As many customers asked for it, we’re happy to announce that Microsoft Exchange Server now officially supports HTTP Strict Transport Security, also known as HSTS.
What is HSTS and how can it help p...
Updated Aug 31, 2023
Version 2.0
Blog Post
benoitdbag 300 is only recommended for testing, if it works the higher values are recommended. Read this:
It’s good practice to start with a max-age configuration of 300 (seconds) which is 5 minutes. After the change has been made, you should closely monitor client connectivity to the Exchange server and roll back the change if any issue arises.
Update to a max-age value of one week (604800) or one month (2592000) and wait for the full max-age of the stage before you move on. A max-age value of one year (31536000) should be set as a minimum from a security point of view and is also at least required, if you plan to add your domain to the HSTS Preload List. Setting the max-age value to a value of two years (63072000) is recommended.
Note
The following examples set the max-age value to 300 seconds which is a configuration that should be used only for validating functionality. Make sure to adjust the attribute value to a higher value when you are ready to bring the configuration to production.
https://learn.microsoft.com/nl-nl/exchange/plan-and-deploy/post-installation-tasks/configure-http-strict-transport-security-in-exchange-server?view=exchserver-2019#enable-hsts-on-exchange-server