Search Google Appliance

Technical Issues FAQ

1. FAQ Overview

This informal FAQ is designed to assist helpdesks and IT Support Staff across the University in resolving issues with the Nexus service. It also contains additional detail on supported protocols to inform and assist ITSS.

For historical information concerning the migration to Nexus, please see Historical notes relating to migration from Herald to Nexus.

2. Email Service

Supported Protocols

The following methods of access are supported:

Protocol Port Server DNS/IP Description
Nexus POP 110/995 / POP3 connections
Nexus IMAP 143/993 / Secured IMAP
HTTPS 443 / Secured HTTP connections for OWA, OutlookAnywhere, EWS, OAB, and Availabilty Service
HTTPS 443 / Secured HTTP connections for Autodiscover Service
HTTP 80 / HTTP redirect for Autodiscover Service

The URL to use for clients that utilise EWS is

3. Unsupported Protocols

The following methods of access are not supported:

Protocol Port Server DNS/IP Description
MAPI Various   Unencrypted direct MAPI connections - Use OutlookAnywhere instead (RPC/HTTPS)

4. Resource Mailboxes

I would like a resource mailbox for room booking
We have put in place the appropriate procedures to do this. Please see the Resources section for more information.

5. Distribution Lists

 I have noticed I appear in various distribution groups!
These groups are system-generated. They were designed for use in SharePoint/Exchange for authorization. They do not appear in the Global Address List.
Can I make my own distribution lists?
You can make personal lists in your mailbox. System level lists will be considered where appropriate, especially for use as security groups. For mass mailing purposes, you are strongly encouraged to use the Maillist Service , also run by IT Services. The Maillist Service can include external users, provides an easy interface to add and remove subscribers, and can allow sophisticated configuration of the behaviour of the mailing list (e.g. moderation, automated joining etc.).

6. Global Address List (GAL)

Where did the information come from?
Your entry in the GAL (or Address Book) is built automatically using data from various sources, including the University Card database and the Core User Database.
Where did you get my postal address from?
The address given for you should be the main address of the unit to which you are primarily affiliated. This can be changed, on request.
What is the difference between Company and Department?
The company field holds your primary department/college, and the department field held a list of all your departments/colleges. This list may be truncated (indicated by "/ ..." on the end) when necessary.
My email address is wrong
The email address may have defaulted to the email address of your primary affiliation. If you wish to use another email address that is associated with you, you should be able to switch addresses via:
I have a second (project) account that does not appear in the list. Why?
 Many secondary (project) accounts are set as ex-directory. The reason that project accounts were originally hidden is we had a large number of project accounts with people's personal names as their display names. There are also some whose names may not make sense in a University-wide list, "IT Office" for example. If you want your project account to appear in the address list we advise you to contact:

For each account you needed to supply:

  • The account username

  • A sensible display name

  • The email address

My account does not appear in the Global Address List
Users recorded as Ex-Directory with IT Services Registration do not appear in the GAL. Also, by default accounts matching the following criteria were hidden:
  • Project accounts

  • Accounts belonging to individuals with status of pgoffer, ugoffer, leaver, cardholder and virtual

  • Accounts that have expired

Accounts can be unhidden on request.

7. Project Accounts

I have a second (project) account that does not appear in the global address list (GAL)?
 See GAL section above
I cannot connect Outlook to my project account
 See GAL section above
I would like to send email from my project account address using my main account
SendAs (or SendOnBehalf) with FullAccess rights can be set on project accounts to allow someone to use their main account to send mail with an alternative address. These rights are controlled centrally and cannot be set using Outlook. The IT Services Helpdesk can now assign SendAs, SendOnBehalf with FullAccess rights on request. Registration Services will not apply rights the other way: a project account over a user account. Authorization to setup such delegations must come from:
  • The registered Department/College ITSS of the user who owns the project account

  • The owner of the project account

 Note: A "user" of a project account is not authorised to request SendAs or SendOnBehalf rights unless they own the project account.

I cannot send from my project account despite having the correct rights assigned
You must change the From field to be 'Send From Other E-mail Address' and then select that identity from the Global Address List. If you reply to a message from the inbox of that account this field will be filled in for you (this can be used to prove the permission is working). Note that this address cannot simply be typed in. If this field has been filled in incorrectly Outlook will cache that entry and so this must be explicitly deleted.

8. Junk Email/spam Filtering

How do I change my spam settings?
These settings can be changed on the self-registration web-site:
My spam filtering does not appear to be working
First check that spam filtering is enabled on your Nexus account by visiting the self-registration web-site: If the spam filtering is enabled here but filtering is still not working then login to OWA via and double check the "[Automatically filter junk e-mail]" setting in the [Options] -> Junk E-mail screen is enabled.
Can I block some spam completely?

The Junk mail filters on Nexus are not set to automatically discard email that passes a certain spam scoring threshold. To compensate for this, the Nexus Junk E-mail folder automatically deletes emails from the Junk E-mail folder (and ‘Deleted Items’) after 90 days. Some users are annoyed that some persistent spam, or irksome personal messages still arrive in their Junk E-mail folder. These people can be helped by either creating a rule on the Junk E-mail folder to delete certain emails immediately, or in the judicious use of Blocked Senders. See:

How does spam filtering work?

The spam-filtering process is explained in detail here:

9. What happens to a user's mailbox when their University Card expires?

When someone's University Card expires and they leave Oxford (and this notably includes "student leavers") their mailbox is usually deleted after 3 months. Departing users can usually extend this period if they ask for an extension at the IT Services Help Centre.

Users can set up forwarding that works for 2 months following departure/card expiry.

N.B. OOF = Out of facility message = Out of Office = Vacation Autoreply

Consider 3 categories of departing users: (A) Users who have forwarding set; (B) users who have a vacation message set (OOF); (C) users who have neither OOF nor forwarding set.

On card expiry, all 3 groups of users cease to have access to their mailboxes. For users in groups A and B, nothing else happens until the end of month 2. Users in group C have an OOF created saying that, "This account is scheduled for deletion. It is unlikely that your message will be read." (Also, if a mailbox belonging to group B has its OOF expire or switch off before the end of two months, that change should be detected within hours and the standard message applied.) At the end of month 2, mailboxes are 'detached' (or 'disabled'), and the routing tables are changed so that mail will not enter Nexus from outside. After a further one month, the mailboxes are deleted, but remain on tape for about 60 further days. (Tape retention policy is subject to change, however, and should be detailed in the Exchange SLD).

See also

10. Does using a NAT (or NAPT) device cause problems with Nexus?

In short, yes it can. There is a default limit to the number of connections per minute that are accepted from a single IP address. This can be caused by the sheer numbers of users behind a Network Address (and Port) Translation device and/or by some users having a large number of connections being opened rapidly. Users may find the interface via Outlook or Outlook Web App to be very slow or intermittently problematic. They may also see "This webpage is not available" when trying to log in to OWA or SharePoint.

Note that the limit applies to usage of both Exchange and SharePoint. It is often the multiple connections that can often occur per user when interacting with Exchange that can cause the limit to be exceeded. However, once exceeded, it can affect SharePoint users as well as Exchange users.

If you wish to use a NAT/NAPT device in front of users who are likely to access Nexus (Exchange and SharePoint), please register this device with the Nexus Team. Send the IP address(es) to prefixing the subject line [ITSS] with a short explanation. Once the exception is created at the Nexus Threat Management Gateway your users' performance issues should be resolved.


Service area: 

Written by IT Services. Latest revision 17 October 2017