I've had most success so far with this approach (Tigunov's config - https://gist.github.com/taddev/7275873).
( btw, I'm using Basic Authentication rather than NTLM ).



server {
server_name mail.contoso.com;
server_name autodiscover.contoso.com;
keepalive_timeout 3h;
proxy_read_timeout 3h;
#reset_timedout_connection on;
tcp_nodelay on;
listen 443 ssl;
client_max_body_size 3G;
#proxy_pass_header Authorization;
proxy_pass_header Date;
proxy_pass_header Server;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Accept-Encoding "";
proxy_pass_request_headers on;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_http_version 1.1;
proxy_request_buffering off;
proxy_buffering off;
proxy_set_header Connection "Keep-Alive";

location / {
proxy_pass https://exchange.internal/;
proxy_next_upstream error timeout invalid_header http_500 http_503;
}

}

With Microsoft's Remote Connectivity Analyzer, I now get up to the point where ActiveSync is tested. "OPTIONS" works, FolderSync fails ( something about a request being aborted or canceled, no further details ).