2

One of my users was migrated to O365 this week. We have a hybrid 365/on premises 2010 mail environment. I've been bashing my head against this for a few days but have gotten precisely nowhere.

External users get NDRs with this error:

4.1.0 - Unknown address error 454-'4.7.0 Failed to establish appropriate TLS channel ATTR41: CertificateExpired: Access Denied [CY1GCC01FT008.eop-gcc01.prod.protection.outlook.com]'

Some internal users get NDRs with this error:

Delivery is delayed to these recipients or groups: [[email protected]] Subject: [email subject] This message hasn't been delivered yet. Delivery will continue to be attempted.

I found a related KB that suggested to re-check the user's SMTP routing address, but it is correctly configured here. User can send external messages and they are successfully received externally; replies and new messages alike do not make it back to user. There are no message delivery restrictions in place. I've tried a variety of external sender domains with no luck, and those domains do work for other users, so it likely is not a filtering issue.

What's next? Why isn't this guy getting external emails?

Improve this question
2
  • What do your exchange logs show, when you trace the messages?
    – Drifter104
    Aug 15, 2018 at 16:41
  • I've seen something similar when a migration went sideways and their mailbox both on prem and in the cloud. If you check O365 it said it was there, if you checked locally with the on prem servers it will show the mail box is there.
    – Nixphoe
    Aug 15, 2018 at 17:37

1 Answer 1

Reset to default
2

Per the NDR message(CertificateExpired: Access Denied), it seems to be a Certificate issue.Please check your Ex2010 server certificate settings:

1.Check that your on-premises email server has Transport Layer Security (TLS) enabled, with a valid certification authority-signed (CA-signed) certificate. We recommend that the certificate subject name includes the domain name that matches the primary email server in your organization. Buy a CA-signed digital certificate that matches this description, if necessary.

2.If you want to use certificates for secure communication between Office 365 and your email server, update the connector your email server uses to receive mail. This connector must recognize the right certificate when Office 365 attempts a connection with your server. If you're using Exchange, see Receive Connectors for more information. On the Edge Transport Server or Client Access Server (CAS), configure the default certificate for the Receive connector. Update the TlsCertificateName parameter on the Set-ReceiveConnector cmdlet in the Exchange Management Shell. To learn how to open the Exchange Management Shell in your on-premises Exchange organization, see Open the Shell.

Details see:Set up connectors to route mail between Office 365 and your own email servers

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .