It seems that order of rules matters!
This means if you want to allow all o365 addresses to be always allowed the permit_mynetworks rule must be on top of each rule (or the one that is responsible for blocking). Once the rule is moved to the top everything started working and it ...
Please perform the following inspections to narrow down this issue(Outlook disconnected):
Did you encounter this issue on an internal/external client or both of them?
Perform a Test E-mail AutoConfiguration in Outlook and see if the Results panel returns the correct URLs and the autodiscover query is successful in Log panel.
For external clients, you ...
Normally, if domain will have several MX records, one of which is intended as a "backup" - with a higher preference number so that it would not normally be picked as the target for email delivery. In the case of errors from the lower-numbered hosts, sending email servers will deliver to the "backup" host: Source
For Exchange server, as ...
It has been a while, how is everything going now? As I know, it would take a while for the permissions to be synced to your Outlook desktop client. So, it is suggested for you to try the same operations again and see if the issue has any difference.
If the issue still continues, since the same send on behalf operation can work fine on your web mail, I'm ...
What is the type of your email client? Is it outlook?
Does the new emails occur to this issue?
I have found a blog on How To Migrate Mailboxes Between IMAP Servers With imapsync, you could compare these steps in it with yours.
This is strange since imapsync doesn't change a byte on messages it transfers, unless told to do so with options like --regexmess or --pipemess
Can you show the headers of a broken message, both on source and destination?
Based on the NDR messages, it seems to be generated from your on-prem Exchange server(server1.domain.com), right?
Did you enable centralized mail transport? Could you find this email on your on-prem Exchange server if you perform a message tracking:
Get-MessageTrackingLog -EventId RECEIVE -Source SMTP -Sender <Sender@domain.com> -Recipients <...
Based on my knowledge, you could not configure MapiOverHttps internaly, and OutlookAnywhere for external connections. Detailed information in the below screenshot and the blog for your reference.
And we cannot configure external or internal authentication for MAPI virtual directory, we only can enable Basic or other authentication by Set-MAPIVirtualDirectory ...
If there are some required mailboxes/public folders on the 2nd server, make sure they are moved to the first server.
After that, as joeqwerty said, just perform uninstall of your Exchange server. You could uninstall the 2nd server via Control Panel or unattended mode(Setup /mode:uninstall /IAcceptExchangeServerLicenseTerms):
If you encounter the error in ...
Did you encounter the connection issue when using internal office PCs? Or did that only when using VPN to build connections?
What's the connectivity status of other services(e.g. ECP, OWA and PowerShell)?
Were you using online mode for Outlook? If so, try enabling cached exchange mode for Outlook and see if it will mitigate this connectivity issue.
A common issue with VPNs is MTU sizes. In some cases the additional VPN headers mean the maximum data that can be transmitted is reduced and packets needs to be segmented if supported or simply dropped
This can manifest in connection being made but once sizeable data is sent to stalls/slows
I would review the MTU size of the interfaces each side of the VPN