Exch Hybrid - "Security or policy settings have rejected your message" from Exch Onli

[Squan_JRP]

We are running Exchange 2013/Exchange Online in a hybrid configuration.

 

Beginning yesterday, users whose mailboxes are in O365 cannot seem to send messages to any external recipients. They receive a bounced message almost immediately saying "Security or Policy Settings at domain.com have rejected your message."

 

They are still able to send messages successfully to another organization mailbox even if the mailbox is on-prem.

 

Doing message trace on the two messages, this seems to be the difference:

 

TO ON-PREM MAILBOX:

EVENT: Send DETAIL: Message sent to mail.domain.com at xx.xx.xx.xxx

 

TO EXTERNAL MAILBOX:

EVENT: Send DETAIL: Reason: [{LED=550 5.7.1 Unable to relay};{MSG=};{FQDN=mail.domain.com};{IP=xx.xx.xx.xxx};{LRT=5/3/2016 12:29:14 PM}]. OutboundProxyTargetIP: xx.xx.xx.xxx. OutboundProxyTargetHostName: mail.domain.com

 

-----------------------

mail.domain.com and the xx.xx.xx.xxx ip address both point at our on-prem exchange server.

 

This is happening for every O365/exchange online user, but, again, only affects messages to external recipients.

[Dave_O]

I had this some time ago. Do you have any transport rules set up that may hinder mailflow?

[Squan_JRP]

There are transport rules, but nothing that should affect this. In any event, all the transport rules would return their own error, not this generic one.

[Squan_JRP]

This is the error that comes back.

[Squan_JRP]

[h=1]This was the issue. Applied the commands in the article and it began working right away.

 

Important notice about certificate expiration if you have an Exchange 2013 hybrid deployment with Office 365:[/h]https://support.microsoft.com/en-us/kb/3145044