Exchange 2013 hybrid O365 - smtp outbound issue

[_techie_]

Hi

 

We are moving away from our current mail/anti-spam system due to it being removed by the vendor.

I have setup the following:

 

Exchange 2013 CU 21

Ran Azure AD Connect and users synced correctly with Hybrid Exchange Mode enabled in Azure AD Connect.

We are using password sync for O365 currently.

Current Certificate (wildcard) in use and valid. Its using the new SHA256 that's compatible with Google Chrome v70 and above.

 

Firewall IP's for Exchange Online Protection and Port 25 open to those EOP IP's inbound and outbound on the firewall.

Run Hybrid Exchange Wizard. Wizard created connectors on Exchange On-Premises and on O365. Validated outbound from O365 to On Prem connector is working in Exchange Admin Center on O365.

 

Send connector for On-Prem to O365 using direct MX lookup (NOT SMART host).

 

Test prior to full migration

Send connector for existing relay and outgoing SMTP disabled.

MX records and SPF records changed to ones provided on O365 (but not autodiscover) and mailflow then tested:

1) O365 mailbox to public (iCloud) is WORKING and vice versa.

2) O365 to On-Prem is is working, but NOT Vice Versa - outgoing mail from On-Prem to O365 or Public (iCloud/GMAIL) is not working. Its not even leaving the On-Prem Exchange box and is sat in the queue with Retry. The queue message is attached to this post for perusal, but it doesn't even give an error!

 

I can't even see anything hitting the firewall/filter for this from our Exchange On-Prem IP.

Some brief research meant I tried adding in an additional Send Connector for public mail flow (via O365 as a smart host).

I have even tried disabling and enabling the internal relay option on Accepted domains on O365, but to no avail.

 

This makes me think its something to do with my send connector on my on Prem exchange, but what?

 

Any ideas, I'm stuck on this one!

[mukz]

Hi _techie_, is outgoing mail going through an external smtp relay?

[_techie_]

Currently, yes (our UTM box). Part of the project is to move away from that relay and use Exchange Online Protection.

After changing the MX record, the old send connector that points to this relay is disabled on Exchange On premise.

[mukz]

We had this same issue as you, in the end we ended up ditching the relay earlier than anticipated. The microsoft chap said it is not supported whatsoever!

[_techie_]

So you went straight to full O365 mailboxes, no on premises mailboxes?

 

Cheers

[mukz]

We had a hybrid solution, but no smtp relay, we had installed the edge role on a different server which did the smtp and was supported by o365 hybrid environment.

 

We are now going to move solely to o365, we don’t want to renew a server which has served us for 9 years.

 

So our previous external email system went from Exchange -> Smtp relay -> Recipient

 

Now it is Exchange O365

 

Sorry if none of this is making sense! Had a few too many and its only 3:30 lol

[Netwacky87]

Hi @_techie_ I think I had the same issue as you, just to dig a bit deeper, Is there an error on the Queue Viewer? Don't go into a message error, its on the main screen at the end of the column.

[_techie_]

Hmmm didn't really look at that! In the log for the messages that are getting stuck leaving on Prem exchange, the "last error" is empty.

I have tried updating my SPF record slightly to include the protection.outlook.com part... still no joy though.

 

I am not using the UTM relay at all, just trying to send out from On-prem exchange through O365. Incoming mail is working fine from public and O365 mailboxes into on-prem exchange, just not outgoing...

 

I'll try a bit later and see if I can see any error in the queue...

[Netwacky87]

Have you tried re-running the Hybrid Wizard? I had a problem when going through our smoothwall box. I had a STARTSSL error which I eventually fixed.

[_techie_]

Hmm yes I have a few times... also added in a second send connector with O365 as a smart host for all other public mail (e.g. *)

[_techie_]

Right, ran a few tests again, and the message queue itself is in a retry state, but all messages held within the queue are in a ready state with SCL of -1.

The last column titled error is again blank with nothing showing up.

[Netwacky87]

Right, ran a few tests again, and the message queue itself is in a retry state, but all messages held within the queue are in a ready state with SCL of -1.

The last column titled error is again blank with nothing showing up.

 

Can you screenshot your exchange queue? Is it going through a smoothwall box? Are ports 25/465 open?

[_techie_]

Hi.

Yes going through Smoothwall Box, Port 25, 465 and 587 (as well as HTTPS) all open to Exchange Online IP's from our on Prem exchange box.

Screenshot for firewall rule and queue attached...

[_techie_]

Hi.

 

Can I just check how you have your send connectors setup on your on Prem exchange, and inbound to O365?

Also your accepted domains for on-prem and O365?

 

Also your MX and SPF records (on your Public DNS) would be good too.

 

Cheers

_techie_

[_techie_]

Think I might have found the issue, if I try and telnet to "our-domain.mail.protection.outlook.com", I get redirected back to our Smoothwall UTM box on ESMTP Anti-spam!!!

I'll try turning off the anti-spam and relay before sending out again after changing the MX record...

 

Cheers!

[Netwacky87]

I had to do this for ours to work nicely with Smoothwall... 3 powershell cmds, obviously change the "Outbound to Office 365" to your send connector name.

 

Set-SendConnector -Identity “Outbound to Office 365” -TlsDomain $null

 

Set-SendConnector -Identity “Outbound to Office 365” -TlsAuthLevel $null

 

Set-SendConnector -Identity “Outbound to Office 365” -RequireTLS $false

 

This is on your on-premise exchange server

[_techie_]

Hmm all my settings were different to yours! I have now changed them and will give them a whirl later :-). Thanks muchly

[_techie_]

Thanks thats worked!! Hope you enjoy your New Year, have a drink on me.

Cheers

_techie_

 

I had to do this for ours to work nicely with Smoothwall... 3 powershell cmds, obviously change the "Outbound to Office 365" to your send connector name.

 

Set-SendConnector -Identity “Outbound to Office 365” -TlsDomain $null

 

Set-SendConnector -Identity “Outbound to Office 365” -TlsAuthLevel $null

 

Set-SendConnector -Identity “Outbound to Office 365” -RequireTLS $false

 

This is on your on-premise exchange server

[Netwacky87]

Its all to do with Smoothwall not liking TLS or something, took me AGESSSS to figure this out about 1.5 years ago!

 

Happy New Year

[3s-gtech]

Will bear that in mind myself - I need to improve the protection for our onsite Exchange so was considering using our Smoothie, but I need TLS to be working so that rules that one out. Will probably go hybrid to increase the protection.

[Netwacky87]

Will bear that in mind myself - I need to improve the protection for our onsite Exchange so was considering using our Smoothie, but I need TLS to be working so that rules that one out. Will probably go hybrid to increase the protection.

 

I seem to recall Smoothwall being able to use TLS but its a backend thing with a support call (IIRC)