SMTP Relay Issue Exchange 2013 to Office 365

[ordeology]

So we have an on-premise exchange server that we use for enabling remote mail boxes and anonymous relay of smtp emails, so this affecting things like scan to email. This was all working perfectly fine until this Monday where we returned from the weekend and it has stopped functioning. Now as far as I can tell, nothing has changed and using wire shark and monitoring the queue viewer, I can see SMTP traffic come in and successfully be relayed out, I can then confirm that I can see this traffic leaving the firewall to the wider internet. I didn't set this up originally so I am picking up the pieces of people long gone who got contractors to set this up when we migrated to office 365. I checked the Microsoft documentation and everything seems to be set up correctly to work. Am I missing anything that will make this work?

[chaplic]

Your (I assume on prem) connector "outbound to office365 (for Anon relays)" is only going to be triggered to the desired recipient email domain is one of the two blacked out, one being the hybrid domain.. are you wanting to be able to email random addresses on theinternet or just people in your tennant?

 

On the 365 end, it has to know how to identify your server, either via certificate or source IP address, could either of those have changed. Also your SPF record must include the external IP address you appear from on the internet when sending from your mailserver

[HPlum78]

I don't know if the following will help you get to a working/ better config and may answer you question of what has changed!

https://docs.microsoft.com/en-us/exchange/mail-flow-best-practices/how-to-set-up-a-multifunction-device-or-application-to-send-email-using-office-3

Edited March 15, 2019 by HPlum78

[ordeology]

Hi,

 

thanks for all your suggestions... it turned out Microsoft had black listed us which we didn't know until we turned on the sendconnector logs... doh...

[ordeology]

I don't know if the following will help you get to a working/ better config and may answer you question of what has changed!

https://docs.microsoft.com/en-us/exchange/mail-flow-best-practices/how-to-set-up-a-multifunction-device-or-application-to-send-email-using-office-3

 

We did find that link useful as we have now started working on moving away from using our on prem exchange sever for SMTP.

[HPlum78]

Ah yes a blacklist will stop you...

[fredbayker]

Has anyone figured out how to avoid getting their IP constantly blacklisted by O365?

It seems to have taken a dislike to our SMTP relay even though the configuration is correct

[HPlum78]

How much SMTP traffic you submitting? What's your architecture? Edited September 20, 2019 by HPlum78

[fredbayker]

I’m unsure, tbh - I’ll have to check the Sophos box. What I can tell you is it’s mainly scanned docs from photocopiers with the odd notification from other bits of software.

 

I would’ve thought that with the office365 connector configured with an accepted domain and IP address for security that it would accept any type of mail protocol traffic from that IP.

[HPlum78]

The issue is that a compromised account would be used to send mail out via SMTP by the shed load so MS have protection in place. Rightly so as it would soon get their IP's blacklisted if they did nothing about spurious traffic.

[chaplic]

Given I'm assuming your volume is fairly low < 10000 day I dont think its any natural o365 limits

 

Have you

 

a) Assuming many reciepients are internal, added the sending IP address into your SPF record?

b) confirmed your sophos box isn't an open relay to the internet?

[fredbayker]

Given I'm assuming your volume is fairly low < 10000 day I dont think its any natural o365 limits

 

Have you

 

a) Assuming many reciepients are internal, added the sending IP address into your SPF record?

b) confirmed your sophos box isn't an open relay to the internet?

 

Cheers for the response.

I’ll certainly take a look at point A.

Can you expand on point B please?

[HPlum78]

So make sure that your smtp server cannot accept message on behalf of other domains (domains you don't own in general)

 

In fact rather than me covering this look at the following:-

http://Https://www.xeams.com/smtprelay.htm

[fredbayker]

Thanks guys for all your help. Turns out your recommendations were spot on. I/we carried out the following:

 

1. The sophos firewall rules were indeed allowing any internal clients to send externally on the any of the usual email ports so we locked it down to just allowing the relay.

 

2. We locked down the relay to accept messages only from specified IPs (photocopiers etc)

 

3. Our traffic used to route through the LAs network and so the IPs addresses in the SPF record belonged to them but that’s no longer the case so we have asked them to change the dns record to reflect the change in IP.