More EOP O365 Hybrid stuff

[Jawloms]

I've got my hybrid setup now, the wizard ran with no errors at all. I migrated a mailbox using the online EAC from premises to O365 and that went fine too. O365 appears and functions in the management console on my on-prem exchange server.

 

If I try and send an email from an account on premises to the migrated mailbox I get a bounce back giving me a 550 and "The email address that you entered couldn't be found. Check the address and try resending the message.". Everything I can find tells me that the hybrid wizard will have set up my connectors for me, but this implies to me it didn't. I can send to my on-prem mailboxes from my O365 migrated mailbox fine. On my on-prem exchange server I have a send connector called "Outbound to Office 365" and my domain is listed in the "address space" tab. What do I check where please?

 

Thank you

 

Stuart

[Jawloms]

Quick Update;

 

The "Microsoft Office 365 Hybrid Configuration Wizard" runs perfectly. In the Exchange Management Console on my local Exchange server, if I go to "Organization Configuration" and double click "Hybrid Configuration", that wizard fails with;

 

Summary: 2 item(s). 1 succeeded, 1 failed.

Elapsed time: 00:00:15

 

 

Set-HybridConfiguration

Completed

 

Exchange Management Shell command completed:

Set-HybridConfiguration -Features 'MoveMailbox','OnlineArchive','FreeBusy','Mailtips','MessageTracking','OwaRedirection','SecureMail','CentralizedTransport' -Domains 'debenhamhigh.co.uk' -ClientAccessServers 'DHS-EXCHANGE' -TransportServers 'DHS-EXCHANGE' -ExternalIPAddresses '85.92.188.117' -OnPremisesSmartHost 'mail.debenhamhighschool.suffolk.sch.uk' -SecureMailCertificateThumbprint '89D1181F0FD8D336BABA66EB5607DFFAFDC30125'

 

Elapsed Time: 00:00:00

 

 

Update-HybridConfiguration

Failed

 

Error:

Updating hybrid configuration failed with error 'Subtask Configure execution failed: Creating Organization Relationships.

 

 

Execution of the Get-FederationInformation cmdlet had thrown an exception. This may indicate invalid parameters in your Hybrid Configuration settings.

 

The method or operation is not implemented.

at System.Management.Automation.PowerShell.CoreInvoke[TOutput](IEnumerable input, PSDataCollection`1 output, PSInvocationSettings settings)

at System.Management.Automation.PowerShell.Invoke(IEnumerable input, PSInvocationSettings settings)

at System.Management.Automation.PowerShell.Invoke()

at Microsoft.Exchange.Management.Hybrid.RemotePowershellSession.RunCommand(String cmdlet, Dictionary`2 parameters, Boolean ignoreNotFoundErrors)

'.

 

Additional troubleshooting information is available in the Update-HybridConfiguration log file located at C:\Program Files\Microsoft\Exchange Server\V14\Logging\Update-HybridConfiguration\HybridConfiguration_1_27_2021_11_54_22_637473452629344738.log.

 

Exchange Management Shell command attempted:

Update-HybridConfiguration -OnPremisesCredentials 'System.Management.Automation.PSCredential' -TenantCredentials 'System.Management.Automation.PSCredential'

 

Elapsed Time: 00:00:15

 

 

Which I've Googled and haven't got very far.

[chaplic]

in AD, what's the targetAddress attribute of the migrated mailbox? should be something like [email protected]

[Jawloms]

The account I'm testing with is an ex student. His username (and so therefore email address) which I use to log in to his account are surname,initial,[email protected], let's say [email protected]. His targetAddress in AD is [email protected], so I sent an email from my hotmail account to [email protected] and his O365 mailbox received it, whereas I have always been testing sending it to [email protected] as that was his primary email address on Exchange onsite. If I look at his account on O365 Admin Center and go to "Manage username and email", his "Primary email address and username" are [email protected], and under "Aliases" he has "[email protected]", "[email protected]" and "[email protected]".

 

Does that help anything?

[chaplic]

Just a note, username (UPN) and email address are completely seperate

 

Email addresses are defined in the AD field proxyAddresses

 

pop

 

smtp:smithj14@debenhamhigh.co.uk

 

in the proxyAddresses field, wait for replication and job done?

 

edit: misread your statement a little, but still curious to learn about proxyAddresses

Edited January 27, 2021 by chaplic

[Jawloms]

Thanks a lot for this. I put the email address in the paroxyAddresses field and it's still bouncing back, however I made sure another account on prem was correct and then migrated the mailbox up to O365. That one appears very slightly differently in the O365 admin center under "Manage username and email", and when I email it from an on-prem email account, it hasn't failed. It also hasn't appeared in the O365 mailbox though! I'm assuming at some point I will get a NDR.

[chaplic]

For J14, Did his proxyAddresses field already have the address or did you have to add it?

 

Second guy is very odd, it's no in he nature of mail to disappear I'd suggest spam then message tracking

 

Azure AD Connect health is worthy of a looksee (though it's not necessarily up to the minute) and I'd also like to have a look to see what the Azure AD connect is projecting into the metaverse, something like this

 

(On Azure AD Connect, find syncrhonisation service, run as admin, metaverse search

[Jawloms]

Got this back yesterday evening;

 

Delivery is delayed to these recipients or groups:

 

John Smith ([email protected])

 

Subject: Testing

 

This message hasn't been delivered yet. Delivery will continue to be attempted.

 

The server will keep trying to deliver this message for the next 1 days, 19 hours and 52 minutes. You'll be notified if the message can't be delivered by that time.

[chaplic]

what queue is it sitting in?

[Jawloms]

On-prem Exchange

 

[chaplic]

Ok, so I think I know the cause of that problem. Your exchange servers will be referring to an internal DNS server that won't have an MX record for debenhamhigh.co.uk

 

 

However, that's a little moot because on prem shouldn't be trying to send to it. it should arrive in exchange then get resolved to the target address and off it pops to O365 via the mail.onmicrosoft.com address).

 

 

1) From on prem exchange, if you email the target address of our test user, does it arrive?

 

2) Same test to [email protected]

 

3) What's the proxyAddresses, TargetAddress,MsExchRemoteRecipientType, MsExchRecipientDisplayType, MSExchRecipientTypeDetails values of the problematic smithj14 account?

[Jawloms]

Simply haven't had the chance to look at this for the last two days. Finally got an NDR though;

 

Delivery has failed to these recipients or groups:

 

John Smith ([email protected])

The server has tried to deliver this message, without success, and has stopped trying. Please try sending this message again. If the problem continues, contact your helpdesk.

 

 

 

 

 

 

Diagnostic information for administrators:

 

Generating server: DHS-EXCHANGE.debenham-cc3.internal

 

[email protected]

#550 4.4.7 QUEUE.Expired; message expired ##

 

Original message headers:

 

I'll pick it up again Monday.......

[Jawloms]

OK, I finally have time to look at this again. I have started testing with a different test account which has the name Tom Morris. He migrated fine. If I email him from on-prem or from an external hotmail, he never receives anything. After a few hours I receive back a "Delivery is delayed" email. After two days I receive a "Delivery has failed, Queue Expired" email. If I look in the on-prem queue I can see the emails sitting there saying "451 4.4.0 DNS query failed". In his O365 account, he has a mail license. Under "Aliases" he has [email protected] and [email protected].

To answer the questions above, in AD he has;

- msExchRemoteRecipientType: 4

- targetAddress: SMTP:[email protected]

- msExchRecipientDisplayType: -2147483642

- msExchRecipientTypeDetails: 2147483648

- proxyAddresses: There are several, some with and some without "smtp:" prefixed. "smtp:[email protected]" and "smtp:[email protected]" are there.

 

I re-ran the HCW and that still completes fine.

 

Where do I go next?

[chaplic]

BTW is the space in the targetAddress" .com" actually in AD?

 

It looks like something is trying to deliver to the debenhamhigh.co.uk address but using an internal DNS server which doesn't have an MX record for debenhamhigh.co.uk

 

From exchange boxes, can you enter nslookup

enter

set type=mx

and enter

debenhamhigh.co.uk

 

(and for completeness let's try DebenhamHighSchool.mail.onmicrosoft.com too)

[Jawloms]

No, the spaces are added in by this forum.

 

debenhamhigh.co.uk

primary name server = dhs-dc-01.debenham-cc3.internal

responsible mail addr = hostmaster.debenham-cc3.internal

serial = 9

refresh = 900 (15 mins)

retry = 600 (10 mins)

expire = 86400 (1 day)

default TTL = 3600 (1 hour)

 

> DebenhamHighSchool.mail.onmicrosoft.com

Server: DHS-DC-01.debenham-cc3.internal

Address: 10.161.2.11

 

Non-authoritative answer:

DebenhamHighSchool.mail.onmicrosoft.com MX preference = 10, mail exchanger = debenhamhighschool-mail-onmicrosoft-com.mail.protection.outlook.com

 

debenhamhighschool-mail-onmicrosoft-com.mail.protection.outlook.com internet address = 104.47.1.36

debenhamhighschool-mail-onmicrosoft-com.mail.protection.outlook.com internet address = 104.47.0.36

[chaplic]

The user looks fine, all values are as I expect

 

As I thought, exchange is trying to send via MX to debenhamhigh.co.uk

 

Which doesn't have an MX record internally in DNS. The answer isn't to create an MX record as I don't see how this should be happening.

Mail should be coming in, exchange matches it against the [email protected] proxy address then sees it has a target address

 

 

Can you

 

a) from on prem do a message trace of the email to tom?

 

b) lay out the logical order of boxes of mail flow? e.g. Internet->Exchange edge->Exchange-all-role-server

[Jawloms]

I sent Tom an email, then went to Message Tracking, Delivery reports and can see me email when I search my mailbox for emails sent to Tom, but if I click details it tells me it "Couldn't retrieve all the message tracking results. Some of the results come from newer versions of Microsoft Exchange, and they are incompatible with the current version." The ones I sent a couple of days ago now say "Delivery report information for this message is no longer available."

 

I only have the one email server so it is literally external email arrives on one and only Exchange server, which should then ping it over to O365 if appropriate. No Edge servers.