[RESOLVED]Office 365 Emails sent by devices being rejected after an IP change

[Disease]

Yesterday our external IP changed unannounced by Virgin, now none of our software that emails, Papercut scan to Email on the photocopiers, Veeam notices, Voice2Email from our PBX are sending, the only thing that has changed is our external IP address. Normal email works fine as you are logging into MS servers.

 

I have trawled through the setting in office 365 to try and find where it would be rejecting emails due to our IP but so far no luck.

 

Anyone had something similar before and resolved it?

 

Many Thanks

Edited January 5, 2024 by Disease

[Norphy]

It's probably one of the Exchange Receive Connectors, at a guess. Have you checked those?

 

https://learn.microsoft.com/en-us/exchange/mail-flow/connectors/receive-connectors?view=exchserver-2019

[Disease]

It's probably one of the Exchange Receive Connectors, at a guess. Have you checked those?

 

https://learn.microsoft.com/en-us/exchange/mail-flow/connectors/receive-connectors?view=exchserver-2019

 

 

Thanks, I will have a look at that although we do use a relay DNS record that points to xxxx.mail.protection.outlook.com which is what I surmise is blocking the emails.

[Norphy]

You're thinking it about it backwards there. Chances are that if the receive connector is the problem, it's expecting mail from your old IP address instead of your new one. The DNS record that your devices is pointing at is besides the point.

[chaplic]

Is your old IP address in your SPF record and not the new one?

[Bedders]

Agreed with Norphy - check the Receive Connector in Exchange 365, see if it has an approved IP scope in there.

[TRSJon]

Morning All..

 

I thought receive connectors were only really needed for Office365 if utilising an on-prem exchange server or similar?

 

I also wondered if there was a Conditional Access policy or Named location configured to, maybe, override MFA to allow these devices to send emails?

[chaplic]

Receive connectors are used where you want to tell Office365 something special about the sending party, so for example to allow SMTP relay

 

Conditional Access doesnt apply to SMTP so none of that applies (unless you were using authentication on prem to send as a user)

[Disease]

Morning All..

 

I thought receive connectors were only really needed for Office365 if utilising an on-prem exchange server or similar?

 

I also wondered if there was a Conditional Access policy or Named location configured to, maybe, override MFA to allow these devices to send emails?

 

We have conditional access but I have changed that to reflect the new IP, the receiving connector is changed to the new IP , I have checked the Smoothwall to ensure that the smtp traffic is going through that, still no joy though.

[robintech]

Wonder if it is this

 

https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/how-to-set-up-a-multifunction-device-or-application-to-send-email-using-microsoft-365-or-office-365#step-by-step-instructions-for-direct-send

[chaplic]

Is your old IP Address listed in your SPF record? Looksee at SPF Check & SPF Lookup - Sender Policy Framework (SPF) - MxToolBox

[Disease]

Thanks for all your help the issue is now resolved!

 

As the IP changeover was unannounced to us we had about a day where it was sending out our normal emails from various devices which which Office 365 thought was a spam relay so they blocked our new external IP. To be fair it was pretty quick in the end to get it unblocked thanks to the excellent support from M-Tech Systems.