Fix Exchange Online Not Delivering NDR for Mail-Enabled Security Groups
Question details
The user is not receiving a Non-Delivery Report (NDR) when sending an email to an invalid external address using a mail-enabled security group with Send As permissions.
- Product
- Microsoft Exchange Online
- Device & OS
- not provided
- Scenario
- Sending an email to an invalid external address using 'Send As' permission via a mail-enabled security group.
- Observed behavior
- Unlike regular user mailboxes, the mail-enabled security group fails to deliver the expected NDR bounce-back message to the sender.
Ensure you have Exchange Administrator credentials and access to the Microsoft 365 Exchange Admin Center to run message traces and verify group delivery settings.
Run a Message Trace and Check Group Delivery Restrictions
Use a message trace in the Exchange Admin Center to track the NDR's path and verify if group restrictions are blocking the delivery to group members.
In many cases, the Exchange server successfully generates the NDR and routes it to the mail-enabled security group. However, strict internal group delivery restrictions may prevent the message from reaching individual members.
Log in to the Microsoft 365 admin center and navigate to the Exchange Admin Center using your administrator credentials.
Navigate to Mail flow > Message trace. Enter the sender (the security group) and the invalid recipient details to track exactly where the NDR was routed and if it was dropped.
Go to Recipients > Groups. Select your mail-enabled security group, open the Settings tab, and review the delivery management settings to ensure the group permits receiving emails from external or system senders.
Test 'Send on Behalf' Permissions
Switching the delegation permission from 'Send As' to 'Send on Behalf' can alter how Exchange Online generates and routes bounce-back messages.
Boost Your Productivity with WPS Office
While troubleshooting Exchange server configurations, ensure your local document management is seamless. WPS Office is a powerful, lightweight, and free alternative to Microsoft Office, offering full compatibility with Word, Excel, and PowerPoint formats without the heavy subscription costs.
Frequently Asked Questions
Why do regular user mailboxes receive NDRs but security groups do not?
Regular mailboxes have direct, unrestricted delivery paths for system bounce messages. Mail-enabled security groups often have built-in delivery restrictions or routing rules that prevent system-generated NDRs from being forwarded to the individual group members.
Can a message trace show if an NDR was generated?
Yes, running a message trace in the Exchange Admin Center will display the entire lifecycle of the email. It will show if the NDR was generated by the server, where it was routed, and if it was dropped due to policy restrictions.
Does changing a mail-enabled security group to a Microsoft 365 group fix NDR issues?
It can in some scenarios. Microsoft 365 groups handle email routing and shared inbox features differently than legacy security groups, which can sometimes resolve complex NDR delivery and delegation permission issues natively.
