Fix Exchange Online Rejecting External Mail from On-Premises Server
Question details
Exchange Online is rejecting outbound emails sent from an on-premises Exchange server to certain external domains.
- Product
- Microsoft Exchange
- Device & OS
- not provided
- Scenario
- Routing mail from an on-premises Exchange server through Exchange Online to external email providers.
- Observed behavior
- Emails successfully reach some external providers like Gmail but are rejected by Exchange Online Protection when sent to other external organizations.
Ensure you have Exchange administrator privileges in your Microsoft 365 tenant to view and modify connector configurations, and have access to your on-premises Exchange Server configuration.
Verify Exchange Online Connector and Mail-Flow Configuration
Check and update your certificate-based inbound connector and send connectors to ensure Exchange Online Protection correctly authenticates and routes your relayed messages.
When an on-premises Exchange server routes mail through Microsoft 365, Exchange Online Protection (EOP) validates the origin. If the inbound connector identifying your on-premises organization is missing, misconfigured, or lacks proper TLS certificates, EOP will reject the relayed messages to external domains to prevent spam.
Log in to the Microsoft 365 admin center and navigate to the Exchange admin center.
Go to Mail flow > Connectors. Locate the inbound connector responsible for accepting mail from your organization's email server.
Ensure the inbound connector is set to verify the sender by a certificate. The subject name on the certificate must match the certificate used by your on-premises Exchange server.
Open the Exchange Management Shell on your on-premises server and verify that the Send Connector pointing to Office 365 has TLS enabled and is using the correct routing domain.
Looking for a Reliable Office Suite? Try WPS Office
While resolving complex backend Microsoft Exchange and Outlook routing issues, ensure your daily document productivity remains uninterrupted. WPS Office is a powerful, lightweight alternative to Microsoft Office that perfectly handles all your document needs without expensive subscription fees.
- 1. Download the Installer: Visit the official WPS Office website and download the free installer for your operating system.
- 2. Install WPS Office: Run the downloaded file and follow the quick installation prompts to set up the software.
- 3. Open Your Documents: Launch WPS Office to instantly view, edit, and save your existing Office documents with full formatting preserved.
Frequently Asked Questions
Why does Exchange Online Protection reject mail to specific external providers but not others?
This usually happens because Exchange Online Protection does not fully recognize the on-premises server as an authorized relay source. Some external providers might have more lenient inbound rules, but EOP's internal relay filters will block the outbound attempt if the certificate-based inbound connector is improperly configured.
Do I need TLS enabled to route mail through Microsoft 365?
Yes. Microsoft 365 requires TLS encryption and a valid SSL certificate to securely authenticate and relay messages sent from an on-premises Exchange environment to external domains.
How do I fix hybrid mail flow issues quickly?
The most effective way to repair hybrid mail flow and connector issues is to run the latest version of the Microsoft Office 365 Hybrid Configuration Wizard (HCW) on your on-premises Exchange server, which validates and updates routing settings automatically.
