How to Exclude Exchange Online NDR Messages from a Transport Rule
Question details
The user needs a method to prevent Exchange Online from routing Non-Delivery Reports (NDRs) through an outbound connector to a third-party gateway.
- Product
- Exchange Online
- Device & OS
- not provided
- Scenario
- Configuring outbound mail flow rules and connectors for routing emails to a third-party email security gateway such as Barracuda.
- Observed behavior
- NDRs are sent with an empty envelope sender, causing them to be rejected by the third-party gateway when the transport rule forces them through the outbound connector.
Ensure you have Exchange Administrator privileges in your Microsoft 365 tenant and can access the Exchange Admin Center to modify mail flow rules.
Modify Mail Flow Rule Exceptions in Exchange Admin Center
Update your transport rule to include specific exceptions for system-generated delivery status notifications (DSNs) so they bypass the third-party connector.
Because NDR messages use an empty sender address (Return-Path: <>) to prevent email loops, standard sender-based exceptions in transport rules often fail to catch them. You must use exceptions based on message type.
Log in to the Microsoft 365 admin center and navigate to the Exchange Admin Center (EAC).
Go to 'Mail flow' > 'Rules'. Select the transport rule that routes your outbound messages to the third-party connector, and click the 'Edit' button.
Scroll down to the 'Except if' section. Add a new exception for 'The message properties' > 'include the message type'.
In the pop-up selection, choose 'Delivery status notification (DSN)' or 'Auto-reply' to explicitly exclude system-generated NDRs from this routing rule.
Save your changes to the transport rule. Send a test email to an invalid external address to trigger an NDR and confirm it is no longer rejected by your gateway.
Escalate to Microsoft Support for Custom Connector Fixes
If standard Exchange Online rule exceptions fail to bypass the NDR routing, escalate the issue to Microsoft Support for advanced backend configuration.
Boost Your IT Productivity with WPS Office
While resolving Exchange Online routing issues requires Microsoft's administrative tools, documenting your IT infrastructure, server configurations, and support logs is much easier with WPS Office. Enjoy a lightweight, highly compatible alternative to Microsoft Office that is completely free to use.
Frequently Asked Questions
Why do NDRs have an empty envelope sender in Exchange Online?
Non-Delivery Reports (NDRs) use a blank envelope sender (Return-Path: <>) by design. This follows standard RFC email protocols to prevent infinite email loops if the NDR itself cannot be delivered to the original sender.
Why does Barracuda reject emails with empty envelope senders?
Third-party email security gateways like Barracuda often block emails with empty sender addresses as a strict security measure to prevent spam and spoofing attempts. This can usually be adjusted in the gateway's sender policy or routing rules.
Can I use message headers to exclude NDRs in Exchange rules?
Yes. If standard message-type exceptions fail, you can create a mail flow rule exception that looks for specific NDR characteristics in the message header. For example, setting an exception where the 'Report-Type' header includes the text 'delivery-status'.
