Troubleshoot mail flow in Exchange Online
Can't send or receive email? Microsoft 365 and Office 365 for business offer admins several ways to troubleshoot. We recommend using the automated solutions because they're typically easier and faster than manual troubleshooting.
For instructions about troubleshooting options, see Find and fix email delivery issues as a Microsoft 365 or Office 365 for business admin.
Troubleshoot mail flow caused by connectors
To validate and troubleshoot mail flow from Microsoft 365 or Office 365 to the email servers in your on-premises organization (also called the on-premises server), validate your connectors. You can set up and validate connectors on the Connectors page in the Exchange admin center (EAC). The built-in validation tests that your mail flow from Microsoft 365 or Office 365 reaches:
Your organization's email server
A partner organization.
For more information, see Validate connectors.
Troubleshoot mail flow issues caused by incorrect SPF records or MX records
How Microsoft 365 uses Sender Policy Framework (SPF) to prevent spoofing gives tips on how to fix several SPF record errors. The beginning of that article also provides an explanation of what SPF records are and how Microsoft 365 and Office 365 use them to prevent spoofing.
Mail flow issues can also happen when your MX record isn't set up correctly. To verify your MX record, see Find and fix issues after adding your domain or DNS records.
Troubleshoot mail flow with thirty-party service
If you're a service provider for Office 365 customers and also an Office 365 customer, then ensure that you don't create an inbound connector of on-premises type using a certificate domain that's same as any of your customers use to send email to Office 365.
For example, if you're Contoso service provider that offers a filtering service for some Office 365 customers, you route emails to Office 365 after you processed them. For this route, you use a TLS certificate with domain name (or SAN) ContosoService.com. However, Contoso service is also an Office 365 customer, your firm needs to relay emails to Office 365. In this route, don't use certificate domain ContosoService.com, and don't create an inbound connector using this certificate domain ContosoService.com. This misconfiguration could cause mail loop for your customers. You must relay your firm's email using a different certificate and configure that certificate domain in the connector.
For more information
Mail flow best practices for Exchange Online and Microsoft 365 or Office 365 (overview)