NDR when sending email to an On-Prem mailbox.

Vijay Kumar 161

I successfully migrated a mailbox from On-Prem to exchange online. It just working fine, mails are receving and able to send as well. However, user had access to an On-prem mailbox which is still at On-prem. When user sending mail to that mailbox address then getting NDR with following description related to distribution group. I don't know why it's saying distribution group and sender and receiver both are mailbox email adddresses. Remote Server returned '550 5.7.133 RESOLVER.RST.SenderNotAuthenticatedForGroup; authentication required; Delivery restriction check failed because the sender was not authenticated when sending to this group'

Kael Yao-MSFT 37,676 Reputation points Microsoft Vendor

2023-04-25T08:31:11.6266667+00:00

Hi @Vijay Kumar,

However, user had access to an On-prem mailbox which is still at On-prem.

Do you mean the online mailbox sends messages to a on-prem mailbox?

If the online user sends to another on-prem mailbox, would the issue persist?
Vijay Kumar 161 Reputation points

2023-04-25T12:22:06.14+00:00

Do you mean the online mailbox sends messages to a on-prem mailbox? - Yes

If the online user sends to another on-prem mailbox, would the issue persist? - No
Kael Yao-MSFT 37,676 Reputation points Microsoft Vendor

2023-04-26T05:55:26.9166667+00:00
Please run the following cmdlet in on-prem Exchange Management Shell:

Get-ADuser -Identity <affected mailbox> -Properties * | fl msExchRemoteRecipientType,msExchRecipientDisplayType,msExchRecipientTypeDetails
Vijay Kumar 161 Reputation points

2023-04-26T06:31:04.9833333+00:00

Here are the results - msExchRemoteRecipientType : 4 msExchRecipientDisplayType : -1073741818 msExchRecipientTypeDetails : 2147483648
Vijay Kumar 161 Reputation points

2023-04-26T07:14:28.4366667+00:00

Sorry, you need on-prem mailbox details. I checked for online one. Checking again.
Vijay Kumar 161 Reputation points

2023-04-26T07:17:51.2233333+00:00

On prem mailbox has following values - msExchRemoteRecipientType : msExchRecipientDisplayType : 1073741824 msExchRecipientTypeDetails : 1
Vijay Kumar 161 Reputation points

2023-04-26T07:18:35.6033333+00:00

On-Prem recipient mailbox has following values - msExchRemoteRecipientType : msExchRecipientDisplayType : 1073741824 msExchRecipientTypeDetails : 1
Vijay Kumar 161 Reputation points

2023-04-26T07:21:37.3666667+00:00

Looks like there more mailboxes on-prem where user unable to send email from exchange online. I checked the parameter in configuration is correct - ACLableSyncedObjectEnabled : True
Vijay Kumar 161 Reputation points

2023-04-26T07:21:50.0333333+00:00

ACLableSyncedObjectEnabled : True
Kael Yao-MSFT 37,676 Reputation points Microsoft Vendor

2023-04-26T09:12:47.22+00:00

Sorry I suppose I misunderstood the situation.

Are you sending emails from Exchange Online with delegate permission as on-prem mailboxes? (for example using send as)

If yes, is the recipient in the NDR message a mailbox or it is a distribution group?

If possible please post a screenshot or in text of the whole NDR message.

And also get the message tracking log on on-prem server of the mail flow.

(Don't forget to hide your personal information for security)

Thanks in advance for the information.

Vijay Kumar 161

Yes, an online exchange mailbox (Recently migrated) sending email to delegated mailbox which is in On-prem exchange. Recipient is mailbox, not distribution group. Below is the NDR report

From: Microsoft Outlook <MicrosoftExchange329e71ec88aerewrewr34r3er3@xyz.com>
Sent: Tuesday, April 25, 2023 10:50 PM
To: ABC@xyz.com
Subject: Undeliverable: RE: Testing
 
Delivery has failed to these recipients or groups:
DFC (Mailbox) (dfc@xyz.com)
Your message couldn't be delivered because delivery to this group is restricted to authenticated senders. If the problem continues, please contact your email admin.





Diagnostic information for administrators:
Generating server: srv1.xyz.com
dfc@xyz.com
Remote Server returned '550 5.7.133 RESOLVER.RST.SenderNotAuthenticatedForGroup; authentication required; Delivery restriction check failed because the sender was not authenticated when sending to this group'
Original message headers:
Received: from srv3.xyz.com (10.45.92.167) by
 srv1.xyz.com (10.45.92.161) with Microsoft SMTP Server
 (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id
 15.1.2507.23; Tue, 25 Apr 2023 10:20:19 -0700
Received: from NAM11-CO1-obe.outbound.protection.outlook.com (10.45.5.9) by
 srv3.xyz.com (10.45.92.169) with Microsoft SMTP Server
 (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id
 15.1.2507.23 via Frontend Transport; Tue, 25 Apr 2023 10:20:19 -0700
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;
 b=CGc6JOsUOJKHLUBAZilbnFi7NyshJMS9ksWksjdndJHPREPuB9yw24JSm7tK4mpY3qrUY7R8YxgGeoCB9FkI/K45peGI7fcF2HBz1OVGFd/vtWySGVpAUQlUBFeTImghpMN035u+KGj9lnKQEVZ3KtazPD3jssBBz7uPyYFrXaKnP+hq6nPdXooOR0tKMryMxOtAejrp5P+y1CZBBs1UwqlFRGCCBWkEV7moj0UwNKcFhTOFKj/7WDD1IWybPZnDIoOzoLfmA6OzI1y88r1ipSJEMwkRJjq1ALudLt7Vf4/yfoGg95tBv6YlHFVCU9jDsWpiANAYG3VEYDlAhPb24g==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
 s=arcselector9901;
 h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
 bh=cCIdWsPrc3sQnasTKh22vqQDJ73108KAvnkYjVYdxRQ=;
 b=Qtg3tfFTqiYL3fe6iVafDRxKEPXaHZkRcoGjjsyWxiNPHpFdmKj8ILFdWYhuDXJhtH3hY+/KAm/3XkiwpoYPCAUN/cfidH/Z0BmPOnzrot+6YBg5ezpzjmAyPNvWrLPhkUQEk0dslQRrDkFsNEFJkkueH7GqcUa2eH3ZT6Cg0m180cyZgEZEErj2e7T8g2SpSzQdJhjpabouPZ3HA+FUVs3PkxGIFF884AYX6kpppmfsp3pxFw/xts6Fa0AkPFwrKsuOJHpzTTpG5O692eTko/c/7/MWttrORB8c3dFN1hgZH8s7ZwuQnEUZgJPHfb+Y2HtRh2ROV6IQo4GbbRb4kQ==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass
 smtp.mailfrom=xyz.com; dmarc=pass action=none header.from=xyz.com;
 dkim=pass header.d=xyz.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=xyz.onmicrosoft.com; s=selector1-xyz-onmicrosoft-com;
 h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
 bh=cCIdWsPrc3sQnasTKh22vqQDJ73108KAvnkYjVYdxRQ=;
 b=LXo60pJYwsF1mr/HorZj3BFjxFbZB2kzu2CD/vUPrUCADNmgaGMUYi0SSKV3xaFh5NxGCz933/VRb1e/eRevCMfPoxX0fu6ioJYynso7sl3JQU/vKFSq11597cAnr+at41JZPNMbHTunPPanzxjNU0Gu/avErEHoSubJ6tO11k4=
Received: from IA0PR12MB8376.namprd12.prod.outlook.com (2603:10b6:208:40b::9)
 by MN2PR12MB4391.namprd12.prod.outlook.com (2603:10b6:208:269::21) with
 Microsoft SMTP Server (version=TLS1_2,
 cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6298.45; Tue, 25 Apr
 2023 17:20:18 +0000
Received: from IA0PR12MB8376.namprd12.prod.outlook.com
 ([fe80::10c3:c64d:40df:1f69]) by IA0PR12MB8376.namprd12.prod.outlook.com
 ([fe80::10c3:c64d:40df:1f69%2]) with mapi id 15.20.6319.033; Tue, 25 Apr 2023
 17:20:18 +0000
From: ABC <abc@xyz.com>
To: User1 <User1@xyz.com>
CC: "DFC" <dfc@xyz.com>,
        "DFC (Mailbox)" <DFC@xyz.com>
Subject: RE: Testing
Thread-Topic: Testing
Thread-Index: Adl0RyNKOqPdI+SITRStvu9gakghoADG7YPAAA3OrUA=
Date: Tue, 25 Apr 2023 17:20:18 +0000
Message-ID: <IA0PR12MB83763822EB7FDDE52A13B179EF649@IA0PR12MB8376.namprd12.prod.outlook.com>
References: <a4fa488e97ce4884bea0ea2857d37fbf@xyz.com>
 <389a1175a6ff47d29372b6b4f6346afa@xyz.com>
In-Reply-To: <389a1175a6ff47d29372b6b4f6346afa@xyz.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
authentication-results: dkim=none (message not signed)
 header.d=none;dmarc=none action=none header.from=xyz.com;
x-ms-publictraffictype: Email
x-ms-traffictypediagnostic: IA0PR12MB8376:EE_|MN2PR12MB4391:EE_
x-ms-office365-filtering-correlation-id: 86eb81c6-070b-4fe0-0760-08db45b1579f
x-ld-processed: cd426fe2-53cb-405b-9329-a105996c296e,ExtAddr
x-microsoft-antispam: BCL:0;
x-microsoft-antispam-message-info: Xv2dHR/rXFQFnFCUFP70iNfMUfGLTeKBC5Roxpb8SeOpnG7/d1d077iCXFqV/UnE4bs7xMNDRGGyn8SMjYuK6Zw2hOQsjk9feWqnsYAM1EOkHE0la1/VfrDdH4nhV918F7Mz9gaziLAYUoFeuzwSuPMLqyV9+u56BzfxqCW8GIlF+RO/wPPL+rxKDXWfWGghsVNoLSoFrE+PX/Vxn2YPPOru87kuq+2y6X376pRHANxa5KSOSBrlPbiGxLnDnhfqt7kCRGNHvW2PqJ5+k6d+gKPi1+qczgnKMzKgMK8CAIsxf6l0V3sTDDFQ7uDS5L1Hyhd0q81maccAZk/VnEdEwTp/fvNR8GamDLPHfv3KeDw4ULiOcyeYImebcIQ1q+/xBCIEeYOKe8YL151zXiUbiVu5k7LtWqgqDBxp6eqPW/XYu9a6hJZG1EkiQjLUiCK1skmyYNS3vJjT/3d2i55zidlPBGLhhSHHVoK9ZAXDj1yYdMZnQs+EW9U8X0x729SQBavkzeLmkpsatsJWw3sXiyffMfytOGWrBHNRPOCflg66dEVjUjPLWaqBs8yCYvgQFhnCDJf5JV2LZ9+zLnlocv9MLv3dOGUgajzEYU69uLRgX15bO1IHHzJ/yhgGf0l05ypw4Dq8/BHN4GR77n0muA==
x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:-1;SRV:;IPV:NLI;SFV:SKI;H:IA0PR12MB8376.namprd12.prod.outlook.com;PTR:;CAT:NONE;SFS:;DIR:INT;
Content-Type: multipart/alternative;
 boundary="_000_IA0PR12MB83763822EB7FDDE52A13B179EF649IA0PR12MB8376namp_"
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: IA0PR12MB8376.namprd12.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 86eb81c6-070b-4fe0-0760-08db45b1579f
X-MS-Exchange-CrossTenant-originalarrivaltime: 25 Apr 2023 17:20:18.4447
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: cd426fe2-53cb-405b-9329-a105996c296e
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: wVZ9iXMNJsvFyS1oe08qN8M1nRVa9jcQF2OMnN21nqU6u0c4W86WbnQL04a/TS39ldlXQNLnQk8Lh0AX8+lo0zC4+cf1CRTWBmulIhODLno=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MN2PR12MB4391
X-OrganizationHeadersPreserved: MN2PR12MB4391.namprd12.prod.outlook.com
Return-Path: abc@xyz.com
X-CrossPremisesHeadersFiltered: srv3.xyz.com

Kael Yao-MSFT 37,676 Reputation points Microsoft Vendor

2023-04-28T05:58:26.5066667+00:00

Thanks for the detailed information!

Does this recipient mailbox have some forwarding or redirecting rules to a distribution group?

Please also have a check of the message tracking log on the on-prem Exchange server to see if there may be some more information.
Vijay Kumar 161 Reputation points

2023-04-28T10:08:32.5966667+00:00

Yes, it has forwarding from other mailboxes. Means mails from other mailboxes are forwarded to this recently migrated mailbox.

Accepted answer

Kael Yao-MSFT 37,676 Reputation points Microsoft Vendor

2023-05-01T08:28:18.5233333+00:00

Hi @Vijay Kumar,

Please modify the delivery management setting of the distribution group (which is used to receive the forwarded messages) to allow the original senders (who are using the Send As permission) to send to this group.

And see if it helps with this issue.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Please sign in to rate this answer.

1 person found this answer helpful.
Vijay Kumar 161 Reputation points

2023-05-01T12:57:09.3933333+00:00

Thank you so much Kael. Yes, I noticed there were DL getting emails forwarded from mailboxes. I modified delivery management and now email flow is fine. Thanks again.
Sign in to comment

Share via

NDR when sending email to an On-Prem mailbox.

0 additional answers