This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(195.2, 67%, 28%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EDK%3C/text%3E%3C/svg%3E)
We have a hybrid Online/On Prem configuration and I migrated our first account from on prem to online. Everything appears ok other than it can not receive emails from external domains. It can send/receive internal emails and it can send to external.
Scratch that. I can send emails, but can not receive emails internal or external.
Further to this. The error is, according to the bounce:
out2d.electric.net.
Remote Server returned '550-Relaying from <email address> is not permitted. Sender IP is 550 [public ip address of exchange].
Who is electric.net??
I figured it out. The issue was on the on-premise Exchange server. When an email would come in with <alias>@ssss .com the on-prem exchange server would see it as authoritative for that domain, as is should, and then attempt to route the email locally to the user. But the user isn't local anymore, it is on Exchange Online.
I edited the users within the on-premise exchange, clicked on Email Address and changed the Set as Remote Routing Address to the Exchange Online email address <alias>@<tenant>.mail.onmicrosoft.com.
Once that was done, the on premise exchange server started using the send connector created by the wizard and email began flowing.
550-Relaying from
Does there exist any email filter tool, smart host or email proxy tool in your organization? In a hybrid environment, there can only exist Edge server between Exchange on-premise and Exchange online.
So, if there exist such tool, please remove it from your organization, then remove exiting connectors(Send connectors on Exchange on-premises and Connectors on Exchange online) and rerun HCW to create new connector to routing emails in your organization.
About the mail flow security, you could use EOP(Contained in Exchange online) to filter emails for your organization.
By the way, make sure all need ports are opened in your organization: Exchange Online
If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Here is what I know so far. Exchange online can send, but not receive. It can not receive internal or external. I don't see any traffic from on the firewall from timestamps when messages should be relayed from on-prem exchange to exchange online so I assume that must be the connector. Because it is only on the receiving side for exchange online and email flows through our on-prems exchange I believe that means either an issue with the send connector in exchange on-prem or the receive connector in exchange online but as traffic does not appear to be flowing there, I think it is the send connector in exchange on-prem.
We don't have a proxy. But we do pay for a 3rd party service that does spam filtering prior to it reaching our on-prem exchange. Our MX record points to them, and our default send connector does have smart hosts configured to route sent traffic through them. It's not something I can get rid of.
The send connector in the on-prem exchange does not have smart hosts configured to send email through the 3rd party relay. Ohhh.... but the 3rd party might be rejecting.
Unfortunately I can see email flowing through the 3rd party to our on-prem exchange server. So it must be that on-prem send connector.
The email need to be sent from Exchange on-premises to Exchange online directly. There cannot exist other tool between them, otherwise, mail flow will failed.
Here are allowed mail flow in hybrid: Transport routing in Exchange hybrid deployments
Although we have a 3rd party SPAM filter, it can be bypassed.