This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(25.6, 26%, 12%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EEH%3C/text%3E%3C/svg%3E)
I have a hybrid Exchange setup where the on-prem Exchange is on a connection with dynamic IP. The ISP did an upgrade and I got a new IP address which was blacklisted. The result was that the on-prem server receives the email, which results in the sender being satisfied the mail is sent and received. However, when the local server tries to forward the email to Office365 the email is dropped and I can see the status FAIL in the message tracking log. The end result is that the email will never arrive in the recipients mailbox and the sender will not resend.
Is there a way to avoid this behavior? Is there some way to tell Office 365 to accept incoming emails from my on-prem server, even if the IP is blacklisted?
Or, as an alternative, is there a way to let these messages stay in the queue on the on-prem server until the IP issue is fixed and Office 365 will accept them? Right now they are dropped at once, never to be seen again.
PS! I know all the reasons why I shouldn't use dynamic IP and hybrid, but that is not part of the question.
Not possible until you get that IP off that blocklist. The ISP should be able to assist.
Even in hybrid, 365 will check that.
P.S. Make sure this new IP is also in your SPF.
Thank you for answering, but it really doesn't resolve the problem that arises from the moment I get a blacklisted IP until I am able to notice and resolve it.
I just renewed my IP address and it was solved for now, but it made me worry about this happening again.
Hi, sorry, yea, ,
You can try that IP adding to the allow list:
https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/configure-the-connection-filter-policy?view=o365-worldwide#scenarios-where-messages-from-sources-in-the-ip-allow-list-are-still-filtered
But 365 will still apply filtering so no guarantee that will work
Let us know if you have any further questions. If not, please accept an answer so this can be closed. Thanks!
Even assuming the method works for a blacklisted IP address, there is a catch: I cannot add the IP address to the exception list since I don't know yet which address I will get.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(246.4, 22%, 33%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EKY%3C/text%3E%3C/svg%3E)
Hi, @Eirik Hamer
I am writing here to confirm with you how thing going now?
Did the problem get resolved?
If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Not yet I am afraid
Sorry to hear that.
Another workaround would be asking Microsoft to remove the ip address from blacklist once you get a blocked dynamic ip address.
While it also works on ip addresses so I suppose it doesn't work for you either.
The problem is not how to fix it when it happens, but to prevent it from happening. By the time it is discovered and fixed there is a risk emails are dropped.
You mean other than not using a dynamic IP? :)
No, I mean other than not getting your IP address blacklisted :)
"PS! I know all the reasons why I shouldn't use dynamic IP and hybrid, but that is not part of the question."
Sometimes the answers are not technical... If you know you are doing something the wrong way, and it's causing you grief, isn't it easier to just do it the right way?
Aside from many RBL's blocking dynamic public address pools, you need reverse PTRs and other features not available with dynamic IP's for headache free SMTP transmission.
-Miguel Fra
https://www.falconitservices.com
Thanks for your sharing!
For a regular, on-prem service I agree totally, and that is also one of the reasons I decided not to run this service from home. However, "doing it the right way" is not an option without considerable cost. I ended up with a hybrid solution since email from actual users will then be sent from Microsofts servers and not mine.
The problem I face is purely related to emails internally in my Exchange organization, and that's why I think it should be up to me whether or not to bounce emails. RBLs and PTRs are not relevant in this scenario. Remember, I am the receiver, not the sender.
Ok, well, if you are using a dynamic IP, then you are stuck :)
I know its not part of what you are asking, but ---really it is. Using a Dynamic IP simply is not something that should be used for this architecture.
Dynamic IP is making it more likely for the problem to occur, but I know the downsides of it. However, this problem can arise even if you have a static IP. Actually, having dynamic IP made it easier for me to fix it myself since I could just renew the address. I still think there should be a way to make sure valid mail doesn't drop after being received by the Exchange organization.
Adding the sending IPs to the allowed list is the only way I know that is possible. Or a rule - if you know the sending IP.
You could also create a transport rule that allows any thing sent from that domain - that also passes DMARC for example.