This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(316.8, 43%, 40%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EBT%3C/text%3E%3C/svg%3E)
We are running Exchange 2016.22 in Hybrid mode.
Bill's account is in ExO.
Kevin's is on-premise.
If Bill turns on his OoO, and Kevin sends him a message, Kevin receives the EXTERNAL OoO message, not the Internal.
Works the same the other way, ie if Kevin sends to Bill.
On the on-premise mailboxes, it all works fine as well.
In the ExO, it all work fine.
Not sure what is up.
When I look at the special header line, it is signed "Internal".
X-MS-Exchange-CrossTenant-AuthAs: Internal
I'm not sure why this is working this way.
Here's a header, in case that provides any insight:
Received: from YQBPR0101MB5941.CANPRD01.PROD.OUTLOOK.COM
(2603:10b6:c01:34::20) by YQXPR01MB6640.CANPRD01.PROD.OUTLOOK.COM with HTTPS;
Thu, 14 Apr 2022 23:16:17 +0000
Received: from YT1PR01CA0108.CANPRD01.PROD.OUTLOOK.COM (2603:10b6:b01:2c::17)
by YQBPR0101MB5941.CANPRD01.PROD.OUTLOOK.COM (2603:10b6:c01:34::20) with
Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5164.20; Thu, 14 Apr
2022 23:16:16 +0000
Received: from YT3CAN01FT012.eop-CAN01.prod.protection.outlook.com
(2603:10b6:b01:2c:cafe::3e) by YT1PR01CA0108.outlook.office365.com
(2603:10b6:b01:2c::17) with Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5164.20 via Frontend
Transport; Thu, 14 Apr 2022 23:16:16 +0000
Authentication-Results: spf=none (sender IP is 208.98.204.234)
smtp.helo=mail.parksville.ca; dkim=none (message not signed)
header.d=none;dmarc=fail action=none header.from=parksville.ca;
Received-SPF: None (protection.outlook.com: mail.parksville.ca does not
designate permitted sender hosts)
Received: from mail.parksville.ca (208.98.204.234) by
YT3CAN01FT012.mail.protection.outlook.com (10.118.140.122) with Microsoft
SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256) id
15.20.5164.19 via Frontend Transport; Thu, 14 Apr 2022 23:16:15 +0000
Received: from COP-MAIL.city.parksville.bc.ca (192.168.2.31) by
COP-MAIL.city.parksville.bc.ca (192.168.2.31) with Microsoft SMTP Server
(version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id
15.1.2375.18; Thu, 14 Apr 2022 16:16:14 -0700
Received: from COP-MAIL.city.parksville.bc.ca ([::1]) by
COP-MAIL.city.parksville.bc.ca ([fe80::1cb3:baaa:502f:e73%12]) with Microsoft
SMTP Server id 15.01.2375.018; Thu, 14 Apr 2022 16:16:14 -0700
Content-Type: multipart/mixed;
boundary="_000_8de3e6e463df4e3392f7f42c63c58d02COPMAILcityparksvillebc_"
From: Deanne Dieleman <DDieleman@parksville.ca>
To: Bill Tkach <BTkach@parksville.ca>
Subject: Automatic reply: Cisco Renewals
Thread-Topic: Cisco Renewals
Thread-Index: AQHYUE8o/ZS8Do9uiUWH8Sdwu/kep6zv/qOAgAAKQkCAAAGiMIAAACCH
Date: Thu, 14 Apr 2022 23:16:14 +0000
Message-ID: <8de3e6e463df4e3392f7f42c63c58d02@COP-MAIL.city.parksville.bc.ca>
References: <UMwg1000000000000000000000000000000000000000000000RACP5K00QZBpri2PRVWntjncOxJZwg@sfdc.net>
<YQXPR01MB664070A0EA13CB9A7C4DF4BAC0EF9@YQXPR01MB6640.CANPRD01.PROD.OUTLOOK.COM>
<c7c99a0ca0404b3ea8aa7a3cf949045e@parksville.ca>,<YQXPR01MB6640B32DED1FF89689F3AFC8C0EF9@YQXPR01MB6640.CANPRD01.PROD.OUTLOOK.COM>
In-Reply-To: <YQXPR01MB6640B32DED1FF89689F3AFC8C0EF9@YQXPR01MB6640.CANPRD01.PROD.OUTLOOK.COM>
X-MS-Has-Attach:
X-Auto-Response-Suppress: All
X-MS-Exchange-Inbox-Rules-Loop: DDieleman@parksville.ca
X-MS-TNEF-Correlator: <8de3e6e463df4e3392f7f42c63c58d02@COP-MAIL.city.parksville.bc.ca>
x-ms-exchange-parent-message-id: <YQXPR01MB6640B32DED1FF89689F3AFC8C0EF9@YQXPR01MB6640.CANPRD01.PROD.OUTLOOK.COM>
auto-submitted: auto-generated
x-ms-exchange-generated-message-source: Mailbox Rules Agent
x-exclaimer-md-config: 656574dc-420f-48ad-8927-61c710e7c5a6
MIME-Version: 1.0
X-OrganizationHeadersPreserved: COP-MAIL.city.parksville.bc.ca
Return-Path: <>
X-MS-Exchange-Organization-ExpirationStartTime: 14 Apr 2022 23:16:16.5732
(UTC)
X-MS-Exchange-Organization-ExpirationStartTimeReason: OriginalSubmit
X-MS-Exchange-Organization-ExpirationInterval: 1:00:00:00.0000000
X-MS-Exchange-Organization-ExpirationIntervalReason: OriginalSubmit
X-MS-Exchange-Organization-Network-Message-Id:
e58f3b72-7e96-4965-17a4-08da1e6cc6ba
X-EOPAttributedMessage: 0
X-MS-Exchange-Organization-MessageDirectionality: Originating
X-MS-Exchange-Organization-AuthAs: Internal
X-MS-Exchange-Organization-AuthMechanism: 03
X-MS-Exchange-Organization-AuthSource: COP-MAIL.city.parksville.bc.ca
X-MS-Exchange-Organization-SCL: -1
X-CrossPremisesHeadersPromoted:
YT3CAN01FT012.eop-CAN01.prod.protection.outlook.com
X-CrossPremisesHeadersFiltered:
YT3CAN01FT012.eop-CAN01.prod.protection.outlook.com
X-MS-PublicTrafficType: Email
X-OriginatorOrg: parksville.ca
X-MS-Office365-Filtering-Correlation-Id: e58f3b72-7e96-4965-17a4-08da1e6cc6ba
X-MS-TrafficTypeDiagnostic: YQBPR0101MB5941:EE_
X-ExclaimerHostedSignatures-MessageProcessed: true
X-Microsoft-Antispam: BCL:0;
X-Forefront-Antispam-Report:
CIP:208.98.204.234;CTRY:CA;LANG:en;SCL:-1;SRV:;IPV:NLI;SFV:SKI;H:mail.parksville.ca;PTR:InfoDomainNonexistent;CAT:NONE;SFS:;DIR:INB;
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 14 Apr 2022 23:16:15.8389
(UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: e58f3b72-7e96-4965-17a4-08da1e6cc6ba
X-MS-Exchange-CrossTenant-Id: c97f1f64-f227-400b-8e81-832107adcac2
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=c97f1f64-f227-400b-8e81-832107adcac2;Ip=[208.98.204.234];Helo=[mail.parksville.ca]
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: COP-MAIL.city.parksville.bc.ca
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: YQBPR0101MB5941
X-MS-Exchange-Transport-EndToEndLatency: 00:00:01.3965669
X-MS-Exchange-Processed-By-BccFoldering: 15.20.5164.020
X-Microsoft-Antispam-Mailbox-Delivery:
ucf:0;jmr:0;auth:0;dest:I;ENG:(910001)(944506458)(944626604)(920097)(425001)(930097);
X-Microsoft-Antispam-Message-Info:
MMc+XFAI93Hu4/Ib4CzXDvVjAV5LWeoX01usE87uwQ6YmRZFy7C6+ULbA47Six7Z3dMtaFfgsi7Tu/oQObZuFBTrxYNc+GW949SS+UgmohoCD7bBj5+sQX83PvJCC01k42Q0V7+5jjAy7XbcD1zmXuWixb0XJwa6eDp16wTS5dwZvbOjff5cPrq90U/BN19YtnmwcPfeYFBiE1eAQWOYqSNTNdrOSuRzFYidcyyqmilYuezr4bYGAjZvoXWqJCdr5SqFaXSwWHL3jH06fmHMODcmI1ljuCYn0d+uIQXg19EL8ZUE0Cdw10SLCD+vNncNGzANCYJ5GVAF5vvRzit71x9GjP+UChNk9wPasuVphLPm2R0hIru5/izX5Z3XlwoU8q8OQz94utb1cSGXV/2BtDAcAj3GD5DsnfXYJhNpahbTs4QFSFD23MIj8TxMXWIAkQ+Uq0U2xvBnbIWAf5JpMoqcjzMDfogYLSW+SaNCj6cYqemxMCj3/HQ++3tG6vrNbkYbq4ew3pqbeduvfrtwopmy8oRwV9eDgtH+S10tyoUXkeaYOPAzY6TmtdNvByvdHqZNTan29kU5OUuiFhdLPfYeSGVH2gch4EBeCCdDYMDcW6XgOSyC3RRyVi2/I2B+
I am writing here to confirm with you any update about this thread now.
If the suggestion below helps, please feel free to accept it as an answer to help more people.
I tested it in my lab and got the same result.
After my research, this is related with remote domain configuration on Exchange on-premises.
You could use the command below to check remote domain on your Exchange on-premises:
Get-RemoteDomain
Then set hybrid domain as Internal:
In this way, when Exchange online sends emails to Exchange on-premises mailboxes, Exchange on-premises mailboxes will return the internal OOF.
Note that enabling OOF will only trigger once for the same user. You need to disable OOF and enable it again. Otherwise, this user will not receive OOF.
If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Sorry I edited this reply, because I didn't test it completely.
On our on-prem, I ran the Get-RemoteDomain and then I ran the two Set-RemoteDomain cmds, in order to set the IsInternal to true.
Name DomainName AllowedOOFType
---- ---------- --------------
Default * ExternalLegacy
Hybrid Domain - parksville.... parksville.mail.onmicrosoft.com External
Hybrid Domain - parksville.... parksville.onmicrosoft.com External
I then, in an Exchange Online account, set out of office to on, and then sent an email from an on-prem account.
The issue was no longer there, when someone sent me a message from onprem to my M365.
However, in the opposite direction, EOL to OnPrem, it still returns the incorrect Out of Office.
Do I need to do the same thing on the M365 side, to trust it as internal?
I did connect to Exchange online and run the get-remotedomain, but it only shows one the primary connection.
Name DomainName AllowedOOFType
---- ---------- --------------
Default * ExternalLegacy
Are there any other negative ramifications to setting that value to true? Am I disabling virus scanning, or email protection, or filtering?
Thanks for the help
About that, you could add the local domain as remote domain, then set the "IsInternal" for it:
New-RemoteDomain -DomainName *.localDomain.com -Name LocalDomain
Get-RemoteDomain localDomain | Set-RemoteDomain -IsInternal $true
If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
I'm confused by why this would be happening. Shouldn't the hybrid connection that is set when I run the hybrid wizard account for this issue?
I don't think I should have to add the local domain as a remote domain for this to work. Again I'm concerned about the security ramifications of doing this.
Does this mean that my hybrid connection to Exchange Online was not configured correctly in the first place?
Thanks for your help.
No, your hybrid is configured correctly.
I think mail flow in hybrid was judged to be Internal by modified message header, but in essence, emails still belong to two different environments. So, the external OOF is trigger.