Emails from Exchange online not making it to recipient

Posted by alucard13132012@reddit | sysadmin | View on Reddit | 23 comments

Have a strange issue. A client email address does not get emails we send. It's only for this one user. Everyone else can receive our emails. I'm pretty sure our emails are being blocked because we sent a holiday card via email and they think we are spam. The IT admin on the clients side says they do not see any emails coming from us and the individual user does not have a block in place for our domain. This person uses Exchange on prem and we use Exchange online. After a few days we get an NDR. Looking at the trace it shows: Reason: \[{LED=420 4.2.0 RESOLVER.ADR.Ambiguous; ambiguous address};{MSG=};{FQDN=};{IP=};{LRT=}\] We use Mimecast to send our emails. strange think is, the emails do not make it to Mimecast. Looking at Microsofts traces I can't seem to find where its getting stuck on Microsoft's side. Its as if Microsoft has blocked us but i'm not seeing where.

Reply to Post

23 Comments

[-]

ITguydoingITthings@reddit

Thought I would update this thread since I justt got through it. Maybe some of the info will help... After the issue got passed on from my CSP to Microsoft, there was an interesting tidbit added to the ticket by the Microsoft tech that might have some weight: after deleting the duplicate Guest user entry, ensure you then permanently delete it (I didn't initially). And then, the kicker: >Even after this, you may encounter errors when attempting to remove the user from Exchange, as the attributes may remain for up to 30 days. But for me, the person was only a Guest user, and had no Exchange mailbox. Passed that clarification on, and the next response was in true Microsoft support fashion: >We have taken the necessary action from our end. Please check the issue behavior now and let us know the status. Was indeed fixed, and the test email I sent yesterday went through immediately this morning. What they did though, remains a mystery. I'll try to get the answer and will update.

[-]

cetrius_hibernia@reddit

https://support.microsoft.com/en-gb/topic/-550-5-7-12-550-4-4-7-or-420-4-2-0-ndr-when-a-user-can-t-receive-email-messages-through-eop-in-office-365-dedicated-itar-1d4c2c4a-8983-946f-1c16-d61adff35bba Either you have a contact breaking it Or it's their side not setup properly

[-]

alucard13132012@reddit (OP)

The recipient did have a guest account in our Azure AD which we deleted, but we still can't send emails to them. Because we can email others to the same email domain we think the user individually blocked our whole domain. but the IT admin on that side said they checked and the user doesn't have a block.

[-]

Mammoth_Mango_2699@reddit

We have been experiencing the same issue with M365. Only one or a couple recipients within the same domain are failing with the "420 4.2.0 Ambiguous" error. Similar to your experience, they all mostly appear to be guest users. I deleted one to test, but it didn't help. Were you able to resolve this issue? What was the fix? Thanks.

[-]

alucard13132012@reddit (OP)

Still working with Microsoft on it. They gave me a powershell script to run but it said the object doesnt exist. I did remove the guest account a few weeks ago. I replied back to them this morning telling them the output of the script. waiting to hear back.

[-]

Mammoth_Mango_2699@reddit

Thanks. I just heard from my Microsoft Support Rep who consulted their technical advisor. I'm going to try their suggestion and will reply back if it was successful. Our issue started around December 26, 2024. Everything worked fine to these recipients prior to that date.

[-]

alucard13132012@reddit (OP)

Ours was around Dec 19th/20th. But I think ours is because a user created an O365 group, added 600 client emails to it and then sent the email. I have 3 like this so far. I have not gone through each one to see if i can send an email to them or not. I would suspect if it was all 600, more users would be letting us know that their emails are bouncing. I am also not sure how to tell if they had a guest account previously or not.

[-]

Mammoth_Mango_2699@reddit

In the contacts section of Microsoft Admin Center you won't see them, but if you go to the Exchange Admin Center > Recipients > Contacts, I found duplicate contacts there. These are the same recipients that can't get emails from the organization. When I try to delete the duplicate, I get an error. Further research shows that it will probably be a PowerShell command, but other people still can't delete the users in PowerShell and it requires Microsoft intervention to remove them. I've updated Microsoft Support on this for next steps.

[-]

alucard13132012@reddit (OP)

I will check that out. They gave me some powershell commands on Friday to do. The commands confused me a little because first, I had to use Claud AI to correct it. Then when I ran them it said the object wasn’t in server NAM10 something or another. But then using the same object id to get the mail user did show information. But when I tried to use the remove user azure command it said there was an associated mail account and it couldn’t be deleted.

[-]

poorly-advised@reddit

Were you ever able to figure this out? I have a client experiencing the same issue and Microsoft hasn't been much assistance in the case I have now. All they have really said is that it's an issue on the recipients side. They also have a Microsoft case open and its been ongoing for about a month now with no luck.

[-]

alucard13132012@reddit (OP)

Microsoft support gave me a link that took me to my admin panel with this issue. I copied the text. Admins provisioning guest users in Exchange Online may see that duplicate objects are created Issue ID: EX1015484 Affected services: Exchange Online Status: Service degradation Issue type: Advisory Start time: Feb 20, 2025, 10:38 AM EST More info As a result of duplicate objects being provisioned, user email addressed to the newly created guest users may fail to deliver. Scope of impact Any admin provisioning guest users in Exchange Online may be impacted. Root cause A recent update to the data pathways leveraged to provision new guest users in Exchange Online exposed an error that's causing some guest user data to be duplicated during provisioning, leading to impact. Current status Feb 26, 2025, 2:22 AM EST Our review of the recent update identified a code issue that was present, causing the increased occurrences of guest users seeing duplicate objects created. We've developed, tested, and verified a fix to address this issue, which is in the process of deploying to all impacted environments. We're monitoring this deployment and we'll provide an ETA for its completion once one becomes available. Next update by: Thursday, February 27, 2025 at 5:00 AM EST History of updates Feb 25, 2025, 2:19 AM EST Based on feedback from affected users, this communication and previous communications have been updated for accuracy regarding guest users. Our efforts to determine the most expedient method to remediate impact are ongoing. Feb 24, 2025, 1:27 PM EST We're continuing our efforts to identify the most expedient method to address the provisioning error leading to impact. Feb 24, 2025, 12:13 PM EST Our investigation has determined that a recent update to the data pathways leveraged to provision new guest users in Exchange Online exposed an error that's causing some guest user data to be duplicated during provisioning, leading to impact. We're evaluating potential methods to address the provisioning error and resolve this issue. Feb 24, 2025, 11:29 AM EST We're investigating a potential issue with the Exchange Online service and checking for impact to your organization. We'll provide an update within 30 minutes.

[-]

poorly-advised@reddit

Thanks you! I was able to have the tech assigned to me delete the duplicated guest users on his end (I got errors when I tried), but of course now I can't add those users to a distribution list and the tech has ghosted me for the last week smh. But based on this it looks like they are working on something in the background.

[-]

alucard13132012@reddit (OP)

No resolution yet. They keep giving me powershell command to run which looks like it’s trying to find the duplicate users but it says it can’t find the users as they don’t exist. One of the emails we are having an issue with, the IT guy said he found this (BUG- 5204442) in another forum or something which I gave to support and they said thank you. But I can’t find any reference to it anywhere.

[-]

petarian83@reddit

Try sending a test message to Mimecast by passing Exchange Online and see if that works. You may need to add your public IP address to SPF before Mimecast accepts the message.

[-]

alucard13132012@reddit (OP)

I’m not sure how I would do that since we use Exchange Online and it’s all on Microsoft’s servers.

[-]

petarian83@reddit

You can use a testing utility like Email Sender (https://www.xeams.com/Email-Sender.htm). Ensure you have your public IP in the SPF record. Otherwise, Mimecast will consider that a forged email and will block it.

[-]

Mammoth_Mango_2699@reddit

[-]

RCTID1975@reddit

What's in the message trace?

[-]

alucard13132012@reddit (OP)

Only what I posted above. I did an extended message trace but it doesn’t show anything extra.

[-]

RCTID1975@reddit

But you didn't post anything about the trace other than "i can't seem to find anything" What's actually in the trace? That's where it's going to tell you what's going on.

[-]

alucard13132012@reddit (OP)

When I do a message trace from exchange online it doesn’t give me anything but this: Reason: \[{LED=420 4.2.0 RESOLVER.ADR.Ambiguous; ambiguous address};{MSG=};{FQDN=};{IP=};{LRT=}\] It’s not giving me much, that’s why I’m at a loss. When we send an email, EXO should send it to mimecast for deliver. However it’s not even getting to mimecast. I don’t see anything in the admin panel of exchange that will allow me to find out where it’s getting stuck. The NDR does not show much either other than the canned, try again later and the recipient server might think your message is spam and have them put you on an allow list.

[-]

RCTID1975@reddit

I'd open a ticket with MS

[-]

alucard13132012@reddit (OP)

Our vendor who gives us the licensing with O365, we have a support ticket with them and asked them to escalate it to MS. So strange.