Email issue

Posted by jesuiscanard@reddit | sysadmin | View on Reddit | 9 comments

Might not be right place but looking for confirmation of thought process. Tenant A had domain A and domain B. Domain B belongs to a company that spun off and is now in tenant A. Process was grab pst files, delete mailboxes (not users) and delete the domain before setting domain up in tenant b. Then migrate the pst files into new users in tenant b. All good for a month or so. Then suddenly tenant A (several domains) cannot send to tenant b. Both have the same email filter product (but different tenants of and configured with correct email settings). Email leaves tenant A, goes to mx record of filter. Then into Microsoft. Multiple hops in Microsoft Then does not hit the filter but the next message trace is in tenant A received from Microsoft server. Tenant A sends to mx record of the filter and the loop goes on. Tenant A has enhanced filtering setup with inbound connector for the filter. Tenant B has no connectors inbound or outbound. No rules in tenant B, something rules forwarding emails from tenant A are there but unrelated to tenant B. Where could the issue be? This is my sanity check.

Reply to Post

9 Comments

[-]

Single-Space-8833@reddit

Are both tenants using Azure-AD? I have done the same thing you are doing 3 times now. The only time it worked as expected was when both tenants DID NOT have AD integrated. Now I never integrate AD with Azure for security plus the reason outlined below. I ended up have to pay the $500 to MSFT to get the issues resolved on the Azure-Integrated networks.

[-]

jesuiscanard@reddit (OP)

Unfortunately, I didn't do it. I'm left with the requirement to support with seeing half the issue. They are entirely cloud based and use entra id.

[-]

Stephen_Dann@reddit

There is a MS test site for email connectivity, for Exchange and O365. Can't remember it's URL, but it is easy to Google. This can check many things including Auto Discover records. The last time I moved a domain from one tenant to another, used this to check when we had similar problems. Second, setting up a direct connector, even if only for 6 - 12 months

[-]

jesuiscanard@reddit (OP)

Out of curiosity, what was the issue? Wondering if it's already been tested for.

[-]

Stephen_Dann@reddit

There was some conflict with the auto discover which affected email routing. Plus some moved users were being connected to the old tenant and failing because they didn't exist there. This was one of those when MS support were good and fixed the issues.

[-]

RCTID1975@reddit

If this is all in M365, I would open a ticket with Microsoft. Sometimes, breaking off a domain into a separate tenant doesn't go cleanly.

[-]

jesuiscanard@reddit (OP)

Yes. Both M365. Both cloud only.

[-]

stupidic@reddit

Sounds like you made an error in your first sentence. "Domain B belongs to a company that spun off and is now in tenant A." Sounds like that should be tenant B. I would create a direct SMTP rule outbound to bypass filtering from Tenant A to Tenant B so the exchange servers talk directly to each other. Remove as many hops as you can. I would also look at internal MX records that might be on your DNS internally. Tell that exchange connector to explicitly use external DNS (or Internal if you wish) just to ensure you know where the name resolution is taking place. That's where I'd start...

[-]

jesuiscanard@reddit (OP)

Well spotted. I will edit. Both tenancy are entirely cloud based. I presume you're referring to hybrid setups there with DNS? And I can't figure out how else DNS could be involved, but we always know it is dns. Or the printer. I'll look to create the rule in the morning. However, the filter sends to correct MS address, so I would presume it's not the filter (which I guessed at first was the culprit) because that routing appears correct and flags in the headers as correct. Once in Microsoft and the same data centre, the hops between Microsoft servers are plentiful but I can't differentiate tenancies.