Non-Delivery Report: [550 5.4.1 Recipient address rejected: Access denied]

Relevant Product: Exclaimer Cloud - Signatures for Office 365

Scenario

You have configured Exclaimer Cloud for your Microsoft 365 tenancy. When you send an email to a public folder, the email is not delivered and you receive a non-delivery report with a similar message:

Reason

You received this error message because of the Directory-Based Edge Blocking (DBEB).

By default, the DBEB is enabled for your domains in Microsoft 365 and will reject external emails with addresses that are not present within the Azure Active Directory. 

Public folder mailboxes are not synchronised with the Azure Active Directory and as your emails are routed out to Exclaimer Cloud, then back to Microsoft 365, they are considered external from the DBEB purpose.  

Resolution

The resolve this issue, you need to check if your public folders are hosted on-premise or in Exchange Online.

If your public folders are hosted on-premise

1. Open the Microsoft Azure Active Directory Connect screen.
   
   
2. Select Optional Features on the left-pane, then tick Exchange Mail Public Folders on the right-pane.
    

This will ensure that Mail Enabled Public Folders addresses will no longer be considered invalid addresses by DBEB. And, messages will be delivered to them like they are delivered to any other recipient. 

If your public folders are hosted in Exchange Online

Directory-Based Edge Blocking (DBEB) is not yet supported for Mail Enabled Public Folders hosted in Exchange Online.

But, there are two possible workarounds:

1. Stop routing emails sent to Public folders to Exclaimer Cloud. No server-side signature will be applied. (Recommended)
   
   
2. Disable the Directory-Based Edge Blocking (Not Recommended)

To stop routing emails sent to Public folders to Exclaimer Cloud (Recommended):

1. Log into Exchange Online.
   
   
2. Navigate to Mail flow, then select rules.
   
   
3. Select the rule Identify Messages to send to Exclaimer Cloud.
   
   
4. Click Edit.
   
   
5. Scroll down to the Except if... section.
   
   
6. Click on add exception.
   
   
7. Select the Recipient... Is this person.
   
   
8. In the Select Member's dialog, select all of the public folder mailboxes.
   
   
9. Click Add.
   
   
10. Click OK then click Save. 

To disable Directory Based Edge Blocking  (Not Recommended)

1.  Log into Exchange Online.
   
   
2. Navigate to Mail flow, then select Accepted domains.
   
   
3. Select the domain of the public folder then click Edit.
   
   
4. Under This accepted domain is select Internal relay to disable DBEB.
   
   
5. Click Save.