Skip to main content

Non-Delivery Report: [550 5.7.64 TenantAttribution; Relay Access Denied]

Michael Valvona
  • Updated

Scenario

You have configured Exclaimer Cloud for your Microsoft 365 tenancy. When you send an email, you find that it is not delivered, and you receive a Non-Delivery Report with a similar message:

ERROR! 550 5.7.64 Relay Access Denied ATTR36

 

ERROR! 550 5.7.367 Remote server returned not permitted to relay

 

ERROR! 451 4.4.62 Mail sent to the wrong Office 365 region.

Reason

When the server-side configuration runs in Exclaimer Cloud, mail flow settings, including mail flow rules, send and receive connectors, and a secure certificate domain, are created in Exchange Online. Once created, these settings should automatically replicate to every other Microsoft Exchange Online server in the cluster of servers to which your Microsoft 365 tenant belongs.
Usually, this replication occurs within a few minutes, and Microsoft recommends allowing one hour for such changes to replicate fully. Still, occasionally, these settings take a lot longer, or they fail to replicate entirely.
After an email is sent to Exclaimer Cloud for a signature to be applied, Exclaimer Cloud will route the email back to the same Microsoft 365 tenant using the MX record for the domain. Any Exchange server in the cluster can try to accept the email back from Exclaimer Cloud.
Suppose the server that tries to accept the email back from Exclaimer Cloud does not have a copy of the mail flow settings configured by Exclaimer Cloud. In that case, it cannot accept the message as it does not meet the criteria imposed by Microsoft Exchange Online's default configuration of not allowing the relaying of emails through servers where the recipient doesn't belong to the organization. The server will reject the email with the error Relay Access Denied.

Resolution

Please click on the required options listed below to go through the detailed description:

Step 1 - Check your mail routing settings
  1. Log into the Exclaimer portal (portal.exclaimer.com) and Launch your subscription.

  2. Use the banner at the top of the page to switch to the old user experience.

  3. Click on the options list from the top-right of your screen and select Settings. 
    Example:



  4. The Settings window is displayed; select the Mail Flow tab.

  5. Click the Edit button under Mail Routing.



  6. From the Mail routing mode drop-down, select Static Domain.



  7. In the Domain name, enter the Microsoft 365 domain name (ending in .onmicrosoft.com).
    For more information, see Where can I find my .onmicrosoft.com domain name?

  8. Click Save to save the changes.
Step 2 - Limit the scope of the Exclaimer Mail flow rule to ensure that end-users are unaffected
If you select Send all email to Exclaimer during configuration, it might be essential for you to, at this stage, to reduce the impact on end-users by ensuring that mail flow is unaffected. To restrict which user's emails are routed to the Exclaimer Cloud servers, you can modify the mail flow rule in Exchange Online to only send an email to Exclaimer Cloud if the sender is a member of a group in Microsoft 365.

To modify the mail flow rule:

  1. Sign in to the Exchange Online admin portal (https://admin.exchange.microsoft.com) as an Administrator.

    The Exchange admin center is displayed.

  2. From the left-hand navigation menu, select Mail flow, then select Rules.

  3. In Rules, select the Identify messages to send to Exclaimer Cloud rule.

  4. Click Edit rule conditions.

  5. In the Apply this rule if section, click the add button (+).

    Example:
  6. Specify a condition to limit the rule to one or more test users.

    For example, The sender is a member of this group
  7. Click Save.
You will need to allow up to an hour for the changes to take effect.
Step 3 - Ensure that you have allowed sufficient time for replication
Sometimes the replication of mail flow settings takes longer than an hour. It may be best to leave the changes replicating for several hours and come back the next day to see if it has succeeded.
We recommend attempting Step 4 - Recreate the mail flow settings after at least one hour has passed since last creating the mail flow settings.

Step 4 - Recreate the mail flow settings
Recreate the mail flow settings to help force the replication to occur:
  1. Log in to the Microsoft 365 admin center.

  2. Navigate to Settings > Domains (https://admin.microsoft.com/Adminportal/Home?source=applauncher#/Domains).

  3. Locate and select the domain ending smtp.exclaimer.cloud or smtp.excl.cloud.

  4. Click Remove domain.

  5. Confirm that you want to remove the domain.

  6. Log into your Exclaimer Cloud subscription.

  7. From the left-hand pane, click Configuration, then select Manage Mail Flow.

  8. If you have limited the scope of the Exclaimer Mail flow rule to a group as part of step 2 above, then untick Send all email to Exclaimer, then enter the group name in Test Group Name.

    NOTE: If you created a new group for this purpose, you would need to start a manual data synchronization before proceeding with these steps.

  9. From the right-hand pane, under Connect to Microsoft 365, click Connect.

  10. Complete the setup as per the guide here:https://support.portal.exclaimer.com/hc/en-gb/articles/360018693078
Once you have completed the setup, please allow at least one hour.
NOTE:

If you have already attempted to force the replication of mail flow settings by re-running the connection wizard and have waited for several hours for the replication to take place and are still seeing the

ERROR: 550 5.7.64 Relay Access Denied ATTR36

We recommend you raise a ticket with Microsoft Support requesting assistance replicating your mail flow settings. Microsoft Support agents previously have been able to force the replication for tenants by running a script on their side.

If you need more help with this issue or need input from Exclaimer for your Microsoft Support ticket, please raise a ticket with Exclaimer Support, and we will be happy to help.