I have a 2013 exchange server on premises. Two different domains domain1.com domain2.org. They are both validated and whether you send to domain1 or 2 , email gets delivered.
Barracuda is in front of the server – and I think this is what's causing the issue.
I'm having an issue where I can't receive emails from users from two organizations – we can send emails to them but we can't receive.They are using office 365. Some other organizations using office 365 can send us emails just fine.
Only thing that changed was that the domains were verified using office365 (no other change in dns but the TXT entry took place) and we deleted that too and removed the domains from office 365 – just in case, but i knew this wasn't the issue.
They are receiving this error message when they send us a message.
Text
Server at MN2PR13MB3371.namprd13.prod.outlook.com returned '550
5.4.317 Message expired, cannot connect to remote server(UntrustedRoot)' Server at domain.com (141.414..) returned
'450 4.4.317 Cannot connect to remote server [Message=UntrustedRoot]
[LastAttemptedServerName=domain.com] [LastAttemptedIP=141.414..:25]
BL2NAM02FT031.eop-nam02.prod.protection.outlook.com'
If I use check tls , i get an error in regards to my certificate. However, this error has been there I believe even before this issue happened.
Here is the error, any input ? Has anyone encountered the same issue ?
Connection converted to SSL SSLVersion in use: TLSv1_3 Cipher in
use: TLS_AES_256_GCM_SHA384 Certificate #1 of 1 (sent by MX): Cert
signed by: #1 Cert VALIDATION ERROR(S): self signed certificate So
email is encrypted but the recipient domain is not verified Cert
Hostname DOES NOT VERIFY (mx.domain1.com!=
Barracuda/emailAddress=sales@barracuda.com) So email is encrypted but
the host is not verified
Best Answer
Since there is no issue with other Office 365 tenants, this issue may be related to these two organizations. You mentioned, “Only thing that changed was that the domains were verified using office365” which two? Your domains domain1 and 2?
You may check if there is any logs in Barracuda about the message. And contact O365 to check if the domains are removed totally.