In Deployment: Directory Based Edge Blocking for Exchange Online Protection

Hi Mike R - If you are in Hybrid mode then you are part of the Exchange Online deployment. You should be able to have your messages rejected within the service for invalid recipients already if your domain is configured as "Authoritative". There is one caveat, though, as EOP requires that your upgrade to the new service is complete. If you are still routing mail through FOPE then the EOP DBEB feature instructions do not apply. I only bring that up because you state that the bounce is not being generated by Forefront. In the current version of the Office 365 Exchange Online service the EOP layer is completely integrated within the message transport pipeline, and there is no more routing through FOPE at all.