Weird behavior of Exchange Online for none-existing email address

Jack_Chen1780
Brass Contributor
Sep 28, 2022
Thanks Arindam! Your answer helped me to understand a little more of the behavior.

By "sending IP", do you mean there is a "front-end" EOP server and work like :

like "smtp client" -> EOP front-end IP shared between tenants ( sending IP ? ) -> different servers for different tenants?

I can see many (if not all) EOP Canada server share same two IPs currently:
104.47.75.228
104.47.75.164

I am still confused why when testing from a Azure VM to 104.47.75.164, "RCPT TO" is working perfectly for multiple tenant's email addresses; but when testing from Fortimail to same 104.47.75.164, "RCPT TO" doesn't work as expected at all.

I guess the front-end server might have rules :
If the smtp client IP is a known high traffic SMTP servers, don't check with backend tenant server and just accept "RCPT TO" and verify later ;
if it's a unknown client IP, verify the address in "RCPT TO" step with backend tenant servers.
- Arindam_Thokder
  Microsoft
  Sep 29, 2022
  Jack_Chen1780 - Hello Jack, by sending IP, I meant the IP that connects to EOP. The Fortimail IP address must be shared between many tenants and not a dedicated for you. If it's a dedicated IP Address, then you might have an On-premises type connector from that IP Address in your tenant. You can try by deleting the connector or changing the connector type to Partner to see if the behavior changes. But this won't change anything if the Fortimail IP Address is shard.
  - Jack_Chen1780
    Brass Contributor
    Sep 29, 2022
    I am more confused now 😞
    
    EOP should allow any sending IP send emails to any tenants. I don't think you have a way to identify a sending IP belong to a particular tenant.
    
    For example, I have a Azure VM with public IP 20.48.254.109. when I use it to connect to EOP Canada VIP 104.47.75.164 :
    
    telnet 104.47.75.164 25
    Trying 104.47.75.164...
    Connected to 104.47.75.164.
    Escape character is '^]'.
    220 YT3CAN01FT005.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Thu, 29 Sep 2022 13:29:17 +0000
    helo test.com
    250 YT3CAN01FT005.mail.protection.outlook.com Hello [20.48.254.109]
    mail from:email address removed for privacy reasons
    250 2.1.0 Sender OK
    rcpt to:email address removed for privacy reasons
    550 5.4.1 Recipient address rejected: Access denied. AS(201806281) [YT3CAN01FT005.eop-CAN01.prod.protection.outlook.com]
    rcpt to:email address removed for privacy reasons
    250 2.1.5 Recipient OK
    quit
    
    telnet 104.47.75.164 25
    Trying 104.47.75.164...
    Connected to 104.47.75.164.
    Escape character is '^]'.
    220 YT3CAN01FT013.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Thu, 29 Sep 2022 13:30:57 +0000
    helo test.com
    250 YT3CAN01FT013.mail.protection.outlook.com Hello [20.48.254.109]
    mail from:email address removed for privacy reasons
    250 2.1.0 Sender OK
    rcpt to:email address removed for privacy reasons
    550 5.4.1 Recipient address rejected: Access denied. AS(201806281) [YT3CAN01FT013.eop-CAN01.prod.protection.outlook.com]
    rcpt to:email address removed for privacy reasons
    250 2.1.5 Recipient OK
    quit
    221 2.0.0 Service closing transmission channel
    
    I don't believe EOP has any way to identify 20.48.254.109 belong to a tenant; when it is connected to EOP, before the "RCPT TO", there isn't any data indicating which EOP tenant it want to send email. Yet EOP can still correctly response with 500 or 250 for multiple tenants.
    
    The problem is when I do exact same test from Fortimail Cloud 154.52.4.131 , EOP only response with 250.
    
    EOP Canada is treating sending IP 154.52.4.131 and 20.48.254.109 differently.

Forum Discussion

Weird behavior of Exchange Online for none-existing email address

Resources