Sharepoint Online Sharing Emails – Rejected / Bounced / NDR

If you have a 3rd party mail security system, or you have locked down Office 365 inbound mail flow, you may notice that when you attempt to share something with an internal colleague in SharePoint Online, the sharing invitation NDRs and gets bounced back. If your mail goes direct to Office 365 and you have configured an Inbound Connector in order to lock down inbound mail (eg to only allow Mimecast to send mail to Office 365), you may see the following error:

Your message wasn't delivered because the recipient's email provider rejected it.

Alternatively, your 3rd party mail hygeine product (in my case, Mimecast) blocked the message before it could get to Office 365 with a slightly different error:

Remote Server returned '< #5.5.0 smtp;550 Administrative Lockout - Inbound not allowed >'

The reason for this error is because the SharePoint Online service is spoofing your email address to send the sharing invitation. If we look more closely at the source server name, we can see that, in my example, the email came from DB4.MAIL.YLO001.MSOPRD.MSFT.NET, which is one of Microsofts own SMTP servers (probably running MDaemon ;-D). The email is coming from a Microsoft SMTP server and is using one of your own email addresses. Not many email services will like this, particularly mail security services such as Mimecast or MessageLabs if this is where your MX records point. To get around this, you will need to allow the SharePoint Online IP address ranges to send using your domain name.

If your MX records point to Office 365 and you have an Inbound Connector configured for locking down inbound mail flow, then you can connect to Exchange Online Powershell and add the SharePoint Online IP addresses to your connector:

First, run Get-InboundConnector | fl and note down the existing SenderIPAddresses. In this example, I will use 1.1.1.1 for demonstration purposes.

Then run the below command to change the IP addresses assigned to the connector. Make sure you include the IP addresses of the mail system which your MX records point to, or you will end up not receiving any mail at all!

Set-InboundConnector -Identity "Connector Name" -SenderIPAddresses 1.1.1.1/32, 42.159.34.0/27, 42.159.38.0/24, 42.159.39.0/24, 42.159.162.0/27, 42.159.166.0/24, 42.159.167.0/24, 65.52.45.0/24, 65.55.22.32/27, 70.37.151.64/27, 94.245.113.160/27, 111.221.17.160/27, 111.221.20.128/25, 111.221.22.32/27, 111.221.22.192/27, 111.221.64.160/27, 111.221.67.0/25, 134.170.200.0/24, 134.170.201.0/24, 134.170.202.0/24, 134.170.203.0/24, 134.170.204.0/24, 134.170.205.0/24, 134.170.206.0/24, 134.170.207.0/24, 134.170.208.0/24, 134.170.209.0/24, 134.170.210.0/24, 134.170.211.0/24, 134.170.212.0/24, 134.170.213.0/24, 134.170.214.0/24, 134.170.215.0/24, 157.55.43.32/27, 157.55.46.128/27, 157.55.56.0/27, 157.55.62.96/27, 157.55.62.128/27, 157.55.103.0/27, 157.55.144.64/26, 157.55.145.192/27, 157.55.147.0/27, 157.55.151.192/27, 157.55.152.128/25, 157.55.153.0/27, 157.55.153.64/26, 157.55.154.64/27, 157.55.225.160/27, 157.55.225.224/27, 157.55.227.128/27, 157.55.229.0/25, 157.55.229.160/27, 157.55.231.32/27, 157.55.232.0/27, 157.55.235.64/27, 157.55.238.128/27, 157.56.24.128/27, 157.56.48.0/27, 157.56.80.128/27, 157.56.81.192/26, 157.56.113.0/27, 157.56.132.128/26, 157.56.150.32/27, 207.46.203.128/27, 213.199.179.0/27

The list of IP addresses above is all of the SharePoint Online IPs at the time of writing, however this is subject to change and should be checked by yourself prior to running this command. You can check the list of IP addresses here: https://support.office.com/en-ca/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-CA&ad=CA#BKMK_SPO

In my case the problem was actually with my Mimecast configuration, not Office 365. In Mimecast there is an Inbound Lockout Policy section under Gateway>Policies. The policies configured here say that any Inbound messages from our domain name should be dropped by the firewall. This stops spoofing and is a default policy. To stop Mimecast blocking messages from SharePoint Online, I created a new Inbound Lockout Policy which did not block emails to my domain name when the Sender IP address was one of SharePoint Online’s IPs. This rectified the problem.

Locking down mail flow does have many benefits, but simplified administration is not one of them unfortunately!

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s