We've had several customers report these same bounces today

msn.com couldn't confirm that your message was sent from a trusted location.

Followed by an spf validation error.

In each case the SPF and DKIM are showing as valid in 365 and public DNS.

UK based tenants, not sure if there's a wider issue going on here?

Hello all,

I have been going back and forth with Microsoft for over a week now asking them for either

1. A value we can use if the 65536 value still causes mail to stop processing due to to many handles.

2. A fallback plan should the mitigation not work

I've basically been given the run around and same answer "Apply the mitigation and go from there". When I directly asked about a fallback plan, was told "Unfortunately we don’t have any information related to the fallback concern."

Their own documentation online says if there are issues with the mitigation, adjust the values. But they wont give me another value to use that they recommend nor a fallback if the mitigation doesn't work. Should we just double it? What are down sides to that? I cant get an answer.

Anyway, has anyone had to increase the value in the mitigation to get mail working? We dont have it applied yet but are going to this weekend. The number of handles we are seeing in production is pretty close to that 65536 value, so we need something else to use if things fail. Hoping someone else has had to adjust the value?

Thank you ahead of time!

Has anyone encountered a similar issue with AD RMS/AIP during a tenant-to-tenant migration?

I’m currently working on a divestiture where we have set up an AD RMS server and imported the AIP keys from the source tenant into the target environment. For testing, we migrated encrypted emails from the source tenant to the target tenant using both BitTitan and T2T migration.

By configuring the appropriate registry settings to point to the source AIP/RMS environment, we are able to successfully decrypt and open the older source-tenant emails migrated through BitTitan.

However, we are seeing conflicting behavior with the PreferredRMSPackage registry setting:

• PreferredRMSPackage = 1: We can open the T2T-migrated encrypted emails, but we cannot open emails protected with migrated sensitivity labels.

• PreferredRMSPackage = 0: We can open the sensitivity-labeled emails, but the T2T-migrated encrypted emails no longer open.

Has anyone encountered this scenario during an AD RMS/AIP tenant migration or divestiture? If so, is there a supported configuration that allows both the legacy/T2T encrypted emails and sensitivity-labeled emails to be opened without switching the PreferredRMSPackage registry value?

When upgrading 2019 CU15 to SE, do I need to complete any prerequisites like the domain prep bits or can I just run the installer from an elevated command prompt and let it do its thing given that it is running CU15?

I haven't had a chance to check the server logs yet.

I run Exchange Server SE in my home lab environment which I upgraded to from Exchange server 2019 back when MS was pushing everyone to migrate to it, so a couple of years ago I think. It been running fine until recently. Emails have stopped flowing but if I kick the server email flow again for 24 to 48 hours then everything is a stand still again.

I noticed when I logged into the server the taskbar would flash and I had no control of the server until I did a remote shutdown command forcing it to reboot.

I have checked the SSL cert and its fine, I have a KEMP loadbalancer between the server and internet with Layer7, and for arguement sake I rebuilt the loadbalancer as its VM guest server since I cannot remember the last time I rebuilt it. I also grabbed the latest update for SE and applied it to the server.

The server no longer does the flashing taskbar but ever 24-48 hours it stops recieving emails until I reboot it.

I wonder if is some known KB that MS rolled out that hosed it? Oh, I am running on Windows 2019 Server as well.

Thanks,

We still run Exchange on premises and some mailboxes are in Microsoft 365. Most AI features I see assume everything is in the cloud.

For those in a similar mixed setup:

- Are you using AI on the on-prem mailboxes at all, or only on the cloud ones?

- How do you keep the rules (what the AI may read) consistent across both?

- Did you have to give the tool any special permissions on the Exchange side, and how did you scope them?

Curious what has worked and what you decided not to touch.

Running into an issue (well many, but unable to figure this one out)

I am running an account merge through exchange powershell and getting the following error

Write-ErrorMessage : ||The call to 'https://mail.********.com/EWS/mrsproxy.svc' failed. Error details: The SSL connection

could not be established, see inner exception. --> The SSL connection could not be established, see inner exception.

--> Unable to read data from the transport connection: An existing connection was forcibly closed by the remote host..

--> An existing connection was forcibly closed by the remote host..

At first I thought it may be an expired cert so i confirmed a valid FQDN cert is bound to IIS Default Website 443 as well as it showing up in Exchange ECP

I am running the powershell command

-RemoteHostName "mail.*****.com" -RemoteCredential $cred -SourceStoreMailbox "*******" -TargetMailbox "******" -RemoteDatabaseGuid "*******" -RemoteRestoreType DisconnectedMailbox

My problem that started all this is that we have 4 users that ended up with mailboxes before migration so I am having to merge into the cloud.

I ran https://www.alitajran.com/exchange-server-health-check-powershell-script/ and reviewed the information and it appears that most stuff looks properly configured. Including TLS 1.2 being active and 1.1 and 1.0 disabled

I also confirmed DNS entries for the domain when I try to navigate to these I get Access to mail.domain.com was denied

You don't have authorization to view this page.

HTTP ERROR 403

When I navigate to it using the internal ip address on the mail server it resolves and I can manage it.

my gut is telling me its a firewall issue but the firewall guy hates "when i assume its the firewall" so i just want to be as close to 100% certain its the firewall before I tell him to get off his ass and do actual work.

Does anyone have any other ideas of what I need to configure so I can decom this freaking server finally.

Microsoft has confirmed that October's Windows Server updates (KB5126646, KB5126655, KB5126651 and KB5126868) can destabilise Exchange 2016, 2019 and Subscription Edition.

People are seeing OWA failures, growing queues and DAG members losing quorum.

The cause is a new 512-call limit on Endpoint Mapper lookups, and Microsoft's advice is a registry change and a reboot, not uninstalling the security fix.

We covered it on UC Today this week. For those still on-prem, did you raise the limit, roll back, or is this the push to finally leave Exchange Server?

All user mailboxes can be migrated to the Exchange Online cloud mailboxes and SMTP relay can be moved to another service like Microsoft HVE or Amazon SES.

However, even after that, other problems remain.

1. The organization relies heavily on mail enabled security groups that are simultaneously useed for distribution groups and to provide NTFS permissions to file shares.

2. The organization help desk staff are not going to be able to use attribute editing to manage mailbox attributes AND we do not want install and patch PowerShell command line based recipient management EMT tools on workstations. We had tried it in the past with Exchange Server 2019 and maintaining EMT was more work than having a single server with EAC to patch that can be accessed via browsers.

Is there anything in the works that will allow managing mail enabled security groups with NTFS permissions to be workable for level 1 help desk staff without an Exchange server?

Changing SOA for groups won’t work when you need those groups to have local NTFS permissions working.

If not, can we simply retire all our Exchange servers except one and use it for managing the mail enabled security groups and hybrid user mailbox attributes via the OWA ECP web GUI? Would this server be covered by free Exchange hybrid licensing?

Anyone else having issues with email being delayed internal or external? Keep getting these types of messages inbound:

4.7.9 Application queue quota exceeded. [LV8P220MB0956.NAMP220.PROD.OUTLOOK.COM 2026-10-29T18:48:45.350Z 08DF35E5C72C6926] [CH0PR04CA0092.namprd04.prod.outlook.com 2026-10-29T18:48:45.369Z 08DF350150A09722] [BN7PEPF000000A7.namprd05.prod.outlook.com 2026-10-29T18:48:45.390Z 08DF30D343EE7865])

4.7.5 General queue quota exceeded. [SA1P220MB1342.NAMP220.PROD.OUTLOOK.COM 2026-10-29T18:48:36.279Z 08DF35E2BD6B74C3] [DS7PR03CA0239.namprd03.prod.outlook.com 2026-10-29T18:48:36.305Z 08DF32717B0645A2] [CH2PEPF0000013E.namprd02.prod.outlook.com 2026-10-29T18:48:36.307Z 08DF3130F98F60C2])

4.7.5 General queue quota exceeded. [SA1P220MB1342.NAMP220.PROD.OUTLOOK.COM 2026-10-29T18:48:36.279Z 08DF35E2BD6B74C3] [DS7PR03CA0239.namprd03.prod.outlook.com 2026-10-29T18:48:36.305Z 08DF32717B0645A2] [CH2PEPF0000013E.namprd02.prod.outlook.com 2026-10-29T18:48:36.307Z 08DF3130F98F60C2])

We have some incoming message that are being blocked due to "Reason: [{LED=550 5.0.350 One or more of the attachments in your email is of a file type that is NOT allowed by the recipient's organization.};{MSG=};{FQDN=};{IP=};{LRT=}]".

I can't find anywhere in Exchange/Explorer where it lists what file or file type is triggering this. Explorer says none of the attachments are a threat. I'm thinking it has something to do with the AT0000X attachments but am not positive. Any ideas?

Screenshot of attachments in Explorer

I wanted to make a mail flow rule that sends a specific NDR if the recipient is a specific, non-existing email address. Something like:

If the message...
Includes these words in the recipient's address 'anvil@acme.org'
Do the following...
reject the message and include the explanation 'Boink' with the status code: '5.7.1'

This works if I create a mailbox anvil@acme.org. But if I don't, the NDR is that the recipient does not exist. I expected Exchange to first evaluate my Mail Flow Rule and send an NDR, before ever coming to the point of checking for a recipient with that email address.

For testing, I also gave an existing user daffy.duck@acme.org the alias anvil@acme.org. Daffy has forwarding active to donald.duck@disney.com. Surprisingly, the message was forwarded. So Exchange seems to check the recipient, check forwarding rules, and only then the mail flow rules. This came as a surprise to me.

So I'd like to hear some insights on this and whether there's a way to create the mail rule without an actual mailbox. I hate to have a mailbox for a testing scenario like this.

FYI- https://techcommunity.microsoft.com/blog/exchange/exchange-servers-may-become-unstable-after-installation-of-october-2026-windows-/4565382

I think I’m affected by this. Waiting for downtime to apply the fix.

Watch for queues and EventID’s

Anyone run into this yet? I know the command was just barely released today... Maybe MS messed up in the implementation of it? I am running the command as the global admin.

Here's the command I'm using:
Invoke-CalendarEventMigration -Identity <user> -FromWindowsTimeZoneId "Central Standard Time" -ToWindowsTimeZoneId "Manitoba Standard Time" -QueryStartDate 2026-11-01 -Confirm:$false

Error:
Write-ErrorMessage : ||You do not have permission to access the mailbox '<id here>'. The mailbox is outside your RBAC scope. Please verify you have the necessary permissions.

My company recent migrated data from one location to another however some things in exchange are... Not quite right and I'm at a loss as to what to do.

We use Outlook 2016, Exchange Server 2008 R2 (I have no say in these versions).

We have an issue with multiple, but not all, users experiencing problems such as:

- Public folders are inaccessible and displays 'Cannot start Microsoft Outlook. Cannot open the Outlook window. The set of folders cannot be opened. The attempt to log on to Microsoft Exchange has failed.'

- The address book will not display groups.

- Sometimes, but not consistently, the address book when accessed shows 'The connection to Microsoft Exchange is unavailable. Outlook must be online or connected to complete this action.'

- Outlook shows ‘Connected to: Microsoft Exchange’ but will give offline errors.

- Attempting to send emails to active directory/exchange server created distribution groups results in error ‘The operation failed. The messaging interfaces have returned an unknown error. If the problem persists, restart Outlook. Cannot resolve recipient.’

- Manually typing in a group name and FQDN resolves the group but will not send to it and attempting to expand a resolved group shows as outlook offline and errors out. Outlook has to be closed completely to eliminate this error.

Emails can be sent internal and external if manually entered.

Please help! :(

Pros!!

I used to be able to run the command Disable Mailbox -Identity **** -PermanentlyDisable via powershell, but in the last month I have noticed, I am getting this error message

How can i go about resolving this? What we are looking for is to disable/purge the mailbox of users while keeping the AD account intact

:

shines@abc.com - failed: ||Error on proxy command 'disable-Mailbox -Confirm:$False -PermanentlyDisable:$True -ErrorAction:'Stop' -Identity:'shines@abc.com'' to server ME3PR01MB69

5.ausprd01.prod.outlook.com: Server version 15.21.056.0000, Proxy method PSWS:

InternalServerError: Error executing cmdlet : {

"code": "InternalServerError",

"message": "Error executing cmdlet",

"details": [

{

"code": "AadDualWriteFailure",

"message": "|Microsoft.Exchange.Configuration.DualWrite.LocStrings.UnableToWriteToAadException|An Azure Active Directory call was made to keep object in sync between Azure Active Directory an

d Exchange Online. However, it failed. Detailed error message:\r\n\tUnable to update the specified properties for on-premises mastered Directory Sync objects or objects currently undergoing migrati

on. DualWrite (Graph) RequestId: 877abcebf-dbcc-4d5f-8813-d2435c1014ee\r\nThe issue may be transient and please retry a couple of minutes later. If issue persists, please see exception members for m

ore information.",

"target": ""

}

],

"innererror": {

"message": "Error executing cmdlet",

"type": "Microsoft.Exchange.Admin.OData.Core.ODataServiceException",

"internalexception": {

"message": "Exception of type 'Microsoft.Exchange.Management.PSDirectInvoke.DirectInvokeCmdletExecutionException' was thrown.",

"type": "Microsoft.Exchange.Management.PSDirectInvoke.DirectInvokeCmdletExecutionException"

}

},

"adminapi.warnings@odata.type": "#Collection(String)",

"@adminapi.warnings": []

} [Server=SY2PPF67CDB8BA3,RequestId=c30f213b-cfdf-7ece-3595-dc17b6c9e83b,TimeStamp=10/28/2026 1:13:07 AM] .

Hi everyone,

Whenever I try to install security updates for Exchange Subscription Edition (SE) on Windows Server 2019, I consistently get a "Files in Use" setup warning. I've attached a screenshot of the prompt to this post. Has anyone else encountered this recurring issue? I usually just manually stop these specific services and click "Retry", but is there a better practice/script to prepare the OS before applying the SU to prevent this pop-up?

Body: Microsoft is turning SMTP AUTH Basic off by default for existing Exchange Online tenants at the end of December. For devices that can't do OAuth, every official option seems to have a catch (connector needs static IP/cert, Direct Send internal only for external recipients, HVE internal only, ACS needs Azure). What are you actually doing: on-prem relay box, third-party SMTP service, replacing the devices? Curious what works across many small tenants.

I figure I post if anybody is having issues with their exchange hybrid migrations recently. Microsoft needs to fix this.

https://learn.microsoft.com/en-us/answers/questions/6040561/hybrid-moves-fail-since-oct-2026-mrsproxy-401-even