Office 365 Exchange Dynamic Distribution Group External Sender Access

How to allow External Senders to submit email to a Dynamic Distribution Group in Office 365 Exchange Online

Problem:

Office 365 Exchange Online by default will not allow external senders to submit email to a Dynamic Distribution Group, even if the group's Delivery Management is set to allow "Senders inside and outside of my organization".

An example of what the sender will see in the NDR (bounce email) is below:

550 5.4.1 [MySpecialDDG@mydomain.com]: Recipient address rejected: Access denied [BL2NAM02FT035.eop-nam02.prod.protection.outlook.com]

Solution:

When creating a Dynamic Distribution Group in Exchange on Office365, if you want external senders to be able to send email to the group, you have to adjust the Accepted Domain in the ECP Mail Flow Settings.

The domain type must be changed from Authoratative to Internal Relay.

Details & Discussion:

This is kind of an abnormal use of the Internal Relay setting:

Normally you would use Internal Relay if there are other email servers (Exchange or non-Exchange) that some mailboxes may reside on besides the O365 tenant. This is sometimes used during migration scenarios where a company has some mailboxes on-prem and others already functioning in their O365 Exchange tenant.

Anyway, in the case of the Dynamic Distribution Group, apparently the Exchange edge protection rejects the message due to Directory Based Edge Blocking (DBEB) not recognizing the DDG as a valid recipient in the directory. I don't know why this behavior is any different from a normal Distribution Group, but it is.

So by changing the domain type to Internal Relay, you are essentially disabling DBED and telling the Exchange Online Edge Protection to allow emails to be received for any address at our domain. Then as the message traverses into the Exchange Online environment, additional scrutiny will happen at the various layers and eventually the message will be delivered (or in the case of an invalid recipient, the message would still be rejected. Just further upstream).

This Breaks/Disables Recipient Verification

This solution disables Recipient Verification. This is because changing a domain's type to "Internal Relay" effectively turns off "Directory Based Edge Blocking" and DBEB is O365 Exchange Online's recipient verification system.

This creates 2 potential problems:

1. Increased server resource utilization to O365 because all messages to invalid recipients are still received & processed until later rejected down the line. This is inefficient. It doesn't affect fees paid to O365 (at least not today), and likely not mail flow performance in any appreciable way. But it is not ideal.
2. 3rd Party spam/mail security solutions used before messages reach O365 (ie have your MX point to a different service provider who filters spam first before relaying into O365) will not be able to rely on recipient verification to determine valid senders. As a result, your administrative overhead of these services will typically increase because you will have to add/remove users to/from the 3rd party email security service manually as users are added to/removed from your organization over time.

Bottom Line / Summary:

I think Microsoft should change internally how DBEB handles DDGs. Whether or not they are accessible for External senders to submit mail to should be controlled solely by the DDG's Delivery Management setting as with traditional Distribution Groups. Until then, this is the way to work around that.

Personally, I will not be leaving any O365 tenants with DBEB disabled for any length of time, so this is not a solution I would implement any longer than the 5-10 minutes I would actually need the feature. But it would be ideal to use a different method altogether (such as submit the messages using an internal address), rather than regularly change a mail flow setting for your primary email domain.

My primary source on this solution is here:

https://answers.microsoft.com/en-us/msoffice/forum/msoffice_o365admin-mso_dep365-mso_o365b/dynamic-distribution-group-and-external-sender/4ce9f7f1-7d66-4d6b-bce6-1b0f731ccf38?auth=1

More info on Directory Based Edge Blocking (DBEB) can be found at:

• https://technet.microsoft.com/en-us/library/dn600322(v=exchg.150).aspx
• https://technet.microsoft.com/en-us/library/jj723153(v=exchg.150).aspx