NDR messages from CodeTwo Email Signatures 365

Problem:

Your message processed by the CodeTwo service could not be delivered and, as a result, you have received a Non-Delivery Report generated by the CodeTwo Email Signatures 365 service.

Fig. 1. Example of a non-delivery report.

Solution:

If your message could not be delivered to at least one of your recipients, the CodeTwo service automatically generates a Non-Delivery Report (NDR) to let you know about that. This happens if the Exchange Online Protection (EOP) server rejected further processing of a message that received a signature.

Although, at first glance it may appear that the delivery error was caused by the CodeTwo service, messages are often rejected because the recipient mailbox does not exist, or you have violated the security policy of your recipient.

The cause of the problem is always displayed in the NDR message. You can identify the issue you are dealing with by its NDR code or ATTR number. Read this Microsoft article to learn more.

Troubleshooting:

In some cases, when you receive an NDR message while using CodeTwo Email Signatures 365, it is possible to resolve the issue. Follow the links below to learn how to:

• troubleshoot error ATTR35 / ATTR36,
• troubleshoot error ATTR41.

How to troubleshoot error ATTR35 / ATTR36

You receive the following delivery error:

451 4.4.62 Mail sent to the wrong Office 365 region. ATTR35550 5.7.64 Relay Access Denied ATTR36

These errors mean that Microsoft 365 (Office 365) connectors required to communicate with the CodeTwo cloud service are malfunctioning. There may be several causes, but the easiest way to resolve the issue is to re-configure the connectors (provided that your subscription is still active).

To re-configure Microsoft 365 connectors:

1. Check if your tenant is provisioned properly.
2. Remove the existing configuration.
3. Configure the connectors.

You will be able to re-configure CodeTwo connectors only if you have an active full subscription or trial version of the program. This will allow you to restore the correct mail flow in your environment. Before proceeding, also make sure that:

• you have access to a global admin account,
• you have access to CodeTwo Admin Panel to manage your tenant.

Check if your tenant is provisioned properly

For your tenant to be able to use CodeTwo Email Signatures 365, it needs to be provisioned. This process involves registering an additional accepted domain (that ends with smtp.codetwo.online). Provisioning usually occurs automatically during the initial stages of service configuration. However, it is possible that this accepted domain needed by CodeTwo Email Signatures 365 to work was deleted accidentally.

To check if your tenant is provisioned correctly:

1. Open the Microsoft 365 admin center and navigate to the Exchange admin center.
2. Go to Mail flow > Accepted domains.
3. Check if the [your unique ID].smtp.codetwo.online domain is displayed on the accepted domains list, as shown in Fig.2.

Fig. 2. CodeTwo Email Signatures 365 domain displayed on the Accepted domains list.

Remove the existing configuration

Once you are sure your tenant is properly provisioned, you can remove the CodeTwo connectors and the associated transport rule. To do this, use the following procedure:

1. Open the Microsoft 365 admin center and navigate to the Exchange admin center.
2. Go to Mail flow > Rules.
3. Remove the CodeTwo Exchange transport rule entry.
4. Go to the Mail flow > Connectors and remove the CodeTwo Inbound Connector and the CodeTwo Outbound Connector.
5. Wait at least two hours for the changes to propagate.

Configure the connectors

After at least two hours, you can re-configure CodeTwo connectors as described in this article. It is recommended to use the automatic connector configuration if possible. Note that the wizard requires logging in using a global admin account. If you do not have access to such account, you can still configure the connectors manually; however, this is not recommended.

When the steps above are completed, normal operation of CodeTwo Email Signatures 365 should be restored.

How to troubleshoot error ATTR41

You receive the following delivery error:

454 4.7.0 Failed to establish appropriate TLS channel ATTR41: CertificateExpired: Access Denied

This error is caused by the expiry of a TLS certificate required to secure the connectors used for communication between the CodeTwo cloud service and Microsoft 365. This certificate is purchased for you automatically by CodeTwo when you register the trial version of the software and remains is valid for 30 days. Afterwards, the certificate is automatically prolonged for another year if:

• you have purchased a subscription of CodeTwo Email Signatures 365 (this applies to both monthly and yearly subscription plans),
• your trial period was extended by CodeTwo Customer Support.

If your subscription is not renewed, the certificate used to authenticate the communication will also not be renewed and will eventually expire. As a result, the connectors will no longer work and NDR messages will be returned.

To avoid this problem (as well as to remedy it if it occurred) you need to remove the connectors transporting your emails to the CodeTwo cloud service as described in this article as soon as you decide to stop using CodeTwo Email Signatures 365.

Remember that the connectors can only be removed by you and until this is done, your emails will still be going through CodeTwo as in the examples below:

• Once your trial period ends(usually after 14 days), signatures will no longer be added to emails, but the connectors remain in place.
• If you purchased a subscription but it expired for any reason, our service continues to add signatures for a few additional days (to give you time to resolve payment issues for example).Then, if you do not prolong your subscription, signatures are no longer added, but the connectors remain in place.