"Delivery restriction check failed because the sender was not authenticated when sending to this group error" with shared mailboxes / DL in the same tenant/domain

Allan Stark 501

There are 2 shared mailboxes device@AAAdomain.com and device@BBBdomain.com without ExO licenses in the same 365/Entra ID/ExO tenant.

There is also a static distribution list alldevices@AAAdomain.com, both shared mailboxes are not members in it, option "Allow external senders to email this group" is not enabled.

When sending mail from shared mailbox device@BBBdomain.com, mail is delivered to the alldevices@AAAdomain.com mailing list without problems, but when trying to send mail to it from shared mailbox devices@AAAdomain.com (in fact in the same authoritative domain), the error

Reason: [{LED=550 5.7.133 RESOLVER.RST.SenderNotAuthenticatedForGroup; authentication required; Delivery restriction check failed because the sender was not authenticated when sending to this group};{MSG=};{FQDN=};{IP=};{LRT=}]

is visible in the message trace.

There are no external connectors or transport rules in the Exchange Online.
Both mail domains are authoritative and have the same settings.

1 answer

Mike Hu-MSFT 1,940 Reputation points Microsoft Vendor

2024-06-19T07:10:14.63+00:00

Hi,

Typically, this error message means that the distribution group has restricted the sender's emails. When sending mail from shared mailbox device@BBBdomain.com, mail is delivered.But when sending from device@AAAdomain.com ,it failed.This may be because the distribution group has restrictions set, for example__device@BBBdomain.com__ is allowed to send mail, but device@AAA domain.com is not allowed to send mail.

You can check it in EAC:Groups->Settings->Edit Delivery management, check any settings in the “Specifiedd senders”.

And more details you can refer to : Fix NDR error 5.7.133 in Exchange Online - Exchange | Microsoft Learn

Please feel free to contact me for any updates.
Please sign in to rate this answer.
Allan Stark 501 Reputation points

2024-06-19T14:51:35.5333333+00:00

Hello @Mike Hu-MSFT

Thanks for your reply.

This Distribution List group has no explicit sending restrictions other than the set "Only allow messages from people inside my organization" attribute.

Both email domains AAAdomain.com and BBBdomain.com belong to the same Exchange Online tenant (the same org).

Therefore, this does not explain why messages from the shared mailbox in the BBB domain are perfectly delivered to the distribution mailing list/group in AAA and sent to its members, but from the shared mailbox in the same AAA domain as the distribution list causes the 550 5.7.133 ExO error.

I once saw something similar many years ago for onprem Exchange Server, but then the problematic sender was an external MTA whitelisted with IP via a Connector, so that's why that Exchange Server marked it as external sender but in the same domain.

But this is clearly not the case this time.

Mike Hu-MSFT 1,940 Reputation points Microsoft Vendor

2024-06-21T06:25:01.2566667+00:00

Hi,

You can try to disable the sender's authentication requirement in the recipient's Exchange.

Run the following command:

Set-DistributionGroup <group_name> -RequireSenderAuthenticationEnabled $false

If you don't want to change this setting, and you are using CodeTwo Email Signatures 365, you can, as an alternative, exclude this distribution group from the scope of the CodeTwo Exchange transport rule by manually defining an appropriate exception within this rule.

In EAC->Rules

Mike Hu-MSFT 1,940 Reputation points Microsoft Vendor

2024-06-25T01:26:17.76+00:00

If this answer has been helpful, please consider accepting the answer to help increase visibility of this question for other members of the Microsoft Q&A community. If not, please let us know what is still needed in the comments so the question can be answered. Thank you for helping to improve Microsoft Q&A!

Mike Hu-MSFT 1,940 Reputation points Microsoft Vendor

2024-06-26T09:01:21.56+00:00

Any updates so far? If you have solved your problem, could you share with us? Maybe it will help more people with similar problems. Don't forget to mark it as answer, this will be easy for other community members to find the useful one.

Allan Stark 501 Reputation points

2024-06-26T12:37:53.19+00:00

Hello @Mike Hu-MSFT
Thanks for the advice to enable the ability to send mail from external senders for this mailing list.

I did this immediately after discovering the problem.

My question was why Exchange Online considers a sender from the same authoritative mail domain and sent from the same IP address to be an external sender, while another sender from a different domain but in the same 365/ExO tenant with the same sending IP address is considered an internal sender.

Mike Hu-MSFT 1,940 Reputation points Microsoft Vendor

2024-06-28T01:58:11+00:00

According to my personal experience ,senders belonging to the same domain should not be considered as external senders. The reason for this phenomenon may be a configuration problem of the trusted domain. Of course, you can view the email header information of their emails in Outlook to observe any differences to further analyze the cause of this phenomenon

In Outlook, open the email, file->properties:
Sign in to comment

Share via

"Delivery restriction check failed because the sender was not authenticated when sending to this group error" with shared mailboxes / DL in the same tenant/domain

1 answer