Inaccessible emails

Dear @Nelson N. Mahlangu,

Thank you for bringing this to our attention. I understand how disruptive it can be when email access and Exchange management tools suddenly become unavailable, especially when everything was working previously. I’m sorry you’re experiencing this issue.

Based on the information you shared, the fact that the mail server still responds correctly to ping, and DNS (nslookup) may confirm that basic network connectivity and name resolution are functioning as expected. This strongly suggests the issue may not be related to DNS or general network availability, but rather to the Exchange Server web services and IIS configuration on the server itself.

In situations like this, Microsoft has documented that Outlook on the web (OWA) and Exchange Control Panel (ECP) may become inaccessible after certain Exchange or Windows security updates, particularly if the update did not complete correctly or was installed without elevated (administrator) permissions. When this occurs, Exchange web components may fail to load even though the server itself remains reachable. You can check the suggestion below to see if your situation can be related to it.

Microsoft documents this behavior and the supported resolution steps here: OWA or ECP stops working after you install a security update

To help move this forward, I recommend reviewing the following items on the Exchange server based on the link above:

1.Confirm whether any recent Exchange or Windows security updates were installed shortly before the issue began.

2.Verify that all Exchange services are running and review the Windows Event Viewer (Application and System logs) for any Exchange, IIS, or .NET related errors.

3.Check IIS bindings and certificates, ensuring that:

• The Default Web Site is using the correct public SSL certificate.
• The Exchange Backend site is bound to the Exchange self‑signed certificate.

4.If the issue started immediately after a security update, reinstalling the Exchange security update using an elevated (Run as Administrator) command prompt is a Microsoft‑supported step and has resolved this issue in many cases.

If these checks do not restore access to OWA and ECP, the issue may require deeper server‑side investigation. In that case, I strongly recommend engaging Microsoft Support, as they can review server logs and configuration details that are not visible externally. You can submit a service request through the Service Hub for the most efficient help.

Please note that this is a paid support ticket, which means it requires an active support plan or a one-time support purchase. However, the benefit of using this channel is that your inquiry will be routed directly to the Microsoft Product Group responsible for the specific service or feature in question. This team includes engineers and developers who work on the product itself, so they are best positioned to provide accurate, in-depth, and authoritative answers especially for complex or edge-case scenarios that go beyond publicly available documentation or community knowledge.

Also, this is a peer‑to‑peer support forum. Microsoft Q&A moderators like myself, as well as other community members, share guidance based on personal experience and publicly available information. Due to security and privacy protocols, we do not have access to your internal environment and are unable to help you further or check your device directly. Our role is to help guide the discussion and connect you with relevant and helpful resources. I truly appreciate your patience and understanding in this situation.

I hope this clarification helps align expectations and provides you some insights in this concern. Wish you a pleasant day!

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment". 

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread. 

Because ping and nslookup work, basic network connectivity and DNS resolution are fine. The issue is likely with Exchange web services (OWA/ECP/ActiveSync/EMS) or certificates/IIS on the Exchange server.

Use the following focused checks and fixes:

1. Verify OWA/ECP health on the server

• On the Exchange Mailbox server, open a browser and go to:
  • https://localhost/owa
  • https://localhost/ecp
• If these fail locally, the problem is on the server (IIS, certificates, Exchange virtual directories), not the network.

2. Check OWA.Protocol health

• On Exchange 2013, the OWA.Protocol health set uses:
  • https://localhost:444/owa/exhealth.check
• If this endpoint does not return HTTP 200 OK, OWA is unhealthy.
• Common causes from the OWA.Protocol health set:
  1. OWA application pool on CAS/Mailbox server not responding.
  2. Network issues between CAS and Mailbox or to domain controllers.
  3. Monitoring account credentials incorrect.
  4. Mailbox database not mounted or Information Store inaccessible.
  5. Information Store not responding.
  6. Domain controllers not responding.
• Actions:
  • In IIS Manager, check that the OWA/ECP application pools are started.
  • Verify the Microsoft Exchange Information Store service and domain controllers are healthy.

3. Check for missing/broken self-signed certificate on Exchange Back End

• On Exchange 2013/2016, if the Microsoft Exchange self-signed certificate bound to the Exchange Back End website on port 444 is removed, OWA/ECP/ActiveSync/EMS cannot connect, and OWA/ECP may show blank pages.
• Fix:
  1. Open Exchange Management Shell on the Mailbox server.
  2. Run: New-ExchangeCertificate.
     • When prompted to overwrite the default certificate, choose No.
  3. Open IIS Manager on the Mailbox server.
  4. Expand Sites → select Exchange Back End → in Actions, choose Bindings.
  5. Select the https binding on Port 444 → Edit.
  6. Choose the Microsoft Exchange certificate created above and apply.
  7. From an elevated command prompt, run iisreset.
• After IIS restarts, test OWA/ECP again.

4. Check for known issues after updates

• If Exchange 2019 RTM is in use and users get browser security warnings and cannot connect to OWA/ECP, the cause can be incorrect cipher suites configured by setup.
• Resolution (per guidance): run the provided PowerShell commands on each server after Exchange Server is installed to correct cipher suites and enable proper HTTP/2 support.

5. Check for security update–related OWA/ECP failures

• If OWA/ECP became inaccessible after installing the July 2021 security update on Exchange 2016/2019, and the server authorization certificate is expired or missing, users cannot sign in to OWA/ECP.
• Fix:
  • Install:
    • Cumulative Update 12 or later for Exchange Server 2019, or
    • Cumulative Update 23 or later for Exchange Server 2016.
  • Ensure the server authorization certificate is valid and present.

6. If mobile clients show “email server is not available”

• When Microsoft Connectivity Analyzer reports “The email server is not available,” the email service is either misconfigured or not responding, even if ping/nslookup succeed.
• An Exchange/IT administrator must correct the server-side configuration and service state. For RPC-related issues, see the referenced RPC troubleshooting article.

After each change (certificate binding, IIS reset, cumulative update), retest:

• From the server: https://localhost/owa and https://localhost/ecp.
• From a client: the normal OWA/ECP URLs.

If all web endpoints remain inaccessible despite valid certificates, running IIS and Exchange services, and healthy OWA.Protocol checks, further detailed server logs and health set diagnostics are required.

References:

• Troubleshooting OWA.Protocol Health Set
• Unable to open OWA, ECP, or EMS after a self-signed certificate is removed from the Exchange Back End website
• Users get a security warning when trying to connect OWA and ECP
• You can't access OWA or ECP after installing the July 2021 security update (KB5012760)
• The email server is not available
• You can't access OWA or ECP after you install Exchange Server 2016 CU6