This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(256, 11%, 34%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ERG%3C/text%3E%3C/svg%3E)
I can receive emails with no problems.
Here is the shortened exchange log:
[Moderator note: personal info removed]
A robust email, calendaring, and collaboration platform developed by Microsoft, designed for enterprise-level communication and data management.Miscellaneous topics that do not fit into specific categories.
This is not a hybrid system. I only use mail.protection.outlook.com for email scanning. This has worked for years. the problem started after I switched to a wildcard certificate. Receiving email works. Note that the edited log is sending to bigpond.com address.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(150.4, 1%, 24%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EDT%3C/text%3E%3C/svg%3E)
Hi Ross Garmoe
Thanks for the clarification.
Since this is not a hybrid setup and you’re only using mail.protection.outlook.com for filtering, the issue may be related to how the connection is being identified after switching to a wildcard certificate, which may no longer match what Microsoft 365 expects.
Could you please check the following:
-Whether the wildcard certificate is correctly assigned to SMTP on your Exchange Server
-Whether the new wildcard certificate is being used for outbound SMTP and aligns with your current configuration
As this behavior involves how the connection is evaluated by mail.protection.outlook.com, if the issue persists after these checks, it would be advisable to raise a support request with Microsoft Support through Service Hub so they can review the connection and mail flow from their side in more detail.
Please note that access to the Services Hub depends on your organization’s support agreement and may require a paid support plan. You can review the requirements and sign-in conditions in the Services Hub sign-in FAQs before submitting a request.
As this is a public peer-to-peer community forum, moderators and community members can share general guidance and experiences, but we do not have access to internal systems or a test environment to reproduce the issue. That said, if you’re able to share any additional details or updates, I’ll do my best to assist you further based on the information you provide.
Thank you again for your patience and understanding.
Please note that our forum is a public platform, and we will modify your question to hide your personal information in the description. Kindly ensure that you hide any personal or organizational information the next time you post an error or other details to protect personal data.
Hi Ross Garmoe
Based on the details you shared, I noticed your Exchange server is routing mail through mail.protection.outlook.com, which indicates that the message is being processed by Exchange Online Protection (Microsoft 365).
Since you mentioned that you are using an Exchange Server, could you please confirm whether your environment includes any integration with Microsoft 365, such as a hybrid configuration?
Regarding the error:
451 4.4.4 Mail received as unauthenticated, incoming to a recipient domain configured in a hosted tenant which has no mail-enabled subscriptions
This error typically indicates that the recipient domain is associated with a Microsoft 365 tenant that does not have an active mail-enabled subscription.
If your setup involves Microsoft 365 (for example, in a hybrid configuration), please verify whether the associated tenant has an active mail-enabled subscription as referenced in the error message.
Please understand that our initial response may not immediately resolve the issue. As this is a public peer-to-peer community forum, moderators and community members can provide general guidance based on experience, but we do not have access to your environment or tenant to perform direct checks. With your help and any additional details you can share, we can continue working together to narrow down the cause and find a solution.
Best regards,
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
This is the output from Get-SendConnector | FL
AddressSpaces : {smtp:*;1}
AuthenticationCredential :
CloudServicesMailEnabled : True
Comment :
ConnectedDomains : {}
ConnectionInactivityTimeOut : 00:10:00
ConnectorType : Default
DNSRoutingEnabled : False
DomainSecureEnabled : False
Enabled : True
ErrorPolicies : Default
ForceHELO : False
Fqdn : mail.[Moderator note: personal info removed].com
FrontendProxyEnabled : False
HomeMTA : Microsoft MTA
HomeMtaServerId : EXCHANGE05
Identity : To EOP
IgnoreSTARTTLS : False
IsScopedConnector : False
IsSmtpConnector : True
MaxMessageSize : 35 MB (36,700,160 bytes)
Name : To EOP
Port : 25
ProtocolLoggingLevel : Verbose
Region : NotSpecified
RequireOorg : False
RequireTLS : True
SmartHostAuthMechanism : None
SmartHosts : {[Moderator note: personal info removed].mail.protection.outlook.com}
SmartHostsString : [Moderator note: personal info removed].mail.protection.outlook.com
SmtpMaxMessagesPerConnection : 20
SourceIPAddress : 0.0.0.0
SourceRoutingGroup : Exchange Routing Group ([Moderator note: personal info removed])
SourceTransportServers : {EXCHANGE05}
TlsAuthLevel : CertificateValidation
TlsCertificateName :
TlsDomain :
UseExternalDNSServersEnabled : False
The wildcard certificate works correctly with receiving email. I think that the log fragment included in the original entry shows that the wildcard certificate is accepted enough to get past TLS 1.2 authentication.
I got a new SSL UCC certificate from Godaddy and keyed it for my Exchange Server, deleted the wildcard certificate and installed the new certificate. Mail is now flowing in both directions with no problems. The Exchange team need to look at why the wildcard certificate passes the TLS 1.2 checks and then rejects the email even though the mail was not being in any tenant.
For my purposes I am done with this problem and you can closes it.
[Moderator note: personal info removed]
Hi Ross Garmoe
Thank you for the update, and I’m glad to hear that mail flow is now working correctly after switching to a UCC certificate.
I appreciate you sharing your observations regarding the wildcard certificate behavior. As this is a public community forum, I don’t have visibility into internal systems or the ability to escalate this further. If you would like this behavior to be reviewed in more detail, you might consider raising a support request with Microsoft for further investigation.
Thanks again for sharing the resolution and details. This will be helpful for others who may encounter a similar issue.
Best regards,