Email To/From Microsoft Distribution Lists failing

Question

My organization uses Microsoft 365 with Sophos Central Email Security as the email filter. The DLs contain both internal and external email addresses, such as Gmail or Yahoo. When I send email from an internal address to the DL, everything gets delivered. When an external address sends to the DL, the internal addresses receive but the external addresses fail. 
 I cannot see any error messages from within Sophos. The external reject message is

Error:

550 5.7.1 XGEMAIL_0011 Command rejected

Message rejected by:

mx-01-us-west-2.prod.hydra.sophos.com

This is a problem for my organization. Any tips/help?

Tom Foucha · Accepted Answer

From the sounds of it you are in gateway mode. In gateway mode Sophos Central does not any list of recipients contained inside the DL so when the message for external users is sent we reject since we aren't a relay. In MFR mode, since the message goes to M365 first, Microsoft will unpack/expand the DL and route individual messages to Sophos for inspection and then if permitted in M365 it will deliver to the external recipients.

Tom Foucha · Answer

Follow these instructions: https://docs.sophos.com/central/Customer/help/en-us/ManageYourProducts/EmailSecurity/SophosMailflow/index.html 
 Once you have mail flowing (you've moved your MX to domain-com.protection.outlook.com then you can delete the domain in Central under the current location.

Tom Foucha · Answer

Steve/Stuart, one of the initiatives we are working on is the ability to show a consolidated quarantine where you can see what Microsoft has put into their quarantine along with the ability to release messages from the Microsoft quarantine. As Microsoft made the Secure by Default hard stance last year, i.e. if your mx points to .protection.outlook.com then you cannot disable Defender Spam scanning. We do have thousands of customers using mailflow mode without issues but you have to decide what works best for your organization.

Email To/From Microsoft Distribution Lists failing

Top Replies