When my customer was trying to email an external domain, they would receive an NDR with the error below. Inbound messages from that domain were being received by my customer without an issue.
550 5.7.51 TenantInboundAttribution; There is a partner connector configured that matched the message’s recipient domain. The connector had either the RestrictDomainsToIPAddresses or RestrictDomainsToCertificate set
Say What?
If you want the backstory on my dealings with issues like this with Barracuda (or probably any email security service that routes mail internally versus doing an MX lookup) check out my original post on this sort of thing.
I wanted to do this quick post as I noticed that there were not a lot of references to 550 5.7.51 while doing my initial troubleshooting. I knew that my customer (the sender) did not have any connectors or rules set up when emailing the recipient domain in question, and this problem cropped up within only a couple days of enabling outbound mail scanning at Barracuda. 2+2=4 sort of thing.
So, I made my first call to Barracuda rather than Office 365. The engineer I spoke to was thinking that the recipient domain might actually have some kind of connector set up, but then I mentioned the possibility that they might have this domain listed and verified with Barracuda ESS and that the messages might have been internally routed. That was key to expedite the solution. He was able to confirm my suspicions and set the recipient domain to a status of “new” in their system, which apparently causes Barracuda to lookup and route mail to the recipient domain’s MX record. Problem solved.
But why the 5.7.51 error?
I think when the recipient domain moved away from Barracuda (and forgot to delete their domain from ESS) to a new service, they locked 365 down to accept mail only via the new services IP blocks. Barracuda still had a reference to their 365 tenant and tried to directly deliver the messages but 365 rejected them since they didn’t come from their new security service. So it sort of makes sense that we’d see such an error. The Barracuda engineer told me they see a lot of different errors caused by the same internal/direct routing situation.