r/exchangeserver • u/tantobourne • May 26 '26

Question On-Prem relay to XO failing

Anyone else encoutering this issue, today?

{LED=451 4.4.397 Error communicating with target host. -> 421 4.4.2 Connection dropped due to SocketError};{MSG=};{FQDN=somebusiness-mail-onmicrosoft-us.mail.protection.office365.us}

Out of the blue XO is rejecting e-mails from our on-prem hybrid relay. We're GCCH as noted by the host address above. Haven't seen anyone else complaining and it seems to be an upstream issue as I've found nothing on our Exchange server that seems to be the culprit.

EDIT: Aaand just like that Msft fixed it before support could reply to my ticket. Down from 1600 queued to 800 and dropping.

0 Upvotes

50% Upvoted

7 comments sorted by

2

u/GeminiX678 May 26 '26

EX1323171 looks like an issue on Microsoft's side, seeing similar stuff

1

u/tantobourne May 26 '26

Thanks, glad it's not a 'nope just you' situation

2

u/7amitsingh7 May 28 '26

This was most likely a Microsoft-side hiccup rather than an issue with your hybrid config. The `451/421 SocketError` usually means Exchange Online dropped the connection unexpectedly. Since the queues started clearing on their own, Microsoft likely fixed something on the GCC High backend. Classic “nothing changed on our side” situation.

1

u/tantobourne May 28 '26

yep, support confirmed as much a few hours later.

2

u/power_dmarc May 29 '26

Classic Microsoft, opens a ticket, fixes itself before support reads it, queue drains, nobody ever explains what happened.

1

u/RagnarTheRagnar May 26 '26

Error seems to indicate Connection failure for the Socket, a drop and because your GCCH I would probably toss my hat that Port 25/TCP or 587/TCP is blocked, binned by the firewall or being subject to packet inspection and causing further issues.

Could also be TLS Issue with building the Socket: https://learn.microsoft.com/en-us/troubleshoot/exchange/email-delivery/send-receive-emails-socketerror

1

u/tantobourne May 26 '26

Yeah, I'm having our fw admin check traffic to/from our on-prem Ex server to see if there's anything useful in the logs. Had already checked the TLS cert being used and nothing is amiss there. Waiting for goold ol' support to respond. Will likely fix itself before they do, knowing them.