Mail Delivery Issues between Mixed Deployment of Exchange 2019 Servers 03 and 04

Question

We have newly deployed two exchange 2019 servers, both of which are used for delivery to 365. One is called 03 and the other is called 04. The two servers 01 and 02 in front are exchange2013. Currently, when 03 is delivered to 04, this error 451 is reported. 4.4.395 Target host responded with error, -> 454 4.7.0 Temporary authentication failure);, in fact, the same error is reported for 01-02 delivery. We suspect that there is something wrong with 04. The fingerprints of the 04 certificate and 03 are the same. Currently, no one can deliver to the 04 server. The same is true for the 03telnet key port 04. Common

I would like to ask the engineer if he has any troubleshooting ideas for this situation.

Answer 1

Hi @何志锋,

Welcome to the Microsoft Q&A platform!

Based on your description, the error "454 4.7.0 Temporary Authentication Failed" that you are experiencing usually indicates an authentication issue between your Exchange servers. Here are some troubleshooting steps you can follow to resolve this issue:

1. Make sure the clocks on both Exchange servers (03 and 04) and the domain controller are synchronized. The time difference between them should be within 5 minutes.
2. Verify that there are no replication issues between your domain controllers. You can force replication to ensure that everything is up to date.
3. Make sure that the SPN for SMTPSVC is properly registered on the target server (04). You can use the SetSPN tool to check and register the necessary SPNs.
4. Verify that the TCP/UDP ports required for the Kerberos protocol are not blocked by any firewall. This is critical for proper authentication.
5. Make sure that the correct certificate is bound to the SMTP service on server 04. You can use the Enable-ExchangeCertificate cmdlet to bind the certificate to the SMTP service.
6. Enable protocol logging on the Send connector to collect more details about the problem. This can help determine if there are any certificate-related issues2.

Here are some commands that may be helpful:

1. To check the SPN:

SetSPN -L <ExchangeServerName>

2. To bind the certificate to the SMTP service:

Enable-ExchangeCertificate -ThumbPrint "<TLSCertThumbprint>" -Services SMTP

3. To enable protocol logging:

Set-SendConnector "<SendConnectorName>" -ProtocolLoggingLevel Verbose

---

Please feel free to contact me for any updates. And if this helps, don't forget to mark it as an answer.

Best,

Jake Zhang

Answer 2

Thank you very much, this problem was solved when I registered SPN