Throttling and Blocking Email from Persistently Vulnerable Exchange Servers to Exchange Online

chupacabra_007 

Do you have anything that uses an Exchange pickup directory? I'm not sure if this has ever been thoroughly explained here, but the way the classification of on-premise servers works is simply by the reported version in the message headers as they flow through Microsoft's servers. Exchange 2016 has a bug where it reports its version as 15.1.2507.6 in the message headers when the email is sent via a pickup directory. This is the Exchange 2016 CU23 release with no patches. All subsequent SUs are not reported when messages are sent via pickup directory. If the message is sent via SMTP, it reports the correct version in the message headers.

Microsoft is aware of this, but they don't seem to care to fix it and won't work around it or make an exception on the EXO side. The easiest fix is to stop using the pickup directories, or if you need them, stand up Exchange 2019 and decommission Exchange 2016. I temporarily worked around this by configuring a connector on my on-prem server to forward messages to a simple postfix relay I stood up. That in turn sent the messages to Microsoft. This extra hop in the middle prevented them from identifying the originating Exchange version, even though it was in the path. I believe I had a connector on the Microsoft side as well identifying the postfix relay to accept messages from it.

After I did that, I worked on standing up Exchange 2019 and decommissioning 2016. Now the version reports correctly on 2019 when sending via pickup directory.

Exchange 2016 and 2019 both go EOL October 14th of next year, but you can do in place upgrades of 2019 to the next version (available sometime next year), so you best be on that anyway since you'll need to upgrade in a very small window of time.