Exchange OnPrem / Hybrid
On-premises Exchange Server, security updates, hybrid connectivity to Exchange Online, and the migration to Exchange SE.
NewExchange Online throttles and blocks outdated Exchange 2016 and 2019 servers starting in September 2026: How transport enforcement works
Starting in the second week of September 2026, Exchange Online requires hybrid servers to have at least the October 2025 SU; otherwise, mail flow is throttled and later blocked. Background on transport enforcement since 2023, escalation stages with SMTP codes, the report in the Admin Center, the 90-day pause via PowerShell, and why the next increase will only allow ESU customers and Exchange SE.
NewHow Long Does an SMTP Session Stay Open? ConnectionTimeout 00:10:00 in Exchange and the Systems for Which That Is Too Short
Exchange terminates every incoming SMTP session after ten minutes, even if it is currently transferring data. Which senders stay on a connection that long, how to determine the actual session duration from the protocol log, and when ConnectionTimeout and ConnectionInactivityTimeout should be adjusted on a relay connector.
CVE-2026-62911: Why 85 Percent of On-Premises Exchange Servers Are Vulnerable and What Is Technically Behind It
The BSI reports that around 85 percent of on-premises Exchange servers in Germany are vulnerable to CVE-2026-62911. This article explains the vulnerability technically: MRSProxy, missing Channel Binding, NTLM relay, and Orange Tsai’s Pwn2Own chain, along with context for the figures and the specific recommended actions.
AuthMechanism 10 and AuthAs Internal: How Exchange Classifies Message Submission in the Header
The X-MS-Exchange-Organization-AuthMechanism header documents how a submitting server authenticated. Value 10 indicates a Receive Connector with Externally Secured and classifies external emails as internal, with consequences for spam filters, mail flow rules, and spoofing protection.
Internal or External? Interpreting Exchange Hybrid Mail Headers: AuthAs, MessageDirectionality, and X-originatororg
In Exchange hybrid environments, header classification determines whether an email is treated as internal. Which headers carry the classification, how tenant attribution works through certificates and connectors, and how to identify a misrouted message.
Determining a Mail Server’s Load Profile: Bursts, Peak Rates, and Recipient Structure from Message Tracking
How many emails per minute does your mail server really process, and how high are the peaks? How to use PowerShell and Exchange Message Tracking to determine the real load profile: rates per minute and hour, burst duration, recipient structure, message sizes, and common analysis mistakes.
Analyzing Exchange Mail Flow: Message Tracking, SMTP Logs, and Receive Connectors
How to systematically determine where a message ended up in Exchange On-Premises, Hybrid, and Exchange Online: queries with sample output, how to read the SMTP log correctly, and the issues that regularly lead to incorrect conclusions.
What We Can Learn from Science for IT Troubleshooting
Falsifiability, control groups, confounding variables, and sampling bias: the method natural sciences have used for centuries solves exactly the problems where IT troubleshooting regularly fails, illustrated with examples from mail flow.
Who Is Actually Delivering to Your Tenant? Aggregating Sending IP Addresses
A single report shows which systems actually deliver mail to your tenant: forgotten connectors, applications sending directly, and service providers nobody documented, including the typical analysis errors involving pagination logic and interpretation.
Common Causes of Mail Loops and How to Fix Them
How to systematically identify and fix SMTP mail loops in Exchange Online, hybrid environments, and upstream mail gateways using NDRs, headers, Message Trace, recipient objects, and connectors.
EXO Migration Without a Remote Move
How to provision on-premises Exchange mailboxes in a controlled manner as new, empty Exchange Online mailboxes: PST backup, CSV approval, RemoteMailbox, synchronization, validation, and rollback.
