Issue
If you have have an external tag notifying people that the e-mails have come from outside the domain as you can see below, but that message has come from inside the organisation why is this?
Right well, this is a mail rule in EXO (or Exchange Online) so anything that is not from the "accepted domain" lists will be tagged as external, however in this example the mail did come from internal but the rule thinks its come from exernal.
The Reason?
This is actually quite simple when you think about it logically, the reason this e-mail gets tagged is down to the fact that EXO is actually correct, but does not accommodate for a hybrid Exchange (this is when you have on-premises Exchange as well as EXO - mainly for company's that cannot for one reason or another go "fully cloud"
The rule was setup like this:
In this instance the local Exchange server that then relays to EXO is actually considered external to the company as that e-mail will be routing via the internet record, which in this case is the inboundmail.bears.local which is part for the accepted domains but is not considered internal - hence the notification.
The Resolution
Add the external address or your internal exchange servers as an exception rule on the mail rule, that will be Sender > IP address is any of the following like below:
Ensure you include all your external exchange IP addresses if its load balanced on a pool of addresses, then when you get the same e-mail again....
You will notice that the external tag for an internal mail is no longer being shown, hey presto!!!!
The Resolution
Add the external address or your internal exchange servers as an exception rule on the mail rule, that will be Sender > IP address is any of the following like below:
Ensure you include all your external exchange IP addresses if its load balanced on a pool of addresses, then when you get the same e-mail again....
You will notice that the external tag for an internal mail is no longer being shown, hey presto!!!!