Troubleshoot Exchange 2016 Mail Flow and the Auth Certificate

Lifecycle warning: Exchange Server 2016 and 2019 reached end of support on 14 October 2025. If you still operate Exchange 2016, treat incident recovery as a short-term requirement and maintain a migration/upgrade plan to Microsoft 365 or Exchange Server Subscription Edition as appropriate.

Start with mail-flow scope

1. Determine whether the failure affects inbound, outbound or internal mail.
2. Check transport services, queues and recent Exchange/Windows events.
3. Use message tracking to identify the last successful processing stage.
4. Check certificates only when the event/log evidence points to TLS, OAuth or authentication issues.

Useful checks

Get-Service MSExchangeTransport,MSExchangeFrontEndTransport
Get-Queue
Get-ExchangeCertificate | Format-Table Thumbprint,Services,NotAfter,Subject

If hybrid OAuth/auth certificate problems are indicated, follow the current Microsoft procedure for your supported hybrid configuration rather than replacing certificates from an old blog command sequence.

Do not “fix” by disabling security

Avoid disabling TLS validation, opening relays or replacing receive/send connector permissions broadly. Capture the exact SMTP or event error and correct the specific certificate, DNS, connector or routing fault.

Reference: Microsoft Learn – Exchange 2016/2019 end of support roadmap.