Solution:
Root Cause: Outbound DNS Resolution Failure or Expired TLS Certificate on Send Connector
Outbound messages remain in the unreachable or specific domain delivery queue when Exchange cannot resolve destination MX records via configured network adapters, or when a TLS handshake fails due to an expired, untrusted, or unassigned TLS certificate on the Send Connector.
# Step-by-Step Fix:
Inspect Stuck Queue Error Details:Query the specific queue status in Exchange Management Shell: powershell
Get-Queue -Filter "Status -eq 'Retry'" | Get-Message -ResultSize Unlimited | Format-Table Identity, Subject, Status, LastError
Verify DNS Lookups for External Routing:Test MX record lookup directly from the Exchange server: powershell
Resolve-DnsName -Name remote-domain.com -Type MX
If using custom network adapter DNS settings on Send Connectors, check configuration via Get-TransportService -Identity $env:COMPUTERNAME | Format-List ExternalDNS*.Validate TLS Certificate Bound to SMTP Service:List installed certificates and verify the SMTP service is bound: powershell
Get-ExchangeCertificate | Format-Table Subject, Thumbprint, Services, NotAfter
Re-assign SMTP service to a valid certificate if expired: powershell
Enable-ExchangeCertificate -Thumbprint <VALID_THUMBPRINT> -Services SMTP
Retry Delivery Queue Manually:Force immediate retry on stuck connector queues: powershell
Retry-Queue -Identity "Unreachable" -Resubmit $true