I have an Exchange 2010 SP3/Office 365 hybrid deployment and I'm having a problem with a specific external email address sending us email. When he tries to send email, it'll usually bounce with a "Delivery not authorized, message refused" error. I thought I had this figured out a couple weeks ago, but it appears not. 

This is a copy of the error log from his end. I have just enabled verbose logging on my SMTP connector, so please let me know if there's something in there I should be looking for.

ezra.hbf.org rejected your message to the following email addresses:

brian@bader.org

Your message wasn't delivered due to a permission or security issue. It may have been rejected by a moderator, the address may only accept email from certain senders, or another restriction may be preventing delivery. For more tips to help resolve this issue, see DSN code 5.7.1 in Exchange Online - Office 365. If the problem continues, contact your email admin.

ezra.hbf.org gave this error:
Delivery not authorized, message refused

Diagnostic information for administrators:

Generating server: DM2PR02MB288.namprd02.prod.outlook.com

brian@bader.org

ezra.hbf.org
Remote Server returned '550 5.7.1 Delivery not authorized, message refused'

Original message headers:

Received: from BY1PR0201CA0034.namprd02.prod.outlook.com (25.160.191.172) by
 DM2PR02MB288.namprd02.prod.outlook.com (10.141.55.149) with Microsoft SMTP
 Server (TLS) id 15.1.136.25; Tue, 14 Apr 2015 13:16:17 +0000

Received: from BL2FFO11FD010.protection.gbl (2a01:111:f400:7c09::199) by
 BY1PR0201CA0034.outlook.office365.com (2a01:111:e400:4814::44) with Microsoft
 SMTP Server (TLS) id 15.1.136.25 via Frontend Transport; Tue, 14 Apr 2015
 13:16:16 +0000

Authentication-Results: spf=pass (sender IP is 63.141.144.137)
 smtp.mailfrom=nomoocookies.com; bader.org; dkim=none (message not signed)
 header.d=none;

Received-SPF: Pass (protection.outlook.com: domain of nomoocookies.com
 designates 63.141.144.137 as permitted sender)
 receiver=protection.outlook.com; client-ip=63.141.144.137;
 helo=smtp20.bigcommerce.net;

Received: from smtp20.bigcommerce.net (63.141.144.137) by
 BL2FFO11FD010.mail.protection.outlook.com (10.173.161.16) with Microsoft SMTP
 Server id 15.1.142.12 via Frontend Transport; Tue, 14 Apr 2015 13:16:15 +0000

Received: from mail3.bigcommerce.com (10.16.220.131) by smtp.bigcommerce.com (PowerMTA(TM) v3.5r17) id h5k9hu0q
in8h for <brian@bader.org>; Tue, 14 Apr 2015 08:15:47 -0500 (envelope-from <david@nomoocookies.com>)

Received: from mail3.bigcommerce.com (localhost [127.0.0.1])

        by mail3.bigcommerce.com (Postfix) with ESMTP id B8A83233201D

        for <brian@bader.org>; Tue, 14 Apr 2015 08:15:45 -0500 (CDT)
Received: from [10.1.20.159] (173-15-182-105-BusName-Philadelphia.hfc.comcastbusiness.net [173.15.182.105])

        by mail3.bigcommerce.com (Postfix) with ESMTPSA

        for <brian@bader.org>; Tue, 14 Apr 2015 08:15:45 -0500 (CDT)
Message-ID: <552D1302.1010609@nomoocookies.com>
Date: Tue, 14 Apr 2015 09:15:46 -0400
From: David Bader <david@nomoocookies.com>
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:31.0) Gecko/20100101 Thunderbird/31.6.0
MIME-Version: 1.0
To: <brian@bader.org>
Subject: Fwd: Undeliverable: Honoring a promise
References: <791c19a1-8028-47ed-8ce4-7e2019b81afa@CY1PR02MB1229.namprd02.prod.outlook.com>
In-Reply-To: <791c19a1-8028-47ed-8ce4-7e2019b81afa@CY1PR02MB1229.namprd02.prod.outlook.com>
X-Forwarded-Message-Id: <791c19a1-8028-47ed-8ce4-7e2019b81afa@CY1PR02MB1229.namprd02.prod.outlook.com>
Content-Type: multipart/mixed;

        boundary="------------040601090609080707090005"
Return-Path: david@nomoocookies.com
X-EOPAttributedMessage: 0
X-Forefront-Antispam-Report:

        CIP:63.141.144.137;CTRY:US;IPV:NLI;EFV:NLI;SFV:SKN;SFS:;DIR:INB;SFP:;SCL:-1;SRVR:DM2PR02MB288;H:smtp20.
bigcommerce.net;FPR:;SPF:None;LANG:;
X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:DM2PR02MB288;
X-Exchange-Antispam-Report-Test: UriScan:;

X-Exchange-Antispam-Report-CFA-Test:
        BCL:0;PCL:0;RULEID:(601004);SRVR:DM2PR02MB288;BCL:0;PCL:0;RULEID:;SRVR:DM2PR02MB288;

X-OriginatorOrg: bader.org
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 14 Apr 2015 13:16:15.7318

 (UTC)
X-MS-Exchange-CrossTenant-Id: 00dd0db2-6ec4-4617-a994-3eb80c681d91
X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM2PR02MB288
X-OrganizationHeadersPreserved: DM2PR02MB288.namprd02.prod.outlook.com
X-CrossPremisesHeadersFilteredByDsnGenerator:

        DM2PR02MB288.namprd02.prod.outlook.com

Are you in Office 365?  If not, I would suggest that you are getting an NDR for a spoofed sender.  If you are, then I recommend that you post this in the Exchange Online (Office 365) Forum: http://social.technet.microsoft.com/Forums/en-US/onlineservicesexchange/threads

Hi Brian,

Thank you for your question.

From error, the issue was occurred by sender instead of yours, we could contact Exchange administrator of sender to solve it.

We suggest if there are any restriction on this specific mailbox address.

If there are any questions regarding this issue, please be free to let me know. 

Best Regard,

Jim