Mail sent to the wrong Office 365 region when sending through the DLP Cloud Email Service

Products

• Data Loss Prevention Cloud Service for Email
• Data Loss Prevention

Issue/Introduction

You've enabled DLP Cloud Service for your email solution, but when sending messages they are returning the following error in your O365 Admin Center:

451 4.4.62 Mail sent to the wrong Office 365 region. ATTR35. For more information please go to <Outlook Error URL> 

Environment

Release : 15.8

Component : Cloud Service for Email

Cause

This error occurs when the DLP Cloud Detector is configured to accept mail from one O365 "forest" or Tenant, but messages originate from a different one than configured.

It's most commonly a result of having 2 DLP and O365 tenants, e.g., one for PROD and another for UAT or TEST - and the Outbound and Inbound Connectors are pointing to the wrong DLP Detector.

Resolution

Verify that your Outbound and Inbound Connectors are set to send and receive mail from the correct "SmartHost" - the same one as provided in your Welcome Email from DLP Cloud Service.

The correct values are also in the Enforce Server, as the "DETECTOR FQDN" - e.g., <DetectorID-GUID>.ds.dlp.protect.broadcom.com

Additional Information

Instructions for configuring O365 and Gmail connectors and transport are given in the Implementation Guide: Symantec_DLP_Cloud_Service_for_Email_Implementation_Guide.pdf (broadcom.com)