EdgeSync failing with "The LDAP server is unavailable": re-creating the Edge Subscription

An Edge Transport server only knows your accepted domains, Send connectors and recipients because EdgeSync copies them from Active Directory into its local AD LDS instance. When that synchronization breaks, the Edge quietly carries on with stale data until mail to a new mailbox bounces or a connector change never arrives. In this post I'll show how to read the EdgeSync errors, fix the usual causes and re-create the Edge Subscription the supported way on Exchange Server SE and Exchange Server 2019.

Symptoms#

Run Test-EdgeSynchronization on a Mailbox server in the subscribed Active Directory site. A broken subscription typically reports a connection failure such as:

EdgeSync service cannot connect to this subscription because of error "The LDAP server is unavailable."

Other signs that point to the same problem:

• Re-running New-EdgeSubscription on the Edge server fails with couldn't create or update the Edge Subscription account on the Edge Transport server, followed by The LDAP server is unavailable.
• Accepted domains, remote domains or Send connectors you changed inside the organization never show up in Get-AcceptedDomain or Get-SendConnector on the Edge.
• With recipient validation enabled on the Edge, mail to recently created mailboxes is rejected as an unknown recipient while older addresses still work.
• Errors from the MSExchange EdgeSync source in the Application log of the Mailbox servers.

Why it happens#

EdgeSync is a one-way push. The Microsoft Exchange EdgeSync service (MSExchangeEdgeSync) on the Mailbox servers in the subscribed site reads configuration and recipient data from Active Directory and writes it into AD LDS on the Edge over secure LDAP on TCP 50636. The Edge never connects back into your directory. The subscription itself is a trust bundle: the XML file you export on the Edge carries a bootstrap account and the Edge server's certificate details, and importing it creates the EdgeSync replication (ESRA) credentials that both sides use from then on.

So the failure almost always comes down to one of these:

The last two are documented reasons to resubscribe, as is suspected compromise of the ESRA credentials. Note also that the bootstrap account in the subscription file expires 1,440 minutes (24 hours) after you create the file, so an old XML file can't be reused.

How to fix it#

1. Confirm the state from inside the organization#

Get-EdgeSubscription | Format-Table Name, Site, Domain
Test-EdgeSynchronization | Format-List

Note which Edge servers fail and which Active Directory site they are subscribed to — you must resubscribe to the same site.

2. Check name resolution in both directions#

# On a Mailbox server
Resolve-DnsName edge01.contoso.com
# On the Edge server
Resolve-DnsName ex01.corp.contoso.com

Each side must resolve the other's fully qualified name. Fix the DNS records, the Edge's DNS suffix or its hosts file before you touch the subscription.

3. Test the EdgeSync port#

# From each Mailbox server in the subscribed site
Test-NetConnection edge01.contoso.com -Port 50636

You want TcpTestSucceeded : True. The connection is initiated by the Mailbox servers, so the firewall rule is inbound to the Edge on TCP 50636; SMTP on TCP 25 is still needed in both directions for mail flow.

4. Check services and the certificate on the Edge#

Get-Service | Where-Object DisplayName -like "Microsoft Exchange*" | Format-Table DisplayName, Status
Get-ExchangeCertificate | Format-Table Thumbprint, Services, NotAfter, Subject -AutoSize

The Microsoft Exchange ADAM service hosts the AD LDS instance; if it's stopped, both EdgeSync and New-EdgeSubscription fail with the LDAP error. Confirm that a valid, unexpired certificate is enabled for SMTP. On the Mailbox servers, check that MSExchangeEdgeSync is running.

5. Re-create the Edge Subscription#

You don't have to remove the old subscription first — resubscribing to the same site overwrites it. Don't run Remove-EdgeSubscription on the Edge if you intend to resubscribe: that deletes all replicated data from AD LDS, which can take a long time with many recipients.

On the Edge server, export a new subscription file:

New-EdgeSubscription -FileName "C:\EdgeSub\Edge01.xml"

Read the confirmation prompt: manually created accepted domains, message classifications, remote domains and Send connectors on the Edge are deleted, and the import must happen within 1,440 minutes. Copy the file to a Mailbox server in the subscribed site and import it there:

New-EdgeSubscription -FileData ([System.IO.File]::ReadAllBytes('C:\EdgeSub\Edge01.xml')) -Site "Default-First-Site-Name" -CreateInternetSendConnector $true -CreateInboundSendConnector $true

If you replaced the automatically created Internet Send connector with your own, use -CreateInternetSendConnector $false so you don't end up with a duplicate. Delete the XML file afterwards — it contains credentials.

6. Force a synchronization#

Start-EdgeSynchronization -ForceFullSync

Add -TargetServer Edge01 to synchronize a single Edge. A manual run also resets the EdgeSync schedule.

Verify the fix#

Test-EdgeSynchronization
Test-EdgeSynchronization -VerifyRecipient newuser@contoso.com

Healthy output looks like this (trimmed):

SyncStatus                  : Normal
ConnectionResult            : Succeeded
TransportConfigStatus       : Synchronized
AcceptedDomainStatus        : Synchronized
SendConnectorStatus         : Synchronized
RecipientStatus             : Synchronized

Use -ExcludeRecipientTest for a faster, configuration-only check in large organizations. Then, on the Edge, confirm that Get-SendConnector lists the EdgeSync - <site> to Internet and EdgeSync - Inbound to <site> connectors (unless you chose not to create them), and send test messages in both directions while watching Get-Queue.

Prevent it next time#

• Resubscribe on purpose after adding a Mailbox server to the site, applying the Edge product key, renewing or replacing the Edge certificate, or any suspicion that the ESRA credentials leaked.
• Document the network path: TCP 50636 inbound to the Edge, TCP 25 both ways, and DNS or hosts entries for every Mailbox server in the site.
• Keep the Edge clock accurate. It isn't domain-joined, so point it at a reliable time source; the subscription process relies on time-limited credentials.
• Monitor by scheduling Test-EdgeSynchronization -ExcludeRecipientTest and alerting when SyncStatus isn't Normal.
• If the Edge carries hybrid mail flow, re-check the hybrid connectors and TLS settings after a resubscription — see Exchange hybrid mail flow and renewing Exchange certificates.

References#

• Procedures for Edge Subscriptions (Microsoft Learn)