Email signatures on Exchange Server (Exclaimer, CodeTwo): routing, duplicates and NDRs

Server-side signatures on Exchange Server come from a transport agent on every Mailbox server, an agent that hands mail to a cloud service, or an SMTP detour through a service. When the design or the install is incomplete, signatures appear only sometimes, appear twice, or mail loops until it bounces. Here's how to identify your design, read the evidence and fix each failure on Exchange Server SE and 2019.

Symptoms#

• One user's messages get the signature only sometimes, depending on which Mailbox server handled them.
• Meeting requests or messages from phones arrive without a signature.
• Two signatures in one message, or the block repeated under every reply in a thread.
• S/MIME-signed or encrypted messages go out unsigned.
• After a signature service joined the outbound path, mail bounces with a loop NDR:

554 5.4.6 Hop count exceeded - possible mail loop

• The service can't hand stamped mail back to Exchange; its logs or bounce messages show Exchange refusing to relay:

550 5.7.54 SMTP; Unable to relay recipient in non-accepted domain

• Mail slows down after a signature agent was installed, and the Application log shows MSExchange Extensibility event 1050: The execution time of agent '<agent name>' exceeded <n> milliseconds while handling event '<event>'.

Why it happens#

Agents only work where they're installed. CodeTwo requires its component on every Mailbox server, and Exclaimer's agent is installed on your on-premises Exchange servers too; skip one and mail categorized there leaves unstamped, which looks random to users. CodeTwo's agent shows in Get-TransportAgent as CodeTwo Exchange Transport Agent (Email Signatures On-prem) or CodeTwo Exchange Rules (Exchange Rules and Rules Pro).

Secure messages can't be edited in place. Changing an S/MIME-signed body invalidates the signature, and an encrypted body can't be read. CodeTwo can't insert a signature directly into a secure message; it wraps the original in an envelope or sends it intact. Exchange disclaimer rules have a fallback action for this case: Wrap (the default), Ignore or Reject.

Formats. Meeting requests are often RTF and phones often send plain text; an HTML-only signature has nothing to insert there.

Duplicates mean two stampers: an Outlook signature plus the server-side one, an old disclaimer rule plus a new agent, or, in hybrid, an on-premises agent and an Exchange Online-based service. A disclaimer rule without an exception also re-appends itself under every reply.

Loops. Exchange Server picks a Send connector by recipient address space, so a * connector with the service as smart host catches all external mail. Stamped mail returned to Exchange goes back to the service; Exchange Server's mail flow rules have no action that routes a message to a chosen connector, so it circles until the hop count is exceeded. If the return connection may not relay, you get 5.7.54.

How to fix it#

1. List everything that stamps mail#

Run on each Mailbox server (Get-TransportAgent reads the local server):

Get-TransportAgent | Format-Table Identity,Enabled,Priority -AutoSize
Get-TransportRule | Where-Object { $_.ApplyHtmlDisclaimerText } |
  Format-List Name,State,Priority,ApplyHtmlDisclaimerLocation,ApplyHtmlDisclaimerFallbackAction
Get-SendConnector | Format-List Name,AddressSpaces,SmartHosts,DNSRoutingEnabled,SourceTransportServers,Enabled

Good: the same signature agent, Enabled True, on every Mailbox server, no disclaimer rule doing the same job, and a smart host pointing at the service only in the SMTP design.

2. Install or enable the agent everywhere#

Install the vendor's agent where it's missing (Exclaimer: cogwheel menu › Exchange On-Premises in the Exclaimer portal; the installer asks for the Service URI). If it's present but disabled:

Enable-TransportAgent -Identity "CodeTwo Exchange Transport Agent"
Restart-Service MSExchangeTransport

Then check the product side: CodeTwo lists unsubmitted console changes (Submit changes) and licences that don't cover every server among its common causes; for Exclaimer, confirm each server reaches the Service URI and the agent's API key still exists.

3. Fill the format gaps#

Create RTF and plain-text versions of each signature (CodeTwo's editor has a Convert button). Exchange ignores disclaimer HTML in plain-text messages, so check how a rule's text reads without it.

4. Choose what happens to secure messages#

CodeTwo processes encrypted and signed messages by default and lets you exclude either type. For disclaimer rules, Ignore delivers the message unchanged, usually right for a signature; Reject bounces it.

Set-TransportRule "Company signature" -ApplyHtmlDisclaimerFallbackAction Ignore

If a gateway encrypts mail after Exchange, the signature is already there; for IRM see the IRM guide.

5. Remove duplicate stampers#

• One component per message path: Disable-TransportRule "Company signature" once a vendor product takes over.
• Remove Outlook client signatures for users who get the server-side one.
• If you keep a disclaimer rule, skip messages that already carry it: Set-TransportRule "Company signature" -ExceptIfSubjectOrBodyContainsWords "Contoso Ltd, registered office".
• In hybrid, decide which component stamps on-premises senders' mail, especially if centralized mail transport routes it through Exchange Online.

6. Break a loop in the SMTP design#

• Stop the bounces: disable the connector to the service (Set-SendConnector "To signature service" -Enabled $false) and make sure another connector handles *, or mail will queue.
• The simplest loop-free flow is one way: Exchange sends to the service and the service delivers to the internet.
• If the service must return mail, use the vendor's documented Exchange Server design: returning mail must not match the same Send connector (see finding mail loops), and relay is granted only to the service's IPs on a dedicated Receive connector (5.7.54 relay guide).

Verify the fix#

1. Send tests from mailboxes on each server: HTML, plain text, a meeting request, a reply and a phone message.
2. Follow one message with message tracking:

Get-TransportService | Get-MessageTrackingLog -Sender test@contoso.com -Start (Get-Date).AddHours(-1) -ResultSize Unlimited |
  Sort-Object Timestamp |
  Format-Table Timestamp,ServerHostname,EventId,Source,ConnectorId,Recipients -AutoSize

3. Good: one SEND per external recipient via the expected connector. A loop shows one MessageId cycling through RECEIVE and SEND.
4. In the received message's headers, the SMTP design shows the vendor's hosts in the Received: lines exactly once; agent designs add no hop.
5. No new event 1050 names the signature agent.

Prevent it next time#

• Re-run Get-TransportAgent on every server after each update and when you add a server (put it in your CU checklist).
• Give signatures one owner and one stamping component.
• Where several agents touch the body, set their order deliberately with Set-TransportAgent -Priority (see third-party transport agents).
• Exclaimer needs Server-Side or Client-Side signatures configured before you install its agent; without Exchange Online it recommends the Client-Side setup without the User Agent.

References#

• Organization-wide disclaimers, signatures, footers, or headers in Exchange Server (Microsoft Learn)
• Send connectors in Exchange Server (Microsoft Learn)
• CodeTwo signatures are not added to emails on an Exchange server – Troubleshooting (CodeTwo)
• Exchange On-Premises (Exclaimer Knowledge Base)