I've noticed that when we take down servers (including domain controller, or exchange), mail being delivered to VALID users by external servers get a 5.1.1 error as noted below.
2015-10-21.log:Oct 21 14:34:57 smtp1 sendmail[25335]: t9LFJ0tf010462: to=<test@domain.com>, delay=03:15:57, xdelay=00:00:00, mailer=esmtp940, pri=455814, relay=x.x.x. [13.39.64.42], dsn=5.1.1, stat=User unknown
Is this normal behaviour for Exchange? If not, is there a way to change exchange's behaviour so it doesn't report "user unknown" errors? (Otherwise upstream servers get confused and cause problems)
(I tried to disguise some info in the above)
UPDATE: I tried shutting down the DC and could not generate a 5.1.1, and tried sending mail when the Exch server in startup/shutdown - but still couldn't generate a 5.1.1. There must be some combination of the above which does this. Hoping someone has ideas.