Looks like the latest version of Mac Mail on Sierra doesn't work with Exchange 2016. It works fine with our Exchange 2013 server. I am getting Unable to Verify account name or password. Outlook 2016 for Mac works fine and all windows clients are working fine so it seems to be a Mac Mail issue. Hi You may follow this below article for a work around to.

-->

Mac users who want an Exchange-compatible email client from Microsoft have historically relied on Entourage or Microsoft Web Access. With the release of Office for Mac 2011, Microsoft has replaced the Entourage client with Outlook for Mac 2011.
Included in the Mac operating system. Supports smart folders and robust filters.

This topic provides information about the network ports that are used by Exchange Server 2016 and Exchange Server 2019 for communication with email clients, internet mail servers, and other services that are external to your local Exchange organization. Before we get into that, understand the following ground rules:

We do not support restricting or altering network traffic between internal Exchange servers, between internal Exchange servers and internal Lync or Skype for Business servers, or between internal Exchange servers and internal Active Directory domain controllers in any and all types of topologies. If you have firewalls or network devices that could potentially restrict or alter this kind of internal network traffic, you need to configure rules that allow free and unrestricted communication between these servers: rules that allow incoming and outgoing network traffic on any port (including random RPC ports) and any protocol that never alter bits on the wire.
Edge Transport servers are almost always located in a perimeter network, so it's expected that you'll restrict network traffic between the Edge Transport server and the internet, and between the Edge Transport server and your internal Exchange organization. These network ports are described in this topic.
It's expected that you'll restrict network traffic between external clients and services and your internal Exchange organization. It's also OK if you decide to restrict network traffic between internal clients and internal Exchange servers. These network ports are described in this topic.

Network ports required for clients and services

The network ports that are required for email clients to access mailboxes and other services in the Exchange organization are described in the following diagram and table.

Notes:

The destination for these clients and services is the Client Access services on a Mailbox server. In Exchange 2016 and Exchange 2019, Client Access (frontend) and backend services are installed together on the same Mailbox server. For more information, see Client Access protocol architecture.
Although the diagram shows clients and services from the internet, the concepts are the same for internal clients (for example, clients in an accounts forest accessing Exchange servers in a resource forest). Similarly, the table doesn't have a source column because the source could be any location that's external to the Exchange organization (for example, the internet or an accounts forest).
Edge Transport servers have no involvement in the network traffic that's associated with these clients and services.

Purpose	Ports	Comments
Encrypted web connections are used by the following clients and services: • Autodiscover service • Exchange ActiveSync • Exchange Web Services (EWS) • Offline address book (OAB) distribution • Outlook Anywhere (RPC over HTTP) • Outlook MAPI over HTTP • Outlook on the web (formerly known as Outlook Web App)	443/TCP (HTTPS)	For more information about these clients and services, see the following topics: • Autodiscover service in Exchange Server • Exchange ActiveSync • EWS reference for Exchange • Offline address books in Exchange Server • Outlook Anywhere • MAPI over HTTP in Exchange Server
Unencrypted web connections are used by the following clients and services: • Internet calendar publishing • Outlook on the web (redirect to 443/TCP) • Autodiscover (fallback when 443/TCP isn't available)	80/TCP (HTTP)	Whenever possible, we recommend using encrypted web connections on 443/TCP to help protect data and credentials. However, you may find that some services must be configured to use unencrypted web connections on 80/TCP to the Client Access services on Mailbox servers. For more information about these clients and services, see the following topics: • Enable Internet Calendar Publishing • Autodiscover service in Exchange Server
IMAP4 clients	143/TCP (IMAP), 993/TCP (secure IMAP)	IMAP4 is disabled by default. For more information, see POP3 and IMAP4 in Exchange Server. The IMAP4 service in the Client Access services on the Mailbox server proxies connections to the IMAP4 Backend service on a Mailbox server.
POP3 clients	110/TCP (POP3), 995/TCP (secure POP3)	POP3 is disabled by default. For more information, see POP3 and IMAP4 in Exchange Server. The POP3 service in the Client Access services on the Mailbox server proxies connections to the POP3 Backend service on a Mailbox server.
SMTP clients (authenticated)	587/TCP (authenticated SMTP)	The default Received connector named 'Client Frontend <Server name>' in the Front End Transport service listens for authenticated SMTP client submissions on port 587. Note: If you have email clients that are only able to submit authenticated SMTP email on port 25, you can modify the network adapter bindings of the client Receive connector to also listen for authenticated SMTP email submissions on port 25.

Network ports required for mail flow

How mail is delivered to and from your Exchange organization depends on your Exchange topology. The most important factor is whether you have a subscribed Edge Transport server deployed in your perimeter network.

Network ports required for mail flow (no Edge Transport servers)

The network ports that are required for mail flow in an Exchange organization that has only Mailbox servers are described in the following diagram and table.

Purpose	Ports	Source	Destination	Comments
Inbound mail	25/TCP (SMTP)	Internet (any)	Mailbox server	The default Receive connector named 'Default Frontend <Mailbox server name>' in the Front End Transport service listens for anonymous inbound SMTP mail on port 25. Mail is relayed from the Front End Transport service to the Transport service on a Mailbox server using the implicit and invisible intra-organization Send connector that automatically routes mail between Exchange servers in the same organization. For more information, see Implicit Send connectors.
Outbound mail	25/TCP (SMTP)	Mailbox server	Internet (any)	By default, Exchange doesn't create any Send connectors that allow you to send mail to the internet. You have to create Send connectors manually. For more information, see Create a Send connector to send mail to the internet.
Outbound mail (if proxied through the Front End transport service)	25/TCP (SMTP)	Mailbox server	Internet (any)	Outbound mail is proxied through the Front End Transport service only when a Send connector is configured with Proxy through Client Access server in the Exchange admin center or `-FrontEndProxyEnabled $true` in the Exchange Management Shell. In this case, the default Receive connector named 'Outbound Proxy Frontend <Mailbox server name>' in the Front End Transport service listens for outbound mail from the Transport service on a Mailbox server. For more information, see Configure Send connectors to proxy outbound mail.
DNS for name resolution of the next mail hop (not pictured)	53/UDP,53/TCP (DNS)	Mailbox server	DNS server	See the Name resolution section in this topic.

Network ports required for mail flow with Edge Transport servers

A subscribed Edge Transport server that's installed in your perimeter network affects mail flow in the following ways:

Outbound mail from th

Mac Client For Exchange