Built in Approval workflow can't send to AD univeral security mail enabled group (email recipient not valid)

Question

Background: SP2010 SP2 with March 2015 CU installed. Using the built-in Approval - SharePoint 2010 workflow on a library. The Approval workflow does send email to individual users when users are specified in the Approvers field instead of a group. We
need to use a group. The workflow reports the error email recipients are not valid. I don't see anything in ULS logs. The Exchange server tracking logs do not show the emails to the AD group being processed (no evidence they are even received into Exchange,
but all other mail from SharePoint goes through, including the workflow's email to the workflow initiator). I can send email to the AD group from Outlook and all group members get it.
To send Approval workflow email to a mail enabled AD Universal Security group, what
exactly are the requirements?
Q1. Does the SharePoint\system account (aka web app pool account) *absolutely* need to have a mailbox?
If so, I need some clarification. I saw
http://www.spdev.info/2012/11/using-security-groups-with-workflows.html which was offered as a solution in another post. It says "To allow SharePoint to email the mail enabled security group you need to either create a mailbox for the SharePoint service
account, or attach the email address provided in the Outbound Email Settings as an additional email alias for a mailbox." Then it says you need to do *both* - create a mailbox for service account *and* add the outbound email settings address as an alias
in the *service account's* mailbox settings. Well, we can't do the latter. We are using a dedicated AD account with a mailbox for SharePoint mail settings purposes, and no two mailboxes can have the same alias.
I tried adding the AD account specified in the Reply From: outbound email settings (Reply To: is set to a distribution list) to the AD group's "Message Delivery Restrictions" and UNchecking Require that all senders are authenticated (even
though the AD account does authenticate). I tried allowing All Senders and UNchecking Require authentication (though that leaves email address open to spammers), but neither worked.
Q2. Does the AD mail enabled group need to be synchronized via User Profile Sync?
We currently only sync users. I do see the AD groups (we use AD groups into SharePoint groups security model) in SharePoint's People and Groups, and the mail address for the mail enabled group is *not* present in the properties. Is it a requirement to sync
the AD groups so that the email address shows in the AD group's properties in SharePoint?
The AD group is in a SharePoint group with Approve permissions. The individual AD group members are also in another AD group in a SharePoint group with Contribute permissions. I even placed myself in the AD group to test whether permissions issues; I am
farm admin. All SharePoint groups are set to allow Everyone to read the group's members.
This is driving me crazy.
Thanks,
Joan

Answer 1

Hello Victoria,
Thank you. I have an update. I got the workflow working. Turned out to be two separate unrelated issues:
(1) invalid email address for recipient was because the email address of AD group was not present in SharePoint's properties for group. Also why nothing appeared in Exchange Server tracking logs; the email was never sent from SharePoint. Once this was remedied
(explained below), the Task Assigned email was sent out to the AD group.
(2) the Task Assigned email was rejected by Exchange for reason 550 5.7.1 RESOLVER.RST.AuthRequired. The Exchange tracking logs clearly showed this. Setting the AD group's properties Mail Flow Settings, Message Delivery Restrictions to "Only senders
in the following list: <the domain account of the email address specified in SharePoint outgoing email Reply From setting>" and UNchecking "Require that all senders are authenticated" allowed the Task Assigned email to go through.
Answer to Q1: It is not required for System account (aka web app pool account) to have a mailbox when the SharePoint outgoing mail settings Reply From email address is of a domain account of the domain SharePoint is in. That is our scenario, as I noted we
use a domain service account dedicated for SharePoint mail. I can't speak to other scenarios. The Reply To: does not have to be the same email address; we use a distribution list. And, ever paranoid about spamming because of unchecking require autenticated
senders, I verified that my own account could not send email to the group (Outlook provides message "You do not have permission to send to: <GroupName>").
Answer to Q2: I did not have to sync groups via User Profile Service. What I did do, however, was remove the AD group from SharePoint, People and Groups, Groups list, and readd it. (Note: what I *literally* did was was remove the SharePoint group from all
permissions, remove the AD group from the SharePoint group, then remove the AD group from the Groups list, readd the AD group into the SharePoint group, and reassign permissions to the SharePoint group - Read to top-level site, Read to subsite (has unique
permissions), and Read, Approve to the subsite library with the workflow. In order to start clean. When I readded the AD group to the SharePoint group, it came in with an email address; email address now shows in the group's SharePoint properties. I noticed
that the format was GroupName instead of Domain\GroupName. (I had originally created the AD group as a Global Security group, added it to a SharePoint group, *then* (after I found out about that requirement when first troubleshooting workflow) converted it
to Universal and mail enabled it.
I suppose, would syncing groups would fix this issue of SharePoint not updating AD group changes?
Additional note: I first gave the AD group Read to the library directly instead of giving Read to the SharePoint group, tried the workflow, and the email was sent. I then removed the AD group's direct permissions to the library and added the SharePoint group
to the library and that also worked. So I was able to use the AD group in SharePoint group (I had read in one post that would not work).
Thanks,
Joan