1. Get-ActiveSyncVirtualDirectory | fl identity,InternalUrl,ExternalUrl

check:

InternalUrl : https://exchangeserver.domain.local/Microsoft-Server-ActiveSyncExternalUrl : https://mail.domain.com/Microsoft-Server-ActiveSync

To fix use:

Set-ActiveSyncVirtualDirectory -Identity "EXCHSERVER\Microsoft-Server-ActiveSync (Default Web Site)" -ExternalUrl "https://mail.domain.com/Microsoft-Server-ActiveSync"

2. Use the following parameters to create a new SRV record:

Service: _autodiscover
Protocol: _tcp
Port Number: 443
Host: mail.contoso.com

Check SVR record:

nslookup -q=srv _autodiscover._tcp.domain.com

3. In IIS browse to the Autodiscover website (usually in the Default Web Site), edit the Authentication settings and then check your Basic Authentication for the Default Domain.

All you need is just the domain no extensions. i.e. 'contoso' not 'contoso.local' or 'contoso.com'

Nothing needs to be under Realm correct.

4. Check port 443 and port 80 are opened.