Best Practices for Microsoft 365 (Exchange Online)

This article contains recommendations and best practices for using MXGuardian with Microsoft 365, also known as Office 365 or Exchange Online. 

Step 1: Create a receive connector

1. Login to the Microsoft 365 Exchange Admin Center at https://admin.exchange.microsoft.com/
2. Under Mail flow, click Connectors.
   
   
3. Click Add a connector
   
   
4. In the Connection From box select Partner Organization and click Next
   
   
   
5. In the Name box, type "MXGuardian inbound connector"
6. Check the box labeled Turn it on and click Next
   
   
   
7. Select By verifying that the IP address of the sending server... 
   
   
   
8. Add all the MXGuardian IP addresses which can be found at https://www.mxguardian.net/ips. You need to add each address one at a time. 
   
   1. Type (or copy & paste) the first IP address
   2. Click the Plus (+) icon to add it to the list
   3. Repeat steps 1-2 for each IP address
   4. When finished, click Next
9. On the security restrictions page, accept the defaults by clicking Next
10. On the confirmation page, click Create Connector

Step 2: Trusted ARC Sealers

MXGuardian adds an ARC signature to all incoming messages. In this step, we tell Microsoft to trust the MXGuardian signature so that we can modify messages without breaking the sender's DKIM signature.

1. Login to the Microsoft Defender home page at: https://security.microsoft.com/
2. Under Email & Collaboration, click Policies & Rules.
   
   
3. Click Threat Policies
   
   
   
   
4. Under Rules, click Email authentication settings
   
   
5. Under Trusted ARC Sealers, click Add
   
   
6. In the box, type "mxguardian.net" and click Save
   
   

Step 3: Configure Enhanced Filtering for Connectors

Enhanced Filtering for Connectors, also known as "skip listing", allows Microsoft to determine the actual source IP of incoming messages that arrive via MXGuardian. This will prevent false positives due to SPF failure.

1. Return to Microsoft Defender > Policies & Rules > Threat Policies
2. Under Rules, click Enhanced Filtering
   
   
3. Locate the inbound connector that you created in Step 1 and click on the connector name (Note: do not click the checkbox)
4. Select Automatically detect and skip the last IP address
   
   
5. Click Save

Now your Microsoft 365 environment is ready to receive mail from MXGuardian.

MX Records and Microsoft 365

When you setup your domain in Microsoft 365, Microsoft will provide you with a new MX record. Usually it is something like "example-com.mail.protection.outlook.com". They will instruct you to point your MX record to this new value. However, if you do that your mail will not go through MXGuardian. Instead you'll need to use this value as your "Primary mail server" in MXGuardian on the "Domain Settings" tab.

This tells us where to send your mail after filtering. 

Please note that since your MX record will be pointing to MXGuardian, you may see an error in your Microsoft 365 console stating that your MX record is misconfigured. You can safely ignore this warning.

More Information:
https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/manage-mail-flow-using-third-party-cloud#scenario-1---mx-record-points-to-third-party-spam-filtering