Best Practices for Microsoft 365 (Exchange Online)

This article contains recommendations and best practices for using MXGuardian with Microsoft 365, also known as Office 365 or Exchange Online. 

Step 1: Create a receive connector

1. Login to the Microsoft 365 Exchange Admin Center at https://admin.exchange.microsoft.com/
2. Under Mail flow, click Connectors.
   
   
3. Click Add a connector
   
   
4. In the Connection From box select Partner Organization and click Next
   
   
   
5. In the Name box, type "MXGuardian inbound connector"
6. Check the box labeled Turn it on and click Next
   
   
   
7. Select By verifying that the IP address of the sending server... 
   
   
   
8. Add all the MXGuardian IP addresses which can be found at https://www.mxguardian.net/ips. You need to add each address one at a time. 
   
   1. Type (or copy & paste) the first IP address
   2. Click the Plus (+) icon to add it to the list
   3. Repeat steps 1-2 for each IP address
   4. When finished, click Next
9. On the security restrictions page, accept the defaults by clicking Next
10. On the confirmation page, click Create Connector

Step 2: Trusted ARC Sealers

1. Login to the Microsoft Defender home page at: https://security.microsoft.com/
2. Under Email & Collaboration, click Policies & Rules.
   
   
3. Click Threat Policies
   
   
   
   
4. Under Rules, click Email authentication settings
   
   
5. Under Trusted ARC Sealers, click Add
   
   
6. In the box, type "mxguardian.net" and click Save
   
   

Now your Microsoft 365 environment is ready to receive mail from MXGuardian.

MX Records and Microsoft 365

When you setup your domain in Microsoft 365, Microsoft will provide you with a new MX record. Usually it is something like "example-com.mail.protection.outlook.com". They will instruct you to point your MX record to this new value. However, if you do that your mail will not go through MXGuardian. Instead you'll need to use this value as your "Primary mail server" in the MXGuardian control panel. You'll find this setting on the "Domain Settings" tab.

This tells us where to send your mail after filtering. 

Please note that since your MX record will be pointing to MXGuardian, you may see an error in your Microsoft 365 console stating that your MX record is misconfigured. You can safely ignore this warning.