If your organization uses MXGuardian for email filtering before messages reach Microsoft 365, you may want Microsoft 365 to skip its own spam filtering for messages that have already been scanned.
This can be done by creating a mail flow rule that bypasses spam filtering when a message contains the header:
X-Spam-Filter: mxguardian.net
This ensures that messages processed by MXGuardian are not quarantined or filtered again by Microsoft 365.
This configuration is performed in the Exchange Admin Center for Microsoft Exchange Online, part of Microsoft 365.
Step 1 — Open the Exchange Admin Center
Direct link:
https://admin.exchange.microsoft.com
Step 2 — Navigate to Mail Flow Rules
In the left menu select Mail flow
Click Rules
This section controls transport rules that process incoming email for your organization.
Step 3 — Create a New Rule
Click Add a rule
Select Create a new rule
Step 4 — Configure the Rule Name
Enter a descriptive name such as:
Bypass spam filtering for MXGuardian messages
Step 5 — Configure the Condition
Under Apply this rule if:
Select The message headers
Choose includes any of these words
Configure the following:
Header name
X-Spam-Filter
Header value
mxguardian.net
This ensures the rule only applies to messages that were processed by MXGuardian.
Step 6 — Configure the Action
Under Do the following:
Select Modify the message properties
Choose Set the spam confidence level (SCL)
Set the value to:
Bypass spam filtering
This sets the SCL value to -1 which tells Microsoft 365 to bypass spam filtering entirely for the message.
Step 7 — Configure Rule Settings
Click Next
Recommended settings:
Mode: Enforce
Severity: Not specified
Stop processing more rules: Checked
Step 8 — Save the Rule
Click Save
The rule will now apply to all incoming messages that contain the MXGuardian header.
How the Rule Works
When a message arrives in Microsoft 365:
Exchange checks for the header
X-Spam-Filter: mxguardian.net
If present, the rule sets the Spam Confidence Level (SCL) to -1
Microsoft 365 skips spam filtering and delivers the message directly to the recipient's inbox.
Important Recommendation
To prevent spoofing, organizations should also ensure that only MXGuardian servers are allowed to send mail to Microsoft 365 by using an inbound connector with IP restrictions. This prevents external senders from adding the header themselves. For complete instructions, please see this article:
Comments
0 comments
Please sign in to leave a comment.