Exchange Enhanced Filtering for Connectors - Exclude EXO?

Question

Exchange Enhanced Filtering for Connectors - Exclude EXO?

Christopher Stainczyk 40

Hi!

I have following Mailflow MX=EXO--->3rdPartyAppliance(Zertificon Z1 for S/MIME--->EXO

Utilization_of_Cloud_email_provider_infrastructure.drawio

My problem is the inbound traffic. It works as shown in the picture, but all incoming mails get a SPF fail. I added the 3rd Party Application under "Enhanced Filtering for Connectors" for the inbound connector. I can see that it works in the message header, but i still get a spf fail because the recieving spf is always exo itself :-( Of course I cannot add the exo-ip since it changes every time. A problem-solver would be the option to exclude the last two ips instead of one, but I'm afraid there is no such option.

Any ideas?

Thank you!

Chris

0 comments

1 answer

Your answer

Answer 1

Yuki Sun-MSFT 41,456 Moderator

Hi @Christopher Stainczyk ,

I can see that it works in the message header, but i still get a spf fail because the recieving spf is always exo itself

Do you mean the IP address of the original external sender is not preserved even after you enable the Enhanced Filtering for Connectors? If this is the case, it's recommended to double confirm that all of the trusted IP addresses that are associated with the third-party product that send email into your tenant, including any intermediate hops with public IP addresses have been included. For more information, you can refer to: Configure Enhanced Filtering for Connectors.
User's image

You can also consider following the document below and pointing the MX record to the 3rd party service instead and see if the mail flow can work as expected:

Manage mail flow using a third-party cloud service with Exchange Online

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Christopher Stainczyk 40 Reputation points

2023-10-13T08:28:29.7966667+00:00

Here a sample message header with the problem.

Step 1-4 is internal sender mailinfrastructure. Step 4 is the mailserver represented in the SPF.

MX of the recipient ist Step 5 = EXO. Here the mail gets scanned etc. Not the mail is transfered to the 3rdPartyAppliance (Step8&9). The mail then gets back to EXO (step 10-12) and correctly decrypted / checked to the recipients mailbox.

I've already added the 3rdPartyAppliance-ip from step 9 to the EnchancedFilter for Connectors.

Now the problem is below. The Authentication Results Orginal is correct, the SPF gets validated and finds the correct source ip from step 4. Here I want it to stop checking :-)

In this example, the final spf check is softfail, because the senders ip is 103.47.14.50, which is EXO itself.

Changing the MX directly to the 3rdPartyAppliance would definitly solve the problem. It unfortunatly not possible, since then ALL mails would go through the appliance, but only a few should.

BR

Chris
Yuki Sun-MSFT 41,456 Reputation points Moderator

2023-10-13T09:29:49.63+00:00

Hi @Christopher Stainczyk ,

Now the problem is below. The Authentication Results Orginal is correct, the SPF gets validated and finds the correct source ip from step 4. Here I want it to stop checking :-)

Thanks for the detailed clarification. But from what I am aware of, it doesn't sound possible given the fact that the inbound mails need to be sent to EXO first.

May I know what's your main concern about this issue? Is it that the incoming mails cannot reach the recipients successfully because of the "softfail"?

By the way, if possible, you can try contacting the support of the 3rdPartyAppliance as well to see if they have any insights on this scenario.
Christopher Stainczyk 40 Reputation points

2023-10-13T10:41:42.2533333+00:00

The problem is in outlook or owa

You get (correctly to be fair) a phishing-warning
Yuki Sun-MSFT 41,456 Reputation points Moderator

2023-10-16T06:24:42.28+00:00

Hi @Christopher Stainczyk ,

Okay. Agreed that looks quite reasonable.

What if disabling Enhanced Filtering for Connectors and just setting up a mail flow rule to pass spam filtering for mails from the 3rd party service? Will this make any difference?

Changing the MX directly to the 3rdPartyAppliance would definitly solve the problem. It unfortunatly not possible, since then ALL mails would go through the appliance, but only a few should.

Is it possible to point MX to the 3rdPartyApplicance and then exclude the mails that don't need to go through it?
Yuki Sun-MSFT 41,456 Reputation points Moderator

2023-10-19T07:25:52.5833333+00:00

Hi @Christopher Stainczyk ,

I am writing to see how everything is going on with this thread. Please post back at your convenience if we can assist further.

Share via

Exchange Enhanced Filtering for Connectors - Exclude EXO?

1 answer

Your answer