EOP and 3rd party email filtering

dirkdigs 921 Reputation points
2021-11-22T15:52:16.083+00:00

I have a case where one Org is using a 3rd party email filtering service. (MX records point here) They have whitelisted several email domain / email address on that service

Some of the messages are going into the user junk folders in outlook . (just started recently in October apparently)

Customer wants to either disable EOP altogether (spam policy) or if that's not possible and they must use double filtering . what needs to be done in EOP?

Will they have to create duplicate filtering rules / whitelist in EOP now as well?

What is the recommended approach here?

Exchange Online
Exchange Online
A Microsoft email and calendaring hosted service.
6,173 questions
0 comments No comments
{count} votes

Accepted answer
  1. Andy David - MVP 157.6K Reputation points MVP Volunteer Moderator
    2021-11-22T18:10:03.117+00:00

    You would need to create a transport rule that sets the SCL to -1 for messages coming the 3rd party IP addresses.

    Alternatively, use enhanced filtering to take advantage of EOP filtering as well and then create rules that allow messages based on the original IPs of the senders

    https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/use-connectors-to-configure-mail-flow/enhanced-filtering-for-connectors

    0 comments No comments

1 additional answer

Sort by: Most helpful
  1. Joyce Shen - MSFT 16,701 Reputation points
    2021-11-23T02:57:22.083+00:00

    Hi @dirkdigs

    Yes, I agree with the suggestions above from Andy, the official document introduces the scenario MX record points to third-party spam filtering , you could refer to this link to get more information.

    151643-image.png

    And instead of bypassing spam filtering using a mail flow rule, we highly recommend that you enable Enhanced Filtering for Connector (also known as Skip Listing). Most third-party cloud anti-spam providers share IP addresses among many customers. Bypassing scanning on these IPs might allow spoofed and phishing messages from these IP addresses.


    If an Answer is helpful, please click "Accept Answer" and upvote it.

    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    0 comments No comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.