Configuring Office 365 for Spambrella

Situation: You want to configure Microsoft 365 to use with Spambrella as your email gateway.

Summary: This guide covers the Spambrella-side preparation, inbound mail flow, outbound mail flow, cutover steps, and verification.

This article explains how to configure Microsoft 365 to use Spambrella as your email gateway. Office 365 and O365 are now branded as Microsoft 365, but the mail-flow concepts are the same.

What is Microsoft 365?

Microsoft 365 is a cloud-based platform from Microsoft that provides email, messaging, security, archiving, and collaboration services through Microsoft’s global data centers.

For product information, visit Microsoft 365 for business.

Before you start

Before you begin provisioning and configuration, make sure you have the following details ready.

• MX record values for each domain you are configuring
• A Microsoft 365 administrator account
• Your Spambrella connection details, including service IPs, smart host, MX, and SPF values from Connection Details

Prepare the Spambrella side first

Before you switch any traffic, complete the core Spambrella configuration.

• Verify your domain using Verify Your Domain
• Review Spam Settings Explained before users are added
• Review Quarantine Digest Settings before users are added
• Adjust user notifications if needed
• Add users, preferably through Azure Active Directory sync
• Review sender lists and filter policies

Note: Lowering DNS TTL values on MX and TXT records before the cutover will make verification and rollback faster.

Set up inbound mail flow

Spambrella sits between the customer’s Microsoft 365 environment and the internet. Inbound mail is routed to Spambrella first, then delivered onward to Microsoft 365.

1. Locate your Microsoft 365 MX record

1. Sign in to the Microsoft 365 admin center.
2. Go to Settings > Domains.
3. Select the domain you want to manage.
4. Find the MX row in the Exchange Online values and copy the Points to address target.

That destination will be needed when you add the domain to Spambrella.

2. Add the domain to Spambrella

1. Sign in to the Spambrella interface.
2. Go to Administration > Account Management > Domains.
3. Choose New Domain.
4. Enter the domain name.
5. Set the domain purpose to Relay.
6. Enter the delivery destination and failover values.
7. Choose your domain verification method.
8. Select Verify Now or Verify Later depending on whether DNS has propagated.

Each domain must be verified before it can be enabled for relay.

Configure Microsoft 365

Limitation: Microsoft 365 allow-list rules do not accept large IP ranges. The maximum practical size in this setup is typically a /24, so add the exact Spambrella ranges from Connection Details as listed for your stack.

1. Bypass spam filtering in Microsoft 365

1. Open the Exchange admin center from the Microsoft 365 admin portal.
2. Go to Mail flow > Rules.
3. Create a new rule.
4. Name the rule, for example By-pass Spam filtering for Spambrella.
5. Set the condition to match messages where the sender IP is in the Spambrella IP ranges.
6. Add the Spambrella IP addresses from Connection Details.
7. Set the spam confidence level to bypass spam filtering.
8. Finish and enforce the rule.

If you also need to suppress Safe Links rewriting, add a message header action for X-MS-Exchange-Organization-SkipSafeLinksProcessing with the value 1.

2. Create the inbound connector

1. In the Exchange admin center, go to Mail flow > Connectors.
2. Create a connector from Partner organization to Office 365.
3. Name the connector and add an optional description.
4. Keep the connector turned off until you are ready to cut over.
5. Choose Use the sender’s IP address.
6. Add the Spambrella IP addresses from Connection Details.
7. Require TLS if your policy calls for it, then save the connector.

Set up outbound mail flow

Outbound mail is routed through Spambrella by configuring a smart host route in Microsoft 365 and enabling outbound relaying in Spambrella.

1. Configure Spambrella

1. Sign in to the Spambrella interface.
2. Go to Administration > Account Management > Features.
3. Enable Outbound Relaying.
4. Go to Administration > Account Management > Domains.
5. Open Managed Hosted Services.
6. Choose Office 365 and save the change.

2. Configure the outbound connector in Microsoft 365

1. Open the Exchange admin center.
2. Go to Mail flow > Connectors.
3. Create a connector from Office 365 to Partner organization.
4. Name the connector and keep it turned off until cutover.
5. Choose Only when email messages are sent to these domains and add a wildcard domain entry.
6. Choose Route email through these smart hosts.
7. Enter the Spambrella smart host value, such as outbound-us1.ppe-hosted.com.
8. Select your preferred TLS option and validate the connector.

If you use the Professional service package and Email Archive, you may need an additional outbound connector for journaling. External distribution groups and some auto-forwarding rules can also require a bypass rule.

3. Handle distribution groups with external recipients

If your tenant sends to distribution groups or auto-forwarding paths that include external recipients, review the specific guidance for that scenario before cutover.

Sending to distribution groups with external domain recipients or out of offices contains the step-by-step instructions.

Cut over mail flow

1. Enable and test domains

1. Return to the Spambrella interface.
2. Go to Administration > Account Management > Domains.
3. Enable the relay control for the domain.
4. Wait for the half-hour propagation window to complete.
5. Use the test-domain action to verify delivery to the configured SMTP destination.

2. Update MX records and SPF

• Replace the live MX record with the Spambrella MX values from Connection Details.
• Keep the MX priority staged low before cutover if you want a safer rollback path.
• Update your SPF record so outbound mail sent through Spambrella is authorized for the domain.

3. Turn on the connectors and rule

• Enable the inbound connector.
• Enable the outbound connector.
• Turn on the bypass spam filtering rule.

4. Verify mail flow

• Send a test inbound message and confirm it appears in the Spambrella logs.
• Send a test outbound message and confirm it appears in the outbound logs.
• Review any bounce messages before tightening the routing policy further.

Further reading

Use these related resources while you finish the rollout and post-cutover checks.

• Top Viewed Articles Related to Office 365
• Microsoft Office 365 Issues and Solutions
• SPF Checking with Office 365