This article explains how to configure Microsoft Office 365 to use EMP Cloud as your email gateway.
What Is Microsoft Office 365?
Office 365 is a cloud-based solution from Microsoft which offers email, messaging, security, archiving and other capabilities delivered from Microsoft’s worldwide network of cloud data centers. For more information please see: https://products.office.com/en-us/business/office
Before You Start…
Before continuing with the provisioning and configuration of the EMP Cloud service, it is recommended that you have the information listed below.
INFORMATION NEEDED FOR CONFIGURING EMP Cloud
INFORMATION NEEDED FOR CONFIGURING OFFICE 365
Office 365 Tenant
The instructions on this KB presume that you are setting up all your domains in your tenant with EMP Cloud. If you are splitting your mail routing, you may need to consult Microsoft on creating the necessary custom rules based on our documentation.
EMP Cloud SIDE
Prior to the below set-up for Office 365, please ensure to do this with the EMP Cloud side.
DNS TTLs
For ease of DNS changes, turning down your TTLs on the DNS, specifically, MX and TXT records will help in the above domain verification, and later MX cut-over.
OFFICE 365 SIDE
Setup Inbound Mail Flow
EMP Cloud is deployed between the customer’s Office 365 environment and the Internet. Inbound mail is routed to EMP Cloud by changing the customer’s MX records. After the email is processed by EMP Cloud it is routed to Office 365.
Locate your MX record for the domain in Office 365…
Adding domain(s) to EMP Cloud…
Repeat if you are adding more than 1 domain.
CONFIGURE OFFICE 365…
Microsoft Office 365 limitation
Please note that Microsoft has a limitation of their allow list. It does not allow you to enter a large IP range. The maximum size of a range is a /24; it will not recognize larger ranges. Unfortunately, you have to enter in the IP ranges twice in this set-up documentation: Connection Details
Bypass Spam Filtering in Office 365…
This will launch the Exchange Admin Center
SCL Bypass
Due to major complaints, Proofpoint has opted to change to the format of ensuring EMP Cloud mail is not scored via the O365 system. This rule will allow external email to come in still but will follow O365 scoring. This is to ensure no mail is lost.
CREATE INBOUND CONNECTOR
An inbound connector is used to manage mail traffic between Office 365 and EMP Cloud.
SETUP OUTBOUND MAIL FLOW
EMP Cloud is deployed between the customer’s Office 365 environment and the Internet. Outbound mail is routed to EMP Cloud by configuring an outbound mail gateway.
Outbound instructions set-up for all mail-in tenant
Please note that these instructions are for all mail within in the tenant. If you custom routing, or extra outbound mail flow, other outbound routing and/or rules will be required to set-up.
CONFIGURE EMP Cloud
Enable Outbound Relaying
Add Service IP addresses to your Inbound Gateway
CONFIGURE OFFICE 365
Create Outbound Connector
This will launch Exchange Admin Center
If you are using EMP Cloud Professional service package and the Email Archive, you will need to create an additional outbound connector. Please refer to Configuring Journaling for Office 365 for additional steps.
If you are using another archiving service, you will need to create an additional outbound connector to ensure journal emailed is not sent to EMP Cloud. If it is sent to EMP Cloud it will be subject to outbound rate-limiting policies. Please contact your archiving service provider for instructions.
External Recipients of distro-groups/Auto-forwarding
Please note that EMP Cloud does not explicitly support some types of auto-forwarding.
CUTTING OVER MAILFLOW
ENABLE & TEST DOMAIN(S)
Once the domain is turned on, you will need to wait for EMP Cloud MTAs to be updated. This occurs every half-hour. You should not proceed to the next step until you’ve waited for this change to be applied.
UPDATE YOUR MX RECORDS
You will need to add EMP Cloud MX records to your DNS record.
You may want to add the MX records with a low priority ahead of your cutover. Once ready, you can then increase the priority of the EMP Cloud MX records while decreasing the priority of your existing MX record.
Update Sender Policy Framework (SPF)
When sending outbound email through the EMP Cloud gateway, recipients receive mail sent from EMP Cloud rather than Office 365 mail servers. If the recipient’s mail service attempts to verify that the message came from your domain, it must confirm that the gateway server is an authorized mail server for your domain.
To enable this, you need to add the EMP Cloud MX records to your domain.
ENABLE INBOUND CONNECTOR
ENABLE OUTBOUND CONNECTOR
ENABLE BY-PASS SPAM FILTERING RULE
VERIFY INBOUND MAILFLOW
VERIFY OUTBOUND MAILFLOW