We are a Checkpoint Email Security customer that wants to leverage Checkpoint's inline outbound email scanning. The way it works is it utilizes a transport rule to route outbound email through a connector that sends it to Checkpoint for processing. Checkpoint then re-injects it back into E365 with specific headers set so the transport rule no longer matches and the mail flows out of the normal connector to the recipient's MX record. Microsoft are counting these emails as TWO recipients even though there's only one actual recipient. I did EXTENSIVE analysis of email data that I exported from both Checkpoint and MS Defender Explorer. The Checkpoint data was consistently about half of what MS's TERRL graph shows us. The Explorer data matched the TERRL graph. After digging with Excel and Claude I learned of duplicate entries except for the network message ID. The Internet Message ID was identical. This led me to the understanding that MS is counting these emails twice. This caused significant business impact when outbound emails suddenly stopped working (I've since created a monitoring check to watch for this). Here's another vendor that confirmed the same behavior: https://success.skyhighsecurity.com/docs/mitigate-terrl-impact-while-using-skyhigh-email-dlp
I have cases open with both Checkpoint (their initial response was to disable outbound scanning but that is not acceptable to me) and Microsoft. It's an uphill battle with both because their answers are "buy more licenses" (which we don't need) or "put in another email gateway to offload bulk senders" (which would barely put a dent in our overall traffic.
I don't understand why Checkpoint and other tools that work the same way aren't covered under this from your blog above:
If I send a message to an external recipient but it routes out to a signature service or on-premises for processing, then comes back into Exchange Online to be sent out to the external recipient, will that get counted twice?
We were counting these messages more than once earlier. But now we fixed this issue and email is counted only once.