Forum Discussion

Dušan Řezníček's avatar
Dušan Řezníček
Copper Contributor
Sep 27, 2016

Securing mailflow in the hybrid configuration

Hello, I'm looking for some help. I'm facing the customer's security department. We plan to configure hybrid configuration in our current Exchange 2010 deployment to ensure a smooth migration to Off...
exchange online
Exchange Server
hybrid
office 365
Dušan Řezníček's avatar
Dušan Řezníček
Copper Contributor
Sep 27, 2016

I wish I could agree with you :) We've set up a custom outbound connector in another tenant which points to the Edge server. At this case emails are delivered. Is it possible to filter inbound messages only from a specific domain?

Eddie Ortega's avatar
Eddie Ortega
Copper Contributor
Sep 27, 2016
Receive connectors can't filter by domain. You're also already filtering by domain by way of "Accepted Domains".

If someone tries to send you an email to a domain that's not on that list, exchange is going to reject it regardless whether it's coming from.

  • Dušan Řezníček's avatar
    Dušan Řezníček
    Copper Contributor
    Sep 30, 2016

    Thanks for the replies, but that's not what I'm trying to achieve. It's about the senders not recipients domain . I 've had to use Exchange Edge as a SMTP gateway in the perimeter network, because putting non-exchange SMTP server between Exchange on-premise and Exchange Online it's not supported. It's against the company policy to allow the Ex Edge in the perimeter to accept from "non-authorized" organization which is only the companys tenant nad not the others. If I create a custom Outbound connector in the another tenant and points it to the Edge server then emails are received :( I found a header X-MS-Exchange-CrossTenant-id which could help. Do you know anything about this?

     

    Thanks in advance.

     

    D.

    • Eddie Ortega's avatar
      Eddie Ortega
      Copper Contributor
      Oct 07, 2016
      I think what you're trying to do is impossible because of the shared nature of Office365. You would have to create a Receive connector with only the IPs you want to accept connections from, but since those IPs are shared it won't help you in this case.

      I looked at that CrossTenant-ID and it seems to be Tenant ID of the person receiving the email not the sender, so I don't think it's going to help in this case.