3rd Party Gateway, Exchange hybrid and message header

[Jude Perera]

Hi team,

I would like to know and clarify a scenario. Imagine there is a hybrid in place. In the exchange online to on-premise mail routing path, lets say there is a 3rd party spam gateway in the middle. This is to a hard requirement from the client.
1) I would like to know if this is considered a supported scenario. As from some articles i read dated 2016 https://docs.microsoft.com/en-us/exchange/transport-options , it says not supported. I want to clarify if this is still valid to this date and what Microsofts recommendation is if we cant bypass the gateway.

2) The issue is that when mails are routed from cloud to onprem, the “X-MS-Exchange-Organization-AuthAs: “ is shown as “Anonymous”. Although as per my understanding this should be “Internal” as this is from same organization.

2) Can this be due to the spam gateway? If so how can we identify that dpam gateway is changing the headers?

Any help is appreciated.

Thank you.
Jude.

[#2]

That's right, this is not a supported scenario. One of the consequences, as you rightly identified, is the stripping of certain X-headers which causes the 'X-MS-Exchange-Organization-AuthAs' header to get stamped as 'Anonymous'.

This can be overcome by creating a transport rule in your on-premise Exchange to stamp "X-MS-Exchange-Organization-AuthAs: Internal" (for mails matching a pattern that proves it's originating from O365). However that's not the only issue you'll notice, which is why this setup is not supported in the first place. I'd recommend by-passing the spam filter for all mail traffic between on-premise hybrid servers and O365.