Configure User Sync on NFR domain even after activating Shield

Suppose you have customers or clients using CloudFilter on other domains, and you have moved to Shield. In that case, you must maintain your domain's address list in the Mailprotector Console to prevent email delivery issues to your customers or clients.

All emails sent or received through CloudFilter will evaluate the email addresses in the sender, from, and reply-to fields to see if they match a protected domain. Protected domains must have the email address listed in the Console to be considered valid. Otherwise, the email will be bounced for invalid sender or recipient address.

550 5.7.1 Invalid recipient address. (<>); from=<> to=<> proto=ESMTP helo=<>


550 5.7.1 Invalid sender address. ( (in reply to MAIL FROM command))

CloudFilter and Shield are completely separate platforms and infrastructures. Today, CloudFilter is not 'Shield-aware' and requires you to maintain a valid list of addresses in the Mailprotector Console, not just Shield Control.

NOTE: If you do not have any customer domains using CloudFilter, you can ignore this best practice.


  • After activating Shield on your NFR domain, please return to the Mailprotector Console.
  • Navigate to your NFR domain in the Mailprotector Console.
  • Please refer to Configure User Sync with O365.


Have more questions? Submit a request