Routing internal mail from Exchange / Office 365 to Mailprotector's smarthost

Description

By default, Exchange (and Exchange Online) routes all internal messages without them ever reaching the Internet. This prevents internal email from passing through Mailprotector's smarthost, and by association, Bracket encryption. Internal messages on Exchange are inherently more secure due to this behavior. However, some users may still have reasons to require filtering or Bracket encryption of internal email as well.

The steps below provide Transport Rule and Connector configurations that route internal email to pass to Mailprotector's smarthost, without conflicting with existing connector configurations.

Applies To:

CloudFilter, SafeSend, Bracket, Exchange 2013 and 2016, Exchange Online, Office 365 (O365)

Prerequisites

This article assumes you have already completed the configuration of the outbound connector to route external email through Mailprotector's smarthost.

Configuration Steps

1. Create the Outbound Connector

  1. From the Mailflow > Connectors tab, click the icon to add a new connector.
  2. Provide a name and description that will allow the connector to be easily distinguished from other Mailprotector connectors. Leave "Turn it on" checked, and click Next.

     

    mceclip1.png

     

  3. Set the connector to only be used when a transport rule redirects messages to this connector, and click Next.

     

    mceclip2.png

     

  4. With "Route email through these smart hosts" selected, add the smart host for your Mailprotector domain to the list with the + icon, and then click Next.

     

    mceclip3.png

     

  5. Leave TLS and certificate settings at default, and click Next.

     

    mceclip4.png

     

  6. Review the settings to confirm that they are correct, and then click Next.
  7. Enter a test address to validate this connector using the icon. This can be any external address that you have access to. Do use an address that is the same as the domain you are configuring. Click Validate.
  8. Once validation is complete, click Save.

     

    mceclip5.png

     

  9. Proceed to one of the two Transport Rule configurations below, depending on whether all internal mail should be routed to Mailprotector or only internal mail that will qualify for Bracket encryption.

NOTE: If the "Send test email" validation fails, the connector can still be saved, and will function correctly as long as there is not a larger configuration issue.

2a. Create a transport rule that routes all internal mail through Mailprotector's smarthost

    1. Navigate to Mail Flow > Rules, and click the icon to create a new transport rule.
    2. Add a descriptive name that will allow this rule to be easily distinguished from other transport rules.
    3. Using the add condition button, add Sender and Recipient criteria that match on "Inside the organization.

       

      mceclip6.png

       

    4. Set "Do the following..." to the action of "Use the following connector..." pointing to the connector, which was created previously.

       

      mceclip7.png

       

    5. Click "More Options" to enable Exceptions.
    6. Click add exception with criteria of "A message header matches..." and an 'X-' value of 'inbound.emailservice.io', and then click Save.

       

      mceclip8.png

       

CRITICAL STEP: Step 6 is required in order to avoid a mail loop when the message passes back to Exchange. It is critical that each field matches the screenshot identically to prevent the mail loop.

2b. ** OPTIONAL ** Route only internal mail which has a subject that matches for Bracket encryption

  1. After completing all steps in 2a, add a 3rd condition of "The subject matches...". This provides the transport rule with a regex that matches the criteria Bracket uses at the smarthost.
    ^\[.*\] 
    mceclip9.png
     

NOTE: If using curly braces or pipes as the Bracket trigger, the following expressions will be used instead:

^\{.*\}   <-- curly braces
^\|.*\| <-- pipes
Have more questions? Submit a request

Comments