What MX and SPF records should be used for domain aliases?
The same records that the primary domain uses can also be applied to a domain alias. Bare in mind though that the SPF record may have subtle differences if the domain alias uses other 3rd party relay services that the primary domain doesn't also use.
Is it possible to make a current domain alias the new primary domain in Mailprotector?
This can be done by clicking "Make Primary Domain" from the domain alias list.
Do I need a separate user source in order to sync users only belonging to the domain alias from O365, Gsuite, etc?
In most cases this won't be necessary. We automatically pick up the alias addresses when provided by sync once the alias has been created in the console. Certain AD (LDAP sync) configurations can be an exception to this however.
I have a multi-domain tenant in O365, and am using a domain alias configuration in Mailprotector. Will I need multiple outbound connectors (one per domain) to facilitate outbound relay through Mailprotector?
A single outbound connector can be used for all domains within a multi-domain tenant. This applies both to a domain alias configuration, as well as configurations where using separate primary domains is more appropriate. We will gracefully route and log the messages regardless of which outbound smarthost is provided in the connector.