Border Gateways – mxHero Help Center

Use this page when mail reaches mxHERO before your Microsoft 365 or Google Workspace system: either your MX record points to mxHERO, or a border gateway (for example Proofpoint, Barracuda, Cisco or Trend Micro) relays mail to mxHERO. It also covers sending processed outbound mail back out through a border gateway.

Before you begin

Read Routing architectures (Inbound Border).
Copy the Transport Agent value from Settings › Gateway (shown here as <TA>).
Set your mail system to accept and trust mail from the mxHERO IP addresses, as for any inbound architecture:
- Microsoft 365: Steps 1–4 of Office 365 manual configuration, or the Office 365 Configuration Service with Inbound selected and Loopback clear.
- Google Workspace: Step 1 of Google Workspace configuration (inbound gateway, message tagging at defaults).
The mxHERO IP addresses are 54.208.111.28, 54.236.184.32, 54.165.252.128, 54.165.253.193, 3.211.77.148, 52.22.51.97, 54.209.222.83 and 107.23.152.206.

Inbound through a border gateway

Diagram: Inbound through a border gateway: the gateway filters first, then mxHERO processes, then your mail system delivers.

Inbound through a border gateway: the gateway filters first, then mxHERO processes, then your mail system delivers.

On the border gateway, set the delivery destination (next hop or smart host) for your domains to smtp-in.mxhero.com, port 25. Use TLS if the gateway offers it.
On the border gateway, add a header to every message it sends to mxHERO:
```
X-mxHero-Transport-Agent: <TA>
```
The header tells mxHERO which organization the mail belongs to. mxHERO removes it before delivery.
If you created a Gateway Secret in Settings › Gateway, also add X-mxHero-Transport-Agent-Secret: <secret>. Messages that carry your Transport Agent value without the correct secret are rejected with 550 Message rejected: invalid transport agent secret. See Gateway settings.
In the Admin Dashboard, open Settings › Organization and domains › Domains and set each domain's Server to your mail system's inbound host:
- Microsoft 365: <tenant>.mail.protection.outlook.com
- Google Workspace: smtp.google.com
- Other: your final receiving mail server (hostname or public IP address).
Send a test message (see Verify).

You don't need a loop exception, because mxHERO delivers to your mail system and no rule there sends the message back.

Important: If you can't add the header on your gateway, turn Only process email rules with transport agent header (Strict Mode) off in Settings › Gateway. With Strict Mode on, mxHERO runs your rules only on mail that carries your Transport Agent value. Other mail passes through unprocessed and does not appear in Email Flow Logs.

Inbound with MX pointing to mxHERO

Use this when you have no border gateway and want all inbound mail to reach mxHERO first.

Set each domain's Server in mxHERO (step 4 above). Do this first.
Turn Strict Mode off in Settings › Gateway. Raw internet mail does not carry the Transport Agent header.
In your DNS, add an MX record for the domain:
```
example.com.  3600  IN  MX  0  smtp-in.mxhero.com.
```
Give it a lower priority number than every other MX record for the domain, so senders try it first. Keep your old MX records at higher numbers during the change, then remove them when mail flows through mxHERO.
Wait for the DNS change to propagate (up to the record's TTL).

Warning: Point MX only at smtp-in.mxhero.com. Never use smtp.mxhero.com or smtp-relay.mxhero.com as an MX target: inbound mail entering on the outbound host is not delivered to your Server, and may loop.

Warning: Set the Server before you change MX. Without it, mxHERO looks up your domain's MX, finds itself, and the message loops until it is rejected after 50 hops.

Your Microsoft 365 or Google Workspace system now sees mxHERO as the sending server. For Microsoft 365, see "Enhanced Filtering for Connectors" in Office 365 manual configuration.

Outbound through a border gateway

To send processed outbound mail out through your border gateway instead of directly to recipients:

In mxHERO, set each domain's Relay Server to your gateway's hostname, optionally with a port, for example relay.example.com or relay.example.com:587. mxHERO sends processed mail from that domain through this host.
On the gateway, allow relaying from the mxHERO IP addresses.

Route outbound mail into mxHERO with the outbound rule for your platform, as usual.

Verify

Send a message from an outside account to a user in the domain.
Open the received message's headers. Check that X-mxHero-Server is present and that the Received headers show the message passing through mxHERO.
Find the message in Reports › Email Flow Logs. If it is missing and Strict Mode is on, the Transport Agent header did not arrive or did not match.

Troubleshooting

Symptom	Cause	Fix
Mail bounces with `554 Message exceeded 50 hops`	Server missing or pointing back to mxHERO	Set Server to your mail system's inbound host, not your MX.
Mail flows but no rule runs and nothing appears in Email Flow Logs	Strict Mode is on and the header is missing or has the wrong value	Add the header with the value copied from Settings › Gateway, or turn Strict Mode off.
`550 Message rejected: invalid transport agent secret.`	A Gateway Secret is set and the secret header is missing or wrong	Add `X-mxHero-Transport-Agent-Secret` with the current secret.
Mail from your own users is rejected with `553 <recipient> address unknown.`	Allowed IP masks in Settings › Gateway are set and don't include the server sending that mail to mxHERO	Add that server's IP address to the list, or clear the list.
Mail lands in spam after it returns to your mail system	Your mail system does not trust the mxHERO IP addresses	Repeat the trust steps in Before you begin.