Each domain in mxHERO has a Server, an optional Relay Server, and two lookup switches. They tell mxHERO where to deliver mail after processing. This page explains each field and gives the values for Microsoft 365, Google Workspace and other mail systems. Set them before you route any mail through mxHERO.
Before you begin
- The domain must be connected in Settings › Organization and domains. See Organization and domains.
- Know which routing architecture you are using. See Routing architectures.
- For Microsoft 365, find your tenant's MX host: Microsoft 365 admin center › Settings › Domains › your domain › the MX record value, for example
example-com.mail.protection.outlook.com.
The fields
| Field | Required | What it does |
|---|---|---|
| Server | Yes | Where mxHERO delivers inbound mail for this domain after processing: the system that hosts your mailboxes, or the next gateway in front of it. Accepts a hostname or public IPv4 address, optionally with a port (host:port). The default port is 25. |
| Relay Server | No | Where mxHERO sends outbound mail from this domain after processing. If empty, mxHERO delivers outbound mail directly to each recipient's mail server. Accepts host or host:port. |
| Rcpt Lookup | No (off) | When on, mxHERO accepts inbound mail only for addresses listed in Settings › Accounts and Groups. Mail to other addresses in the domain is rejected. |
| MX Lookup | No (off) | When on, mxHERO looks up the MX records of the Server name and delivers to them, instead of delivering to the Server host itself. |
Aliases connected to a domain use the same settings.
Values by mail system
| Mail system | Server | Relay Server |
|---|---|---|
| Microsoft 365 / Exchange Online | Your tenant MX host, for example example-com.mail.protection.outlook.com
|
Outbound Loopback: your tenant MX host. Otherwise empty. |
| Google Workspace | smtp.google.com |
Outbound Loopback: smtp-relay.gmail.com. Otherwise empty. |
| On-premises server or another gateway | The host that finally receives your mail (hostname or IP, with port if not 25) | Empty, or the gateway that must send your outbound mail, for example relay.example.com:587
|
The rule of thumb: the Server is whatever system receives your mail after mxHERO. The Relay Server is whatever system must send your mail to the internet after mxHERO, if not mxHERO itself.
Important: The Server is required even if you route only outbound mail. mxHERO is a gateway, not a mailbox host: without a Server it falls back to your domain's public MX record, which may point back to mxHERO.
Warning: Never set the Server to your public MX host when your MX points to mxHERO, and never to an mxHERO host (
smtp-in.mxhero.com,smtp-relay.mxhero.com). Mail would come straight back to mxHERO and loop until it bounces after 50 hops.
Set the Server and Relay Server
Open Settings › Organization and domains, then the Domains tab.
Click Edit on the domain's row.
Enter the Server.
Enter the Relay Server, or leave it empty.
-
Leave Rcpt Lookup and MX Lookup off unless you need them (see below).
Click Save.
Changes apply to mail delivery right away.
When to turn on Rcpt Lookup
Turn it on only if your account list in Settings › Accounts and Groups is complete, including shared mailboxes, groups and aliases, and you want mxHERO to reject mail for unknown addresses. If the list is incomplete, valid mail is rejected. See Accounts and directory overview.
When to turn on MX Lookup
Turn it on only when the Server is a domain name whose MX records point to the real receiving hosts and you want DNS to choose the host. For Microsoft 365 and Google Workspace, leave it off.
How the settings are used
Inbound mail goes to the Server; outbound mail goes to the Relay Server if set, otherwise directly to the recipient.
- Mail that arrives on the inbound host (
smtp-in.mxhero.com) for one of your domains is delivered to that domain's Server. - Mail from your domain is delivered through its Relay Server when one is set. For recipients in your own domains arriving inbound, the Server takes priority.
- If no Server is set, mxHERO delivers inbound mail to your domain's public MX record. If that MX points to mxHERO, the message loops.
- When there is no Relay Server, mxHERO delivers directly. Your SPF record must then include mxHERO. See SPF, DKIM and DMARC.
- When you use a Relay Server, that system must accept mail from mxHERO's IP addresses. See Network endpoints and IP addresses.
Verify
-
Expand the domain's row on the Domains tab. SERVER and RELAY SERVER show the values you saved ("Not set" when empty).
After routing is in place, send a test message and check its delivery in Reports › Email Flow Logs. The recipient detail shows the relay host used. See Testing mail flow.
Troubleshooting
| Symptom | Cause | Fix |
|---|---|---|
| The dashboard rejects the Server value | Private IP ranges (10.x, 172.16–31.x, 192.168.x, 127.x, 169.254.x), IPv6 addresses and names that don't resolve are not accepted |
Use a public hostname that resolves, or a public IPv4 address. |
Mail bounces with 554 Message exceeded 50 hops, this may indicate an email loop.
|
Server missing, set to your MX, or set to an mxHERO host | Set the Server to your mail system's inbound host (table above). |
| External senders get "User unknown in relay recipient table" | Rcpt Lookup is on and the address isn't in Accounts and Groups | Add the address, sync your directory, or turn Rcpt Lookup off. |
| Outbound mail rejected or marked as spam by recipients | No Relay Server and SPF doesn't include mxHERO | Add mxHERO to SPF, or relay through your mail system. |
| Outbound Loopback mail is refused by Microsoft 365 or Google | Your platform doesn't accept relayed mail from mxHERO | Check the inbound connector (Microsoft 365) or SMTP relay rule (Google Workspace) on the routing page for your platform. |
Comments
0 comments
Please sign in to leave a comment.