Office 365 Manual Configuration

This page shows how to route Microsoft 365 (Exchange Online) mail through mxHERO by hand. Each step is given for the admin center and as Exchange Online PowerShell. The values match what the Office 365 Configuration Service creates, so you can use this page to build, check or repair that configuration.

Before you begin

• Choose your architecture. See Routing architectures.
• You need Exchange admin rights in the tenant. For PowerShell, install the ExchangeOnlineManagement module and run Connect-ExchangeOnline.
• Copy the Transport Agent value from Settings › Gateway in the Admin Dashboard. In this page it is shown as <TA>. It is 32 lowercase hexadecimal characters, for example 585439da368cbc9d4fe026ab3795e8c7 (yours is different).
• Find your tenant's MX host: Microsoft 365 admin center › Settings › Domains › your domain › the MX record value, for example example-com.mail.protection.outlook.com.

Values used on this page:

Warning: Do not use smtp.mxhero.com for any connector. Older guides used it for outbound. Use smtp-relay.mxhero.com for outbound and smtp-in.mxhero.com for inbound.

For PowerShell, set these variables once at the start of your session:

$ta  = "<TA>"   # Transport Agent value from Settings › Gateway
$ips = @("54.208.111.28","54.236.184.32","54.165.252.128","54.165.253.193",
         "3.211.77.148","52.22.51.97","54.209.222.83","107.23.152.206")

Which steps you need

Step 1: Turn off TNEF

Microsoft rich-text format (TNEF, winmail.dat) hides attachments from mxHERO. Turn it off for the default remote domain.

Admin center: Exchange admin center › Mail flow › Remote domains › Default › edit the message format settings › set Use rich-text format to Never › Save.

PowerShell:

Set-RemoteDomain Default -TNEFEnabled $false

If you have other remote domains, see Preventing TNEF encapsulation.

Step 2: Create the inbound connector

This connector tells Exchange Online that mail from the mxHERO IP addresses comes from a partner, and requires TLS. It also accepts mail that mxHERO returns after processing.

Admin center:

1. Exchange admin center › Mail flow › Connectors › Add a connector.
2. Connection from: Partner organization. Connection to: Office 365. Click Next.
3. Name: mxHERO Tenant Connector. Leave it turned on. Click Next.
4. Identify the partner by IP address: select the option to verify that the sending server's IP address matches the list, and add the 8 mxHERO IP addresses.
5. Under security restrictions, select Reject email messages if they aren't sent over TLS.
6. Review and click Create connector.

PowerShell:

New-InboundConnector -Name "mxHERO Tenant Connector" `
  -ConnectorType Partner `
  -SenderDomains "*" `
  -SenderIPAddresses $ips `
  -RequireTls $true `
  -Enabled $true

Step 3: Trust mxHERO as an ARC sealer

mxHERO changes messages (for example, it replaces attachments with links), so the original DKIM signature no longer verifies. mxHERO adds an ARC seal that records the original SPF, DKIM and DMARC results. Trusting mxhero.com as an ARC sealer lets Microsoft 365 use those results instead of failing the message.

Admin center: Microsoft Defender portal › Email & collaboration › Policies & rules › Threat policies › Advanced delivery › ARC tab › add trusted ARC sealer mxhero.com. Direct link: security.microsoft.com/authentication?viewid=ARC.

PowerShell: Set-ArcConfig replaces the whole list, so keep the sealers you already trust:

$current = (Get-ArcConfig).ArcTrustedSealers -split "," | ForEach-Object { $_.Trim() } | Where-Object { $_ }
$sealers = @($current + "mxhero.com") | Sort-Object -Unique
Set-ArcConfig -Identity Default -ArcTrustedSealers ($sealers -join ",")
Get-ArcConfig | Format-List ArcTrustedSealers

Step 4: Add the mxHERO IPs to the connection filter

This stops Exchange Online Protection from marking mail that mxHERO returns as spam.

Admin center: Microsoft Defender portal › Email & collaboration › Policies & rules › Threat policies › Anti-spam › Connection filter policy (Default) › Edit connection filter policy › add the 8 mxHERO IP addresses to the IP Allow list › Save.

PowerShell (keeps existing entries):

$existing = (Get-HostedConnectionFilterPolicy "Default").IPAllowList
$combined = @($existing + $ips) | Sort-Object -Unique
Set-HostedConnectionFilterPolicy "Default" -IPAllowList $combined

Inbound Border only: Enhanced Filtering for Connectors

If your MX record points to mxHERO or to a border gateway instead of Microsoft 365, Microsoft sees mxHERO as the sending server. Microsoft's Enhanced Filtering for Connectors can skip the mxHERO IP addresses (and any border gateway in front of mxHERO) so that Microsoft evaluates the original sender's IP. Configure it on mxHERO Tenant Connector as described in Microsoft's Enhanced Filtering for Connectors article. Do not use it in Inbound Loopback, where your MX record already points to Microsoft 365.

Step 5: Inbound Loopback route and rule

Skip this step for Inbound Border.

Create the connector mxHERO Inbound Route

Admin center:

1. Exchange admin center › Mail flow › Connectors › Add a connector.
2. Connection from: Office 365. Connection to: Partner organization. Click Next.
3. Name: mxHERO Inbound Route. Leave it turned on.
4. Use of connector: Only when I have a transport rule set up that redirects messages to this connector.
5. Routing: Route email through these smart hosts › add smtp-in.mxhero.com.
6. Security restrictions: Always use Transport Layer Security (TLS) and Issued by a trusted certificate authority (CA).
7. When the wizard asks for a validation address, enter a mailbox in one of your domains registered in mxHERO. Review and create the connector.

PowerShell:

New-OutboundConnector -Name "mxHERO Inbound Route" `
  -SmartHosts "smtp-in.mxhero.com" `
  -UseMXRecord $false `
  -IsTransportRuleScoped $true `
  -TlsSettings CertificateValidation `
  -Enabled $true

Create the rule mxHERO - Route Inbound

Admin center:

1. Exchange admin center › Mail flow › Rules › Add a rule › Create a new rule.
2. Name: mxHERO - Route Inbound.
3. Apply this rule if: The recipient › is external/internal › Inside the organization.
4. Do the following: Redirect the message to › the following connector › mxHERO Inbound Route.
5. Add a second action: Modify the message properties › set a message header › header X-mxHero-Transport-Agent, value <TA>.
6. Except if: The message headers › matches these text patterns › header X-mxHero-Server, pattern <TA>.
7. Save the rule. Leave it disabled until you are ready to test.

PowerShell (created disabled):

New-TransportRule -Name "mxHERO - Route Inbound" `
  -SentToScope InOrganization `
  -ExceptIfHeaderMatchesMessageHeader "X-mxHero-Server" `
  -ExceptIfHeaderMatchesPatterns $ta `
  -RouteMessageOutboundConnector "mxHERO Inbound Route" `
  -SetHeaderName "X-mxHero-Transport-Agent" `
  -SetHeaderValue $ta `
  -Enabled $false

Warning: The exception must test X-mxHero-Server. An exception on X-mxHero-Transport-Agent never matches, because mxHERO removes that header, and mail loops.

Step 6: Outbound route and rule

Create the connector mxHERO Outbound Route

Admin center: same as the mxHERO Inbound Route connector in Step 5, with Name mxHERO Outbound Route and smart host smtp-relay.mxhero.com. For the validation address, use an external address you control.

PowerShell:

New-OutboundConnector -Name "mxHERO Outbound Route" `
  -SmartHosts "smtp-relay.mxhero.com" `
  -UseMXRecord $false `
  -IsTransportRuleScoped $true `
  -TlsSettings CertificateValidation `
  -Enabled $true

Create the rule mxHERO - Route Outbound

Admin center:

1. Mail flow › Rules › Add a rule › Create a new rule.
2. Name: mxHERO - Route Outbound.
3. Apply this rule if: The sender › is external/internal › Inside the organization.
4. Do the following: Redirect the message to › the following connector › mxHERO Outbound Route.
5. Add the action Modify the message properties › set a message header › X-mxHero-Transport-Agent = <TA>.
6. Except if: The message headers › matches these text patterns › X-mxHero-Server, pattern <TA>.
7. Save the rule, disabled for now.

PowerShell:

New-TransportRule -Name "mxHERO - Route Outbound" `
  -FromScope InOrganization `
  -ExceptIfHeaderMatchesMessageHeader "X-mxHero-Server" `
  -ExceptIfHeaderMatchesPatterns $ta `
  -RouteMessageOutboundConnector "mxHERO Outbound Route" `
  -SetHeaderName "X-mxHero-Transport-Agent" `
  -SetHeaderValue $ta `
  -Enabled $false

For Outbound Loopback, mxHERO returns processed mail through mxHERO Tenant Connector (Step 2), so you don't need another connector.

Step 7: Set Server and Relay Server in mxHERO

1. In the Admin Dashboard, open Settings › Organization and domains › Domains.
2. Edit each domain:
   • Server: your tenant MX host, for example example-com.mail.protection.outlook.com. Required for every architecture.
   • Relay Server: Outbound Loopback only: your tenant MX host. Leave it empty for Outbound Standard.
3. Save.

See Domain Server and Relay settings.

Step 8: SPF and DKIM

Add include:_spf.mxhero.com to your existing SPF record. Do not create a second SPF record.

v=spf1 include:spf.protection.outlook.com include:_spf.mxhero.com ~all

For Outbound Standard, also set up DKIM signing for mxHERO. See SPF, DKIM and DMARC.

Turn on routing

1. Create a test rule in mxHERO for a test user. See Testing mail flow.

2. Optional: limit the rules to a pilot group. See Selective routing.

3. Turn on the rules:

   Enable-TransportRule "mxHERO - Route Inbound"
   Enable-TransportRule "mxHERO - Route Outbound"

Rule changes can take up to an hour to apply across Exchange Online.

Verify

1. Check the configuration:

   Get-RemoteDomain Default | Format-List TNEFEnabled
   Get-InboundConnector "mxHERO Tenant Connector" | Format-List ConnectorType,SenderIPAddresses,RequireTls,Enabled
   Get-OutboundConnector | Where-Object Name -like "mxHERO*" | Format-List Name,SmartHosts,IsTransportRuleScoped,Enabled
   Get-TransportRule | Where-Object Name -like "mxHERO*" | Format-List Name,State,SetHeaderValue,ExceptIfHeaderMatchesMessageHeader,ExceptIfHeaderMatchesPatterns
   Get-ArcConfig | Format-List ArcTrustedSealers

   TNEFEnabled is False. SetHeaderValue and ExceptIfHeaderMatchesPatterns both equal <TA>. ArcTrustedSealers includes mxhero.com.

2. Send a test message from outside to a test user. Open the received message's headers: X-mxHero-Server is present, and Authentication-Results shows compauth=pass reason=130 (the ARC seal was trusted).

3. Find the message in Reports › Email Flow Logs.

Troubleshooting

Related pages

• Routing architectures
• Office 365 Configuration Service
• Selective routing
• Testing mail flow
• Removing mxHERO from mail flow
• Spam and authentication issues