Removing mxHERO from Mail Flow

This page explains how to stop routing mail through mxHERO without losing mail. Follow the steps in order: first stop new mail from going to mxHERO, then let mail already in transit finish, and only then remove the settings that let mxHERO return mail to you. The same order applies if you pause mxHERO for troubleshooting.

Warning: Remove routing before your mxHERO subscription ends. When a subscription is no longer active, mxHERO rejects mail from your domains with Relay access denied for sender <domain>. Please contact mxHERO support. and defers mail to them. If you already see this error, go straight to If your subscription has already ended.

Before you begin

• You need admin access to your mail system (Exchange admin center or Google Admin console), your DNS, and the mxHERO Admin Dashboard.
• Note which architecture you use. See Routing architectures.
• Allow at least 24 hours between stopping routing and removing the return path.

Important: The Office 365 Configuration Service has no undo. Remove what it created by hand, using the object names below.

Step 1: Release held mail

Messages held by Temporary Hold or waiting for Request Approval stay in mxHERO until they are released, rejected or expire.

1. In Rules › Rules List, disable your Temporary Hold and Request Approval rules so no new mail is held.
2. Ask senders and approvers to release or reject waiting messages in the End User App. See Managing held emails and Approving emails.
3. Wait until nothing is waiting. At expiry, held messages are released or rejected depending on the rule settings, and expired approval requests are rejected.

Keep the rest of the configuration in place until this is done. mxHERO needs the return path (Step 3) to deliver released messages.

Step 2: Stop sending new mail to mxHERO

Do the part for your platform. Disable the routing; don't delete anything yet.

Microsoft 365

Admin center: Exchange admin center › Mail flow › Rules › turn off mxHERO - Route Inbound and mxHERO - Route Outbound (or the rules you created with other names).

PowerShell:

Disable-TransportRule -Identity "mxHERO - Route Inbound"  -Confirm:$false
Disable-TransportRule -Identity "mxHERO - Route Outbound" -Confirm:$false

Google Workspace

1. Go to Apps › Google Workspace › Gmail › Compliance › Content compliance.
2. Disable mxHERO inbound routing and mxHERO outbound routing (or your equivalent rules).
3. Go to Apps › Google Workspace › Gmail › Routing. If Outbound gateway contains an mxHERO host (for example smtp-relay.mxhero.com, smtp.mxhero.com, gmail.mxhero.com or gmail-out.mxhero.com), clear it and click Save.

MX record or border gateway

• MX pointing to mxHERO: add MX records for your mail system (for example your Microsoft 365 tenant MX host, or Google's MX records) with a lower priority number than the mxHERO record. After the old record's TTL has passed, delete the MX record that points to smtp-in.mxhero.com (or any other mxHERO host).
• Border gateway: change its delivery destination from smtp-in.mxhero.com back to your mail system, and remove the X-mxHero-Transport-Agent header action.
• Other mail servers: remove any MX record, send connector or smart host that points to an mxHERO host.

Changes in Exchange Online and Gmail can take up to an hour to apply.

Step 3: Wait for mail in transit

Keep these in place for at least 24 hours after Step 2:

• the domain Server and Relay Server values in mxHERO;
• in Microsoft 365: mxHERO Tenant Connector, the mxHERO IPs in the connection filter, and the ARC sealer;
• in Google Workspace: the inbound gateway IPs, the host routes and the SMTP relay rule.

mxHERO retries delivery for up to 24 hours. If you remove the return path earlier, messages still in mxHERO can bounce.

Check Reports › Email Flow Logs: when no new messages appear and the last ones show as delivered, continue.

Step 4: Remove the configuration from your mail system

Microsoft 365

Remove the objects in this order: rules, then outbound connectors, then the inbound connector.

Admin center:

1. Mail flow › Rules: delete mxHERO - Route Inbound and mxHERO - Route Outbound.
2. Mail flow › Connectors: delete mxHERO Inbound Route and mxHERO Outbound Route, then mxHERO Tenant Connector.
3. Microsoft Defender portal › Email & collaboration › Policies & rules › Threat policies › Anti-spam › Connection filter policy (Default): remove the 8 mxHERO IP addresses from the IP Allow list.
4. Microsoft Defender portal › Advanced delivery › ARC tab: remove mxhero.com from the trusted ARC sealers.

PowerShell:

# 1. Rules
Remove-TransportRule -Identity "mxHERO - Route Inbound"  -Confirm:$false
Remove-TransportRule -Identity "mxHERO - Route Outbound" -Confirm:$false

# 2. Connectors
Remove-OutboundConnector -Identity "mxHERO Inbound Route"  -Confirm:$false
Remove-OutboundConnector -Identity "mxHERO Outbound Route" -Confirm:$false
Remove-InboundConnector  -Identity "mxHERO Tenant Connector" -Confirm:$false

# 3. Connection filter IP Allow list
$ips = @("54.208.111.28","54.236.184.32","54.165.252.128","54.165.253.193",
         "3.211.77.148","52.22.51.97","54.209.222.83","107.23.152.206")
$keep = (Get-HostedConnectionFilterPolicy "Default").IPAllowList | Where-Object { $ips -notcontains $_ }
Set-HostedConnectionFilterPolicy "Default" -IPAllowList $keep

# 4. ARC trusted sealers (keeps the others)
$keepSealers = (Get-ArcConfig).ArcTrustedSealers -split "," | ForEach-Object { $_.Trim() } |
               Where-Object { $_ -and $_ -ne "mxhero.com" }
if ($keepSealers) { Set-ArcConfig -Identity Default -ArcTrustedSealers ($keepSealers -join ",") }

If a command reports that an object doesn't exist, it was not created for your architecture; continue. If mxhero.com is your only trusted ARC sealer, the script above leaves it. It has no effect once mxHERO no longer sends you mail, and you can remove it in the Defender portal.

TNEF stays turned off. You can leave it that way, or turn rich-text format back on for the Default remote domain if you need it.

Google Workspace

1. Gmail › Compliance › Content compliance: delete mxHERO inbound routing and mxHERO outbound routing.
2. Gmail › Hosts: delete mxHERO Inbound and mxHERO Outbound.
3. Gmail › Routing › SMTP relay service: delete the rule that allows the mxHERO IP addresses.
4. Gmail › Spam, phishing, and malware › Inbound gateway: remove the 8 mxHERO IP addresses. If you set up message tagging for mxHERO (^X-Gm-spam: (0|1)$), clear it too. If no other gateway uses this setting, turn the inbound gateway off.
5. Click Save after each change.

Step 5: Update DNS

1. SPF: remove include:_spf.mxhero.com from your SPF record. If your record uses the older consolidated include:_spf-gmail.mxhero.com, replace it with include:_spf.google.com so Gmail stays authorized.

   v=spf1 include:_spf.google.com ~all

2. DKIM: delete the mxHERO DKIM TXT record (mxhero._domainkey or mxhero-xxxx._domainkey).

3. MX: confirm no MX record points to an mxHERO host.

Step 6: Clean up mxHERO

1. In Rules › Rules List, disable the remaining rules, including User Mailboxes rules, which work through APIs and keep running without routing.
2. Optional: disconnect your mail system and storage integrations in Settings › Integrations.

Verify

1. Send a message from an outside account to a user, and from a user to an outside account.
2. Check the headers of both: there is no X-mxHero-Server header and no Received header from an mxHERO host.
3. Check Reports › Email Flow Logs: the test messages don't appear.

If your subscription has already ended

If senders get Relay access denied for sender <domain>. Please contact mxHERO support., or mail to your domain is deferred with "Relay access denied", your mail system is still routing to mxHERO but your mxHERO domains are inactive. Mail is being rejected or delayed now, so act at once:

1. Do Step 2 for your platform: disable the routing rules, clear the Gmail outbound gateway, and move MX back to your mail system.
2. Skip Steps 1 and 3; mxHERO is no longer processing your mail.
3. Do Steps 4 and 5.

To reactivate instead, contact mxHERO support. See Getting support.

Troubleshooting

Related pages

• Routing architectures
• Office 365 Configuration Service
• Office 365 manual configuration
• Google Workspace configuration
• Mail loops and bounces