O365 Inbound Mail Server Address

[AB_IT]

Hey All,

 

Just changing over to O365 from our on-prem exchange server. We use a filter called Trend Micro Hosted Email Security which was originally pointing to our Office IP address to access our exchange server and filter appropriatley. I need to change this so it's pointing at our O365 platform instead.

 

The issue is the service is asking for an Inbound Mail Server IP or FQDN and port number. I've looked everywhere to try and source something for O365 but to no avail.

 

Does anyone know where I can find this information from?

 

Any help would be most appreciated, all our support has isn't available anymore so I'm all on my own trying to navigate this lol!

 

Thanks in advance

[jslate1980]

Here are the instructions to add inbound connector for office 365 https://docs.trendmicro.com/en-us/enterprise/hosted-email-security-getting-started-guide/configuring-a-domain/adding-office-365-in.aspx. Though we have this with our licensing, I use cloud app security tool instead.

[AB_IT]

Thank you for responding pal I've already done the above and added into O365 but Trend Micro I presume will need to be pointed to O365 in order to deliver emails there and not to our Exchange Server?

 

It's this part that I'm stuck on although even their instructions don't tell you how to retrieve the Inbound Server address...

 

[jslate1980]

Thank you for responding pal I've already done the above and added into O365 but Trend Micro I presume will need to be pointed to O365 in order to deliver emails there and not to our Exchange Server?

 

It's this part that I'm stuck on although even their instructions don't tell you how to retrieve the Inbound Server address...

 

[ATTACH=CONFIG]62512[/ATTACH]

It gives you the ip addresses in the article for Europe, Africa and the Middle East.

[jslate1980]

Reading again I think its just this.

 

52.48.127.192/26

Edited July 8, 2021 by jslate1980

[AB_IT]

Reading again I think its just this.

 

52.48.127.192/26

I don't think it's that as that's for pointing O365 to Trend Micro as it's Trend Micro's servers. The IP that was in the field previously on the Trend Micro Dashboard was our Exchange Mail Servers IP address. But I don't know what to put in for O365?

 

Hopefully these screenshots will explain better what I mean

 

[chaplic]

orgname-co-uk.mail.protection.outlook.com

 

basically your dns name with dashes instead of dots then

 

.mail.protection.outlook.com

 

 

Be aware you have to tell O365 about your mail gateway, otherwise SPF checks in O365 will fail as it sees your box trying to spoof the original sender. Dont just crudely trust email from your box and put in a SCL -1 rule.

 

 

Enhanced filtering for connectors | Microsoft Docs

[Guest Guest]

Surely you'd just point your Mx record at trend micro and then trend micro to the Mx record as in the Office 365 portal

[AB_IT]

orgname-co-uk.mail.protection.outlook.com

 

basically your dns name with dashes instead of dots then

 

.mail.protection.outlook.com

 

 

Be aware you have to tell O365 about your mail gateway, otherwise SPF checks in O365 will fail as it sees your box trying to spoof the original sender. Dont just crudely trust email from your box and put in a SCL -1 rule.

 

 

Enhanced filtering for connectors | Microsoft Docs

Thanks mate, I tried doing what you said previously and just copied the MX record that O365 gives into Trend Micro using Port 25... I'm not sure on the port as O365 doesn't give you this so maybe that's what's wrong?

 

When I hover over the red "!" it says unable to connect to inbound server.

 

 

I didn't know I had to do any of the other stuff you have said about SPF and SCL -1 rule... I'll be honest I haven't got a clue what you're on about. I know "spf" is usually inputted into your domain as a TXT record is this the same thing? What do I need to do with this?

 

It all seems to be working weirdly... I can send and recieve emails just fine, I just can't figure out how it's working!? But now you've said about the latter I'm worried it won't continue to work?

 

Edit: I have a TXT record in my DNS saying this... "v=spf1 ip4:"On-Premise WAN Address" include:spf.hes.trendmicro.com include:spf.example.com ~all"

 

I presume I need to change the "On-Premise WAN Address" part to point to orgname-co-uk.mail.protection.outlook.com , have I got that right?

Edited July 8, 2021 by AB_IT

[chaplic]

So if this is the trend console, and your mail flow is

 

Internet->Trend->O365 then all that looks right, O365 uses port 25. If you read an header of a received email (use mha.azurewebsites.net) then you will see if you are following that route. I'd speak to trend about that 'config required' bubble.

 

SPF is about telling the internet which mailservers are allowed to send email on your behalf of your organisation

 

natwest.com for examples tells the internet these servers are allowed to send mail with a from address of natwest.com

 

"v=spf1 ip4:155.136.80.0/24 ip4:80.75.73.242 ip4:81.145.55.71 ip4:82.144.239.194 ip4:195.3.184.231 ip4:195.3.184.230 ip4:195.225.218.101 ip4:195.184.243.2 -all"

 

O365 pays attention to this too. However, if natwest send you any email, O365 won't see it coming from the above IP ranges, but instead from your trend box. It may still deliver it to your inbox, or maybe junk items, but you are asking for trouble. You can tell O365 to blindly trust anything coming from trend, but you are losing a layer of protection.

[AB_IT]

So if this is the trend console, and your mail flow is

 

Internet->Trend->O365 then all that looks right, O365 uses port 25. If you read an header of a received email (use mha.azurewebsites.net) then you will see if you are following that route. I'd speak to trend about that 'config required' bubble.

 

SPF is about telling the internet which mailservers are allowed to send email on your behalf of your organisation

 

natwest.com for examples tells the internet these servers are allowed to send mail with a from address of natwest.com

 

"v=spf1 ip4:155.136.80.0/24 ip4:80.75.73.242 ip4:81.145.55.71 ip4:82.144.239.194 ip4:195.3.184.231 ip4:195.3.184.230 ip4:195.225.218.101 ip4:195.184.243.2 -all"

 

O365 pays attention to this too. However, if natwest send you any email, O365 won't see it coming from the above IP ranges, but instead from your trend box. It may still deliver it to your inbox, or maybe junk items, but you are asking for trouble. You can tell O365 to blindly trust anything coming from trend, but you are losing a layer of protection.

Thank you for your help, I really do appreciate it!

 

Okay so my Domain config on TrendMicro is correct and I have port 25 as the port so there shouldn't be an issue? I'll speak to Trend tomorrow and see what they say.

 

Ah, that makes sense with regards to SPF. I presume there's no way around this as if I want to filter incoming emails through Trend it's always going to have Trend as the IP? Unless you think there's something I can do to maintain that layer of protection? Surely Trend will fill the gap and be the one to ensure SPF Records are correct before passing it onto my O365 users so does it matter if I make O365 blindly accept all emails from Trend?

 

Sorry for all the questions!

[chaplic]

The link I provided earlier Enhanced filtering for connectors | Microsoft Docs allows you to pop the IP addresses of trend into O365, so it knows what is going on, and in my natwest example will ignore trend as the sender and evaluate the original sender of the email, so you get dual layer protection, though you would think O365 wouldn't catch anything...