Integrating with 3rd Party Connector-Based Email Security Solutions

Overview

When using MetaDefender for Microsoft 365 alongside other SMTP connector-based email security solutions, it's important to configure your mail flow rules carefully. Improper configuration can cause email loops or delivery issues, especially when emails are routed back to Microsoft 365 after inspection.

This article explains how to integrate MetaDefender for Microsoft 365 with 3rd party email security services and prevent mail looping by properly adjusting mail flow rule exceptions.

Problem

Email loops may occur if MetaDefender for Microsoft 365 processes emails that have already passed through another email security gateway and are then routed back into Microsoft 365. This can lead to:

  • Duplicate email scanning

  • Increased latency or delivery delays

  • Potential delivery failures or message rejection

  • Infinite mail loops in extreme cases

Solution

Step 1: Collect IP Ranges from 3rd Party Service

Before modifying MetaDefender for Microsoft 365 rules, obtain the public IP ranges used by your 3rd party security service to send emails back into Microsoft 365. These are typically documented by the vendor or available through their admin console.

Info

MetaDefender for Microsoft 365 IP ranges can be found here Service IP ranges

Step 2: Update Mail Flow Rules in Microsoft 365

Update the relevant mail flow rules below. (Note: Only modify the rules that are present in your environment.)

  • OPSWAT MetaDefender Cloud Email Security - Inbound emails

  • OPSWAT MetaDefender Cloud Email Security - Outbound emails

Action:

  • Add an exception to the rule based on Sender IP address.

  • Specify the collected 3rd party IP ranges.

Example: Adding an Exception to a Rule

  1. Go to Microsoft 365 Admin Center > Exchange Admin Center.

  2. Navigate to Mail flow > Rules.

  3. Select the rule, e.g., OPSWAT MetaDefender Cloud Email Security- Inbound emails.

  4. Click Edit.

  5. Under Except if..., choose The sender's IP address is in any of these ranges or exactly matches.

  6. Add the 3rd party IP addresses.

  7. Save the rule and apply changes.