Exchange Online connectors for mail flow through Conbool

Conbool sits as a gateway in the mail flow of Microsoft 365 and Exchange Online. The connection is made with two connectors and three rules. Central signature, encryption and inbound protection then apply regardless of the client.

The setup wizard in the portal creates these objects itself once administrator consent has been granted. This page describes the same state by hand through the Exchange admin center, for organisations that do not grant consent or want to control the objects themselves. The order of the sections is the order of the setup.

Values you will need

In all examples example.com stands for your own mail domain. The remaining values:

• Smart host and certificate name are shown in the portal under Settings, Domains, in the respective domain in the mail server field. In the setup wizard they appear at the mail server step as soon as manual setup is chosen. Partner and on-premises installations deliver from their own instance and show different values there. In the cloud edition both read mail.conbool.com.
• Exception header is X-Conbool- followed by the mail domain with its dots replaced by hyphens. example.com becomes X-Conbool-example-com. The value is always true. By it Exchange recognises that a message has already passed the gateway. For outgoing messages Conbool sets the header of the sender domain and for incoming messages the header of the recipient domain. Every message concerning a domain therefore carries the header of exactly that domain.
• ARC sealer is arc.conbool.com, likewise different for partner and on-premises installations.

Check the accepted domain

In the Exchange admin center under Mail flow, Accepted domains the domain must have the type Authoritative.

If it says Internal relay, even mail between two of your own mailboxes leaves the organisation. It comes back through Conbool, Exchange again does not find the recipient as local and routes it out again. That is a closed loop which only ends through the hop count of Microsoft or of Conbool. The type therefore belongs checked before anything else.

Internal relay is only correct if part of the mailboxes of this domain sits outside Exchange Online, for instance in a hybrid environment. That part then needs a route of its own, and the loop check below applies to both paths separately.

Outbound connector

Under Mail flow, Connectors, Add connector:

• Connection from Office 365, connection to Your organisation's email server
• Name Conbool Outbound Connector example.com
• Use of connector set to Only when I have a transport rule set up that redirects messages to this connector
• Routing set to Route email through these smart hosts with the value mail.conbool.com
• Security restrictions with Always use Transport Layer Security, Issued by a trusted certificate authority and subject name mail.conbool.com

Restricting to the transport rule is mandatory. Without it, Exchange evaluates the connector for the entire outbound traffic of the organisation, including domains that are not with Conbool at all. It is at the same time the precondition for the rule in the next section to be able to offer this connector as a target.

Inbound connector

Under Mail flow, Connectors, Add connector:

• Connection from Partner organisation, connection to Office 365
• Name Conbool Inbound Connector example.com
• Sender domains set to *
• Authentication through the subject name in the certificate of the sending server with the value mail.conbool.com
• Security with Reject email messages if they aren't sent over TLS and the restriction to senders presenting this certificate

Two points deliberately depart from the obvious path. The type Partner organisation is correct, even though Conbool sits in the path like a server of your own. The type Your organisation's email server maps the connection through the certificate name, and that name is the same across all Conbool installations. Especially in hybrid environments the mapping then reaches beyond your own organisation and produces errors of the 4.4.62 kind. An active connector of the type Partner organisation with the Conbool certificate name is later adopted, not replaced, by the setup wizard, whatever name it was given.

And the sender domains stay at *, because checked mail from arbitrary senders arrives through this connector. Individual domains at this point lock out foreign senders. Protection is provided by the certificate, not by the domain list.

Authentication through IP addresses is not provided for. The addresses of the gateway change, the certificate does not.

Rule 1: outbound route

Under Mail flow, Rules, create a new rule named Conbool Exchange transport rule example.com with priority 0.

Match sender addresses in Header or envelope.

Conditions, both together:

• The sender is located Inside the organisation
• The sender domain is example.com

Action:

• Route the message using the connector with the outbound connector

Exceptions, all four:

• A message header matches these text patterns, header X-Conbool-example-com, pattern true
• The message type is Calendaring
• A message header includes any of these words, header Return-Path, word <>
• The sender address matches these text patterns, pattern <>

Mode Enforce, rule enabled.

The first exception is the whole loop protection. If it is missing or the header is misspelled, Exchange immediately routes out again every message returned by Conbool. The other three exceptions keep calendar traffic and non-delivery reports out of the route, which would otherwise circle as well.

One rule per mail domain. The header carries exactly one domain in its name. A rule that lists several sender domains in one condition knows the header of only one of them. Mail from the other domains comes back with the header of its own domain, the exception does not apply, the message is routed out again and circles. Exactly this pattern arises regularly when a test domain sits next to the production domain in the same Microsoft 365. Two domains mean two rules, each with its own domain condition and its own header. The connectors stay the same.

The domain condition is mandatory. A rule with Inside the organisation as its only condition catches the entire internal sending of the organisation, regardless of the sender domain, and produces the same picture.

No second route on the same traffic. Older rules from earlier attempts, rules of other vendors or a second Conbool rule with a different name overwrite each other in the routing action. Before the first test message the rule list belongs reviewed once from top to bottom, and rules that are not needed are deleted rather than disabled.

Rule 2: spam marking

Name Conbool Spam classification rule, priority 1. This rule is created once per organisation, not per domain. It evaluates only the header and therefore needs no domain condition.

• Condition: A message header matches these text patterns, header X-Conbool-Flag, pattern YES
• Action: Set the spam confidence level (SCL) to 7

With that, whatever Conbool detects as spam lands in the junk folder of the mailbox instead of the inbox.

Rule 3: releases from quarantine

Name Conbool Quarantine Release Bypass, priority 2. This rule is created once per organisation, not per domain.

• Conditions: A message header matches these text patterns, header X-Conbool-Released, pattern yes, plus sender Outside the organisation and recipient Inside the organisation
• Actions: Set the spam confidence level (SCL) to -1 and Stop processing more rules

Without this rule a message released from quarantine falls into Microsoft's spam scoring and disappears again. Restricting it to senders from outside and recipients inside prevents replies to released messages from bypassing filtering as well.

Register the ARC sealer

Under Settings, Email authentication, ARC, add arc.conbool.com as a trusted sealer. Existing entries stay, the list is extended and not replaced.

Conbool seals every inbound message with the authentication result from the state before its own processing. Without the entry Microsoft discards that result. Messages from senders with a strict DMARC policy then land in the junk folder despite passing the check, as soon as Conbool changes the text, for instance by link rewriting or a disclaimer. The change takes up to 30 minutes to take effect.

Switch the MX

Only once connectors and rules are in place is the MX record of the domain pointed at Conbool. The wizard shows the values for it, described under connecting a domain. The internal relay host to which Conbool returns checked messages is entered there as well. For Exchange Online that is the record of the form example-com.mail.protection.outlook.com.

Outbound, Conbool then delivers directly to the recipient's mail server. If an existing instance is to stay in the path for security or archiving, the outbound path instead goes to a defined smart host, controlled through the mailer table and smart host routing.

Verify the setup

• Outbound: send a test message to the outside. It appears in the portal in message tracing with direction outbound and a DKIM signature set.
• Inbound: send a test message from outside and look at the headers in the recipient mailbox. X-Conbool-example-com with the value true must be present.
• Internal: send a message between two of your own mailboxes. It must appear exactly once in message tracing. Several times means a loop.
• Two domains: additionally send the internal test from the second domain to the first. This path covers the separation of rules and headers and stays undetected in a check within a single domain.

Failure pattern: mail loop

Recognisable by three signs: Microsoft answers with 5.4.1 Hop count exceeded - possible mail loop, the same message appears repeatedly in message tracing every minute, and the headers contain double-digit numbers of Received lines.

The causes in order of frequency:

1. One rule covers several sender domains and the exception header matches only one of them.
2. The exception header is missing, misspelled or carries a value other than true. Dots instead of hyphens in the name are the most common typo.
3. The accepted domain is set to Internal relay instead of Authoritative.
4. The rule has no condition on the sender domain.
5. A second rule or a second connector from an earlier setup is still active in the list.

Conbool detects circling messages by the hop count, breaks them off and discards the copies. Traffic calms down as a result, but the cause in Exchange remains and has to be fixed from the list above.

Limits

• Delivery runs on port 25. A different port is not provided for.
• Authentication of the inbound connector runs through the certificate name, not through IP addresses.
• If the setup wizard in the portal is used later, it creates its own objects and only clears away its own earlier versions. Rules and connectors created by hand remain. They belong deleted before the wizard runs, otherwise two routes exist for the same traffic, and that is again the starting point of a loop. The inbound connector of the type Partner organisation is the exception, the wizard adopts it.

Continue with the product-level connection in SecureMail for Microsoft 365 and with add-in deployment. For self-operated servers your own mail server applies instead.