[email protected] your organization email server office 365: your cloud email subscription (exo and...

Spark the future.

May 4 – 8, 2015Chicago, IL

Using Connectors & Mail Routing in O365Khushru IraniProgram ManagerTransport Team, O365

BRK3159

Session Objectives And Takeaways

How mailflow works in Office 365So why do I need connectors?Dispel myths about connectorsNew Connector UI demo

Customer Type and MailflowExchange Online (EXO)

Hosted – all mailboxes are in Office 365 Hybrid – some mailboxes are in Office 365, some are in on-premises

Exchange Online Protection (EOP)All mailboxes are hosted in on-premises, use EOP for protection only

Customer type determines configuration and how mail flows through Office 365

Mail flow participants

[email protected] [email protected]

e.g. [email protected]. MessageLabs

Your organization email server

Partner organizationEmail Service Provider

Internet

[email protected]

Office 365: Your cloud email subscription (EXO and EOP), hosts your cloud mailboxes. It also acts as a hub for all mailflow of Office 365 customers

Your organization email server (a.k.a. on-premises server): This is an email server that you manage. It could be MS Exchange, or any other email server such as Lotus Notes. Cloud-only organizations won't have one.

Partner Organization: A partner can be an organization you do business with, such as a bank.

Email Service Provider: A cloud email service provider that provides services such as archiving, anti-spam, etc.

Internet: Email sent from the Internet that doesn't originate from your organization email servers or rest of the participants.

Scenario: Fully Hosted

Fully Hosted

Contoso.com

Add domain contoso.com in O365 and verify you own the domain by adding a txt record (at DNS provider)

Contoso.com is registered as an accepted domain

Fully Hosted

MX Record


Add users Change MX record for contoso.com to point to O365

(at DNS provider)

Contoso.comContoso.com is

registered as an accepted domain

Fully Hosted

MX Record



(at DNS provider)

contoso.com MX preference = 10, mail exchanger = contoso-com.mail.protection.outlook.com

contoso-com.mail.protection.outlook.com internet address = 207.46.163.170contoso-com.mail.protection.outlook.com internet address = 207.46.163.215contoso-com.mail.protection.outlook.com internet address = 207.46.163.247

Contoso.com Region based

IPsContoso.com is registered as an accepted domain

Fully Hosted

MX Record



(at DNS provider)



Contoso.com

From: [email protected]: [email protected]

Do we need a connector for this scenario?

NO

Region based IPs


Fully HostedFrom: [email protected]: [email protected]

SPF Record

Register a SPF record (TXT) for contoso.com (at DNS provider)

"v=spf1 include:spf.protection.outlook.com -all“

SPF effectively tells the world that contoso.com can send mail using O365 IPs, thereby reducing the chances of your mail being considered as spam

Contoso.com


NO


Fully Hosted + Scanner/Printer

Contoso.com

Can it talk SMTP using TLS 1.0 & higher? Yes

Can your scanner authenticate using a username+password? Yes


NO





Contoso.com


smtp.office365.com (Username + Password)

Use SMTP Client submission to authenticate to O365 and send mail [connect to smtp.office365.com]

If you have multiple devices you can share the username/password

You can even send mail outside O365

Can it talk SMTP using TLS 1.0 & higher? Yes

Can your scanner authenticate using a username+password? Yes


Contoso.com


Can it talk SMTP using TLS 1.0 & higher? Not sure

Can your scanner authenticate using a username+password? No


NO

You will have to use “direct send”; especially if you don’t have a dedicated IP to send from(Mail highly prone to be marked as spam)Contoso.com is

registered as an accepted domain

Fully Hosted + Email marketing

Contoso.com

From: [email protected] From: [email protected]

To: [email protected]

EmailMarketing.com

Reply to: [email protected]


NO

This mail should NOT pass through O365 at all


Fully Hosted + Hosted Website/App

Contoso.com


www.contoso.com


NO

Authenticate using EWS

Create a user account in O365 (it could be shared) Use EWS API to authenticate & log in Send mail from that user account (subject to sender

& recipient limits)


Scenario: Hybrid (customers that have their own organization email servers)

Hybrid – Before the move to O365

Contoso.com

MX Record


contoso.com MX preference = 20, mail exchanger = mail.contoso.comcontoso.com MX preference = 10, mail exchanger = mailbackup.contoso.com mail.contoso.com internet address = 78.35.15.8mailbackup.contoso.com internet address = 78.35.15.9

Hybrid

Contoso.com

Contoso.com


MX Record



Move MX to point to O365 (preferred method, since it avoids many issues with SPF, DKIM, DMARC, etc.)


Add users you want to host in O365

Hybrid – Primary reason for having connectors

Contoso.com

Contoso.com

You want one happy family organization

Cloud + On-premises appear as one organization (Exchange headers are retained between the two)

MX Record


Hybrid – Connector From O365 To Your Org

Contoso.com

MX Record

Contoso.com


Connector (Direction of mail flow)From: O365To: Your organization servers(PSH: Outbound On-premise Connector)For all Accepted domainsPoint to your organization’s smarthost

Receive Connector(Firewall to accept mails from mail.protection.microsoft.com IPs)

Hybrid – Connector From O365 To Your Org

Contoso.com


MX Record

Contoso.com



Receive Connector(Firewall to accept mails from mail.protection.microsoft.com IPs)

Connector (Direction of mail flow)From: O365To: Your organization servers(PSH: Outbound On-premise Connector)For all Accepted domainsPoint to your organization’s smarthost

Hybrid – Mail queued to your org smart hostYou will see a Message Center post + an email notification to your admin

Connector: From O365 To Your Organization ServersDemo

Hybrid – Authoritative Domain

Contoso.com

MX Record

Contoso.com

Contoso.com is registered as an accepted domain of type = Authoritative


Contoso.com domain is of type = Authoritative [This gives you Directory Based Edge Blocking*]

Users+Groups in your organization need to be synced to O365

For every user with a mailbox in your on-premises org, have a mail user with an External Email Address* As long as you don’t have Public Folders or Dynamic Distribution

Groups

Hybrid – Internal Relay Domain

Contoso.com

MX Record

Contoso.com

Contoso.com is registered as an accepted domain of type = Internal Relay


If you don’t want to sync users+groups in your organization to O365, then mark your domain as Internal Relay

You will not get DBEB (Directory Based Edge Blocking)

Hybrid – Connector From Your Org To O365

Contoso.com

Contoso.com



Send Connector(All mail goes via smarthost contoso-com.mail.protection.outlook.com)Connector (Direction of mail flow)From: Your organization serversTo: O365(PSH: Inbound On-premise Connector)Prove Identity using certificate or IP[Sender domain must match Accepted domain]

Hybrid – Connector From Your Org To O365

Contoso.com

SPF Record

Contoso.com


Send Connector(All mail goes via smarthost contoso-com.mail.protection.outlook.com)

From: [email protected]: [email protected] "v=spf1 include:spf.protection.outlook.com –

all”

Connector (Direction of mail flow)From: Your organization serversTo: O365(PSH: Inbound On-premise Connector)Prove Identity using certificate or IP[Sender domain must match Accepted domain]

Connector: From Your Organization Servers To O365Demo

Hybrid – In Summary

Contoso.com

SPF Record

Contoso.com


MX Record

You create 2 connectors because – You want one happy family

organization Cloud + On-premises appear as one

organization (Exchange headers are retained between the two)

Keep in mind – You MUST have dedicated IPs (those

IPs MUST belong to your organization)

More secure way of proving mail comes from on-premises is TLS using certificate (issued by well-known CA) vs. IPs

Sender domain MUST match accepted domain

Between O365 and your on-premises there MUST be no other service provider

Hybrid – Retain Exchange Internal HeadersFor Mail flow between O365 and your org Exchange Servers

Exchange internal headers are used by some Exchange components (such as DL permission management, calendar). Note: Transport rule no longer requires this.

All Exchange internal headers (X-MS-Exchange-Organization-xxxx) are stripped off by O365 before coming into or leaving from O365

To retain these headers between the two environmentsMailflow In On-premises (Your organization email servers) In O365

On-premises->O365

Ex 2013: Sendconnector(CloudServicesMailEnabled) Ex 2010: RemoteDomain (TrustedMailOutboundEnabled)

UI: “Retain Exchange internal headers”Cmdlet: Inbound connector(CloudServicesMailEnabled)

O365->On-premises

Ex 2013: Default Frontend ReceiveConnector:1. TlsCertificateName <Subjectname>2. TlsDomainCapabilities:mail.protection.outlook.com:AcceptCloudSer

vicesMail Ex 2010: RemoteDomain (TrustedMailInboundEnabled)

Outbound connector(CloudServicesMailEnabled)

Hybrid + Scanner/Printer or In-house App

Contoso.com

SPF Record

Contoso.com


MX Record

You can use existing connectors to send mail from the scanner or app


Hybrid – Force TLS with certain partners

Contoso.com

SPF Record

Contoso.com


MX Record

Partner – bank.com From: [email protected]: [email protected]


Bank.com sends mail to Contoso.com like any other org on the Internet

O365 will apply TLS for mail from bank.com to O365, if bank.com chooses to apply TLS

O365 will apply TLS for mail from O365 to bank.com, if bank.com supports TLS


NO, but…

...If you want to force TLS with certain partners

Contoso.com

Contoso.com




Connector (Direction of mail flow)From: Your partner organizationTo: O365(PSH: Inbound partner connector)

Connector (Direction of mail flow)From: O365To: Your partner organization(PSH: Outbound partner connector)

SPF RecordMX

Record

...If you want to force TLS with certain partners

Contoso.com

Contoso.com




SPF RecordMX

Record From Partner Organization to

O365: Force TLS; If TLS isn’t used, then reject incoming connection

From O365 to Partner Organization: Force TLS; If TLS isn’t supported by partner, then do not send mail to partner

Connector: From O365 To Partner Organization and From Partner Organization to O365Demo

Hybrid – Instead of MX pointing on-premises

Contoso.com

MX Record

contoso.com MX preference = 20, mail exchanger = mail.contoso.comcontoso.com MX preference = 10, mail exchanger = mailbackup.contoso.com mail.contoso.com internet address = 78.35.15.8mailbackup.contoso.com internet address = 78.35.15.9

Hybrid – MX points to a (shared) service

Contoso.com

MX Record


contoso.com MX preference = 10, mail exchanger = cluster9.us.messagelabs.com

cluster9.us.messagelabs.com internet address = 216.82.241.83cluster9.us.messagelabs.com internet address = 216.82.242.19cluster9.us.messagelabs.com internet address = 216.82.249.35Do we need a connector for this

scenario?NO, but…

...If you want to force TLS + route all outbound mail

Contoso.com

Contoso.com


Connector (Direction of mail flow)From: Your partner organizationTo: O365(PSH: Inbound partner connector)

Connector (Direction of mail flow)From: O365To: Your partner organization(PSH: Outbound partner connector)Recipient domain = *

MX Record

...If you want to force TLS + route all outbound mail

Contoso.com

Contoso.com


MX Record From: [email protected]

To: [email protected]

From Partner Organization to O365: Force TLS; If TLS isn’t used, then reject incoming connection(Identify the partner via these IPs)


From O365 to Partner Organization: Force TLS; If TLS isn’t supported by partner, then do not send mail to partner(Because recipient domain=*; we route mail outside using the connector)

Hybrid – Which Connector does O365 pick?

Contoso.com

Contoso.com


MX Record

Which Connector does O365 pick? From O365 to partner organization

Recipient domain = * Send mail to partner IPs


From O365 to your organization Recipient domain=Accepted

domains Send mail to Org IPs

Closer match on recipient domain wins

Summary

Who Needs to Create Connectors in O365You have a standalone Exchange Online Protection (EOP) subscription (required)

You are a hybrid organization with an Exchange Online subscription (required)

You have an Exchange Online subscription and your organization needs to send email messages from non-mailboxes, such as printers/scanners (optional)

You often exchange email with business partners, and you want to apply certain security restrictions (optional)

Questions

Visit Myignite at http://myignite.microsoft.com or download and use the Ignite Mobile App with the QR code above.

Please evaluate this sessionYour feedback is important to us!

http://myignite.microsoft.com/

[email protected] your organization email server office 365: your cloud email subscription (exo and...

Documents

accepted domain slide

mx record

txt record

spf record txt

internet address

mx preference

dns provider v

cloud email service