# How to use an external spam filter with Microsoft 365 and Enhanced Filtering for Connectors URL: https://iblockspam.com/blog/microsoft-365-third-party-spam-filter-enhanced-filtering Last updated: 2026-10-09 Published: 2026-10-09 Topic: Setup guides Author: iBlockSpam Team > How to run an MX-level spam filter in front of Exchange Online: Partner connector, Enhanced Filtering for Connectors, why not SCL -1, headers and rollback. ## Short answer Point MX to the filter, create a Partner inbound connector for it, and enable Enhanced Filtering for Connectors on that connector with the filter's IP ranges. Microsoft 365 then evaluates SPF, DKIM and DMARC against the original sender. Don't use an SCL -1 bypass rule, and restrict the connector by certificate or IP once MX has moved. Microsoft documents three ways to combine a non-Microsoft email security service with Microsoft 365. The one it fully supports for inbound filtering is DNS mail routing: your MX points to the filtering service, which delivers to Exchange Online, with Enhanced Filtering for Connectors turned on ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/mdo-integrate-security-service)). This guide explains why that setting matters and how to configure it correctly. ## What goes wrong without Enhanced Filtering? When a filter sits in front of Microsoft 365, every message arrives from the filter's IP addresses. Microsoft puts it plainly: "the message adopts the source IP of the last hop that sits in front of Microsoft 365... it's simply how SMTP works" ([Microsoft Learn](https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/use-connectors-to-configure-mail-flow/enhanced-filtering-for-connectors)). Consequences: - SPF checks ([RFC 7208](https://www.rfc-editor.org/rfc/rfc7208)) run against the filter's IP, so legitimate mail can fail SPF and spoofed mail can't be judged on its real source. - DMARC can't be enforced explicitly. Headers show `compauth` reason `905`: "DMARC wasn't enforced due to complex routing" ([Microsoft Learn: anti-spam headers](https://learn.microsoft.com/en-us/defender-office-365/message-headers-eop-mdo)). - IP reputation, heuristic clustering, anti-spoofing and anti-phishing lose accuracy. - Microsoft warns that skipping this step inevitably results in misclassification of inbound mail. ## Why not just bypass Microsoft's filtering with SCL -1? | Approach | What Microsoft 365 sees | Microsoft's position | Risk | | --- | --- | --- | --- | | Nothing configured | The filter as the sender | Not recommended | Misclassification, false positives | | Mail flow rule setting SCL -1 for the filter's IPs | The filter as the sender; spam checks skipped (`SFV:SKN`) | Possible, but not recommended | Filter IPs are shared across customers; spoofed or phishing mail from those IPs is let through | | Enhanced Filtering for Connectors | The original sender | "Highly recommended" | Low; requires accurate IP list | Microsoft's reasoning: "Most third-party cloud anti-spam providers share IP addresses among many customers. Bypassing scanning on these IPs might allow spoofed and phishing messages" ([Microsoft Learn](https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/manage-mail-flow-using-third-party-cloud)). ## How do you configure it, step by step? You need the **Exchange Administrator** role (or **Organization Management** in Exchange Online). ``, `` and `` stand for your filter's values. 1. **Create a Partner inbound connector.** Exchange admin center (`https://admin.cloud.microsoft/exchange#/connectors`) > **Mail flow > Connectors > + Add a connector**. **Connection from: Partner organization**. Name it. On **Authenticating sent email**, choose **By verifying that the sender domain matches one of the following domains** and enter `*`. On **Security restrictions**, check **Reject email messages if they aren't sent over TLS**. Create the connector ([Microsoft Learn](https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/use-connectors-to-configure-mail-flow/set-up-connectors-to-secure-mail-sent-from-partner-organization)). 2. **Enable Enhanced Filtering.** Microsoft Defender portal > **Email & collaboration > Policies & rules > Threat policies > Rules > Enhanced filtering** (`https://security.microsoft.com/skiplisting`). Select the connector. Under **IP addresses to skip**, choose **Skip these IP addresses that are associated with the connector** and enter each range, or choose **Automatically detect and skip the last IP address**. 3. **Choose the scope.** **Apply to a small set of users** for a pilot, then **Apply to entire organization**. PowerShell for steps 1–3: ```powershell New-InboundConnector -Name "Spam filter inbound" -ConnectorType Partner ` -SenderDomains * -RequireTls $true -SenderIpAddresses Set-InboundConnector -Identity "Spam filter inbound" ` -EFSkipLastIP $false -EFSkipIPs ``` IPv6 ranges can only be set in PowerShell. Private (RFC 1918), loopback and Microsoft 365 IPs aren't accepted. 4. **Disable SCL -1 rules** that target the filter. In the Exchange admin center, **Mail flow > Rules**, find rules that set the spam confidence level to -1 and turn them off. 5. **Change MX** to ``. Remove the `mail.protection.outlook.com` MX entirely. 6. **Restrict the connector** after the old TTL has passed. Microsoft prefers certificate matching: ```powershell Set-InboundConnector -Identity "Spam filter inbound" ` -TlsSenderCertificateName ` -RestrictDomainsToCertificate $true ``` or `-RestrictDomainsToIPAddresses $true` with `-SenderIpAddresses`. Mail delivered straight to your tenant is then rejected with `5.7.51 TenantInboundAttribution`. 7. **Consider ARC.** If your filter supports ARC sealing, Microsoft recommends adding it as a trusted ARC sealer in the Defender portal. If it doesn't modify messages, this is less important. ## How do you verify it's working? Open a test message's headers (Outlook: **File > Properties > Internet headers**) or use our [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer). - **X-MS-Exchange-SkipListedInternetSender**: stamped when skip listing is enabled on the connector; shows the true source. - **X-MS-Exchange-ExternalOriginalInternetSender**: stamped when skip listing succeeded and the recipient is in scope. - **Authentication-Results**: `spf=pass (sender IP is …)` should show the original sender's IP. `compauth` reason `905` means Enhanced Filtering didn't apply to that message. - **X-Forefront-Antispam-Report**: `SFV:SKN` means a rule bypassed filtering. It shouldn't appear. The **Threat protection status** report in the Defender portal shows the effect over time. ## Which Microsoft 365 protections still apply? With Enhanced Filtering on, Microsoft 365 runs its normal inbound protection on mail from the filter. That includes anti-spam, anti-malware, anti-phishing and spoof intelligence, plus Safe Attachments and Safe Links if you have Defender for Office 365. Microsoft lists explicit email authentication, anti-spoofing, heuristic clustering and better automated investigation among the benefits ([Microsoft Learn](https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/use-connectors-to-configure-mail-flow/enhanced-filtering-for-connectors)). Two consequences are worth planning for: - **Two quarantines.** The filter holds what it catches; Microsoft 365 quarantines or junks what it catches. Tell users that digests from both are normal, and decide who reviews Microsoft's quarantine. - **Reporting false positives.** Report a message to the service that held it. If Microsoft 365 junked it, use Microsoft's submission tools; if the filter held it, release and report it there. Microsoft also notes that adding more products can increase false positives overall, which is one more reason to avoid SCL -1 shortcuts and keep both layers working on accurate sender data ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/mdo-integrate-security-service)). ## What are the pitfalls with pilots and hybrid setups? - **Pilot scope:** Enhanced Filtering applies only if *all* recipients are on the list. A message to one pilot user and one other user gets normal filtering for both. - **Proxy addresses:** list every address of each pilot user. - **Hybrid:** if mail passes the filter and then on-premises Exchange before Exchange Online, enable Enhanced Filtering on the **OnPremises** inbound connector as well. Microsoft doesn't support adding on-premises hybrid servers in non-linear routing (where mail goes Microsoft 365 → on-premises → Microsoft 365). - **Filters after Microsoft 365:** Enhanced Filtering isn't designed for services that scan mail after Exchange Online. ## How do you roll back? 1. Remove the connector restriction (`-RestrictDomainsToCertificate $false -RestrictDomainsToIPAddresses $false`). Do this before touching MX. 2. Point MX back to `.mail.protection.outlook.com`. 3. Keep the filter active until the old TTL has passed. 4. Disable Enhanced Filtering (`-EFSkipLastIP $false -EFSkipIPs $null`), then disable the connector. ## What are the common mistakes? - Enabling Enhanced Filtering on a different connector from the one the filter's mail matches. - Missing one of the filter's IP ranges. - Leaving an old SCL -1 rule active. - Restricting the connector before MX has propagated. - Double link wrapping by the filter and Safe Links. ## How iBlockSpam helps iBlockSpam is designed to sit in front of Exchange Online in the way Microsoft documents: MX to iBlockSpam, a Partner inbound connector, Enhanced Filtering for Connectors. The setup wizard shows your exact IP ranges and certificate name for the connector and Enhanced Filtering fields, a before/after DNS comparison, and rollback steps in the right order. Microsoft's own protection stays on as a second layer. If Exchange Online is unavailable, iBlockSpam holds mail for up to 5 days. The Microsoft 365 settings themselves are applied by you, in your tenant. ## Next steps 1. Confirm Enhanced Filtering is on for the Partner connector, and remove any SCL -1 rule it replaces. 2. Send a test from outside and look for the X-MS-Exchange-ExternalOriginalInternetSender header with the [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer). 3. For the iBlockSpam-specific values, see the [Microsoft 365 platform page](https://iblockspam.com/platforms/microsoft-365). If you're choosing the filter to put in front of Microsoft 365, see the [Microsoft 365 built-in vs gateway](https://iblockspam.com/compare/microsoft-365-built-in-vs-gateway) comparison and iBlockSpam's per-domain [pricing](https://iblockspam.com/pricing). See all [spam filter setup guides](https://iblockspam.com/blog/topic/setup). ## Frequently asked questions ### What is Enhanced Filtering for Connectors? A setting on an inbound connector, also called skip listing, that tells Microsoft 365 to skip the IPs of services in front of it and find the true source of each message. Microsoft fully supports it for a filtering service that sits in front of Exchange Online. ### Should I choose 'Automatically detect and skip the last IP address' or list IPs? Microsoft recommends the automatic option when only the last hop needs skipping. Listing the filter's ranges is more explicit and also works. Use one or the other, and include every public IP the filter delivers from. ### Can I test Enhanced Filtering on a few users first? Yes, with 'Apply to a small set of users' or -EFUsers. It applies only when every recipient of a message is on the list, and you must list every proxy address of each test user. ### Is an SCL -1 mail flow rule ever right? Microsoft notes a few cases, such as Defender for Office 365 evaluation mode or a phased defense-in-depth rollout. For a normal deployment, Microsoft recommends Enhanced Filtering instead and says to disable SCL -1 rules once it's on. ### Will Safe Links still work? Yes, but avoid having both services rewrite links. Microsoft recommends disabling link wrapping in the non-Microsoft service to prevent double wrapping. ## Sources - [Microsoft Learn: Enhanced Filtering for Connectors in Exchange Online](https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/use-connectors-to-configure-mail-flow/enhanced-filtering-for-connectors) - [Microsoft Learn: Manage mail flow using a third-party cloud service with Exchange Online](https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/manage-mail-flow-using-third-party-cloud) - [Microsoft Learn: Integrate non-Microsoft security services with Microsoft 365](https://learn.microsoft.com/en-us/defender-office-365/mdo-integrate-security-service) - [Microsoft Learn: Set up a connector for mail from a partner organization](https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/use-connectors-to-configure-mail-flow/set-up-connectors-to-secure-mail-sent-from-partner-organization) - [Microsoft Learn: Anti-spam message headers](https://learn.microsoft.com/en-us/defender-office-365/message-headers-eop-mdo) - [RFC 7208: Sender Policy Framework (SPF)](https://www.rfc-editor.org/rfc/rfc7208) ## Free tools for this guide - [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser. - [MX Lookup](https://iblockspam.com/tools/mx-lookup): See where your mail is delivered, spot unfiltered backup MX and broken hosts. - [SPF Checker](https://iblockspam.com/tools/spf-checker): Count real DNS lookups, find PermErrors, loops and risky "all" settings. - [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject. --- Source: iBlockSpam, https://iblockspam.com/blog/microsoft-365-third-party-spam-filter-enhanced-filtering (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt