Skip to main content
The integration is done via mail flow rules and connectors.
Prerequisites

​
Create xorlab to M365 connector

This connector makes sure that M365 will accept emails from xorlab.
  1. Go to Exchange Admin Center → Connectors → add a connector: Add a connector
  2. Connection from → Your organization’s email server: New connector
  3. Set the name to xorlabToMicrosoft365 and enable Retain internal Exchange email headers: Connector name
  4. Choose By verifying that the subject name… and add *.xyz.activeguard.cloud where xyz is your customer ID: Authenticating sent email
  5. Create connector.

​
Create M365 to xorlab connector

This connector makes sure that all emails are routed through xorlab.
  1. Create a new connector.
  2. Connection from → Office 365, and Connection to → Your organization’s email server: New connector from M365
  3. Set the name to Microsoft365Toxorlab and enable Retain internal Exchange email headers: Connector name from M365
  4. Select Only when I have a transport rule set up…: Use of connector
  5. Add a new smart host with the value mx.xyz.activeguard.cloud, where xyz is your customer ID: Routing
  6. Activate Always use Transport Layer Security… and select Issued by a trusted certificate authority (CA): Security restrictions
  7. Enter a company mailbox where a validation email should be sent to: Validation email
    Unsuccessful validationThe connector validation might fail at this point. If this happens, save the connector without validation, create the mail flow rule in the next section and then validate the connector again.
  8. Review the connector and click Create when it’s OK.

​
Create mail flow rules

Here we create mail flow rules that use the connector from above. The mail flow rules make sure that there is no loop between xorlab and M365.
  1. Go to Exchange Admin Center → Mail flow → Rules and create a new rule: Creating a new rule
  2. Configure the rule like this:
    • Name: IncomingToxorlab
    • Apply this rule if → The sender → is external/internal → Outside the organization
    • Click the plus icon (+) to add another condition
    • And → The recipient → is external/internal → Inside the organization
    • Do the following → Redirect the message to → the following connector → choose Microsoft365Toxorlab
    • Except if → The sender → IP address is in any of these ranges… → add all IPs of the xorlab MTAs (find them in the DNS A records of mx.xyz.activeguard.cloud)
    New rule
  3. Click through Next → Finish and leave all settings at their defaults.
  4. Repeat steps #2-3 to add another rule but this time set:
    • Name: OutgoingToxorlab
    • The sender → Inside the organization
    • The recipient → Outside the organization
    • Except if → The message properties → Automatic Reply
      Exclude automatic repliesIn the outgoing rule we exclude automatic replies because M365 does not always accept them when sending them back.
    Outgoing rule
  5. Enable both rules in the Rules page.
  6. It can take several minutes until the rule is active. Test it by sending an incoming and outgoing email.

​
Troubleshooting

Apply the following measures only if you experience deliverability issues between M365 and xorlab. Normally, they are not necessary.

​
M365 rejects emails from xorlab

If M365 rejects some legitimate emails from xorlab, there are multiple measures. Apply them in order written below until the problem is fixed. First, add your xorlab domain as an “accepted domain”.
  1. Go to Microsoft 365 Admin Center → Settings → Domains and add a domain: add-domain
  2. Enter xyz.activeguard.cloud, where xyz is your customer ID: Add a domain name
  3. Select the first option Add a text record…: Domain verification method
  4. Send the TXT value to support@xorlab.com so that we can add it to the DNS record of your domain. After this has been done, verify: Domain verification data
  5. After a successful verification, click More options and select Skip and do this later: Domain skip and do this later
If that does not help, you can add xorlab to your SPF records.
You can add the xorlab MTAs to your SPF records. For this, include a:mx.xyz.activeguard.cloud to all your domains that route emails via xorlab:
Afterward, check that your SPF records are still valid, for example with DMARCanalyzer’s SPF checker.
If adding xorlab to your SPF record did also not help, you can add xorlab to the anti-spam policy of M365.
  1. Go to Anti-spam policies and select Connection filter policy (Default): Anti-spam policies
  2. Click Edit connection filter policy: Connection filter policy
  3. Enter the xorlab MTA IPs to the first field: Allowed IPS for connection cilter
  4. Check if the addresses are correct under IP Allow list and click Close.

​
M365 puts emails from xorlab into Junk

The following mail flow rule will bypass the M365 spam filtering for emails coming from xorlab. Note that this will mostly disable the Junk folder mechanism for your mailboxes.
  1. Go to Exchange Admin Center → Mail flow → Rules and create a new rule: Creating a new rule
  2. Configure the rule like this:
    • Name: SpamBypassxorlab.
    • Apply this rule if → The sender → IP address is in any of these ranges… → add all IPs of the xorlab MTAs
    • Click the plus icon (+) to add another condition
    • And → The message properties → include an SCL greater than or equal to → Bypass spam filtering
    • Do the following → Modify the message properties → set the spam confidence level (SCL) → Bypass spam filtering Bypass spam filtering actions
  3. Click through Next → Finish and leave all settings at their defaults.
  4. Enable the rule in the Rules page.

​
Next steps

Optionally continue with: Once the integration is complete, continue with What to Configure Next.