> ## Documentation Index
> Fetch the complete documentation index at: https://docs.xorlab.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Pages under /latest/ document the current release. Paths that begin with a version number, for example /10.0/, are frozen snapshots of superseded releases kept for reference only — never present their instructions as current. If the reader's version is unknown, answer from /latest/ and say which version the answer describes.
> xorlab is deployed on-premises, hybrid, or as a cloud service, and integrates with either Microsoft 365 or on-premises mail infrastructure. Configuration steps often differ between these. State which deployment and integration mode an instruction applies to instead of presenting one as universal.
> Distinguish inline mode from monitoring mode when describing anything that acts on email. Monitoring mode observes a copy and cannot block or quarantine; inline mode routes mail through xorlab and can.
> Write the product name as lowercase 'xorlab'. Use the documented component names: xorlab Control Center (XCC), xorlab MTA, xorlab Sandbox (DANA), xorlab Natural Language Understanding (NLU). After the first mention, use the short forms XCC, MTA, Sandbox, and NLU. Do not use DANA as a standalone name for the Sandbox, but keep it where it is a literal string in configuration keys, container names, and hostnames.
> Do not invent configuration keys, rule parameters, list names, log properties, or API fields. If a value is not present in this documentation, say that it is not documented rather than guessing.

# Set Up Email Routing in xorlab

> Configure email routing and TLS enforcement on xorlab in preparation for the Microsoft 365 integration.

<Warning>
  **Prerequisites**

  * Complete [Before You Begin](/latest/before-begin-integration)
</Warning>

## Enforce TLS

In `activeguard/mta/startup_cfg/postfix_custom/main.cf`, set the following parameters to enforce TLS on all connections. In SaaS, they are normally already configured like this.

```ini main.cf theme={null}
smtpd_tls_cert_file = /etc/ssl/my_certs/my_cert.crt
smtpd_tls_key_file = /etc/ssl/my_certs/my_cert.key
smtp_tls_security_level = verify
smtpd_tls_security_level = encrypt
```

If you had to change anything, click **Publish**. The new Postfix settings become active within about one minute.

## Route all emails to M365

1. Open `main.cf` in `activeguard/mta/startup_cfg/postfix_custom/`.
2. Set `relayhost` to `<GUID>.mail.protection.outlook.com`. You find your `<GUID>` in the M365 Exchange Admin Center under **Mail flow** → **Accepted domains**.
   ```ini main.cf theme={null}
   relayhost = <GUID>.mail.protection.outlook.com
   ```

<Accordion title="Advanced routing">
  If for any reason you need to route your emails to different M365 regions, configure the following in addition:

  1. For every domain that should be routed separately, add a corresponding entry in the `transport` and `sender_dependent_transport` file.
     ```text transport theme={null}
     xorlab.com          smtp:xorlab-com.mail.protection.outlook.com
     xorlab.net          smtp:xorlab-net.mail.protection.outlook.com
     ```
     ```text sender_dependent_transport theme={null}
     @xorlab.com         xorlab-com.mail.protection.outlook.com
     @xorlab.net         xorlab-net.mail.protection.outlook.com
     ```
     By default, subdomains need to be added separately. Please see [Subdomain matching](/latest/smtp-configuration#subdomain-matching) to change the default.
  2. In `main.cf`, configure the following two lines:
     ```ini main.cf theme={null}
     # Activate recipient transport maps
     transport_maps = lmdb:/etc/postfix/transport
     # Activate sender transport maps
     sender_dependent_relayhost_maps = lmdb:/etc/postfix/sender_dependent_transport
     ```
</Accordion>

When you finish editing the Postfix files, click **Publish**. The routing configuration becomes active within about one minute.

## Next steps

* [Create Entra ID App](/latest/m365-entra-id-app)