Skip to main content

Mesh Gateway

Organizations on all email platforms can use Mesh Gateway as long as they can accept email on port 25 and can point the MX records to Mesh.

Mesh Gateway for Office 365

Mesh Gateway for Exchange

Mesh Gateway for Google Workspace

Mesh Gateway for all other email platforms

Mesh Gateway for Microsoft 365

This guide outlines how to install Mesh Gateway for organizations on Microsoft 365.

Tip: If this is your first time setting up a customer in Mesh (or even if it’s not), it is worthwhile familiarizing yourself with the following checklist Before You Start Checklist

Tip

Installation Time: 10-15 minutes

  1. Create a Mail Flow for Rule for Mesh in Microsoft 365 

    In order to allow email filtered by Mesh to be delivered safely without any double filtering from Microsoft, you need to create a mail flow rule in Microsoft 365 for our IP ranges.

    This video walks you through the process step by step:

    • Ensure that the IP ranges applicable to your region are used. You can find this here.

    • View our step by step guide on creating a mail flow rule.

    • Visit Microsoft’s documentation on this topic here.

  2. Populating Users via Azure Sync 

    In order to allow users to receive quarantine digests and to be able to create their own allow/block rules, users need to be populated in the users table.

    • Login as Customer and navigate to Users > Import & Sync > Azure Sync.

    • Select O365 Authorize to permit Mesh to sync the users from Azure.

    • View more information on user population and role types.

    Note

    The Azure sync will automatically run every hour. For any mailboxes synced that do not require an account in Mesh, please select and set to disable.

  3. Import Allow & Block Rules (optional) 

    You can import a list of safe senders or domains using our CSV template.

  4. Update Your MX Records 

    Update your MX records with the values applicable to your service region.

    MX records are region specific and there should be no other records present.

    If you use MTA-STS, ensure you also update the MX entries there.

    Note

    Please wait at least 15 minutes after creating your account in Mesh before updating your MX records to ensure there is no interruption to delivery while our system updates.

  5. Create a Connector In Microsoft 365 

    In order to prevent threats from bypassing Mesh filtering and ensuring emails from our MTAs can deliver to your mail environment, you should create a Connector for Mesh in Microsoft 365.

    Note

    • Only complete this step after you point your MX records to Mesh. We recommend waiting 24 hours to allow for DNS propagation.

    • If you are moving from another Secure Email Gateway, you will likely have an existing connector in place to reject emails that aren't sent from a specific IP range.

    • You will need to remove this before changing MX records to prevent clean email filtered by Mesh from being rejected.

    This video walks you through the process step by step:

    • Ensure that the IP ranges applicable to your region are used. You can find this here.

    • View our step by step guide on creating a connector.

  6. Enable Outbound Email Scanning (Optional) 

    Note

    If your tenant uses an autoforward in some capacity, please ensure you read the above guide.

    1054801944.png

  7. Configure Report Junk & Phishing Button (Optional) 

    The Outlook report button can be utilised to share potential false negatives / false positives with your helpdesk and the Mesh detection team. View our step-by-step guide.

    1658159116.png

    Tip

    You’re all set. Your email is now protected by Mesh Gateway.

Mesh Gateway for Exchange

This guide outlines how to install Mesh Gateway for organizations on Exchange.

Tip: If this is your first time setting up a customer in Mesh (or even if it’s not), it is worthwhile familiarizing yourself with this checklist ⟶ Before You Start Checklist

Tip

Installation Time: 10-15 minutes

  1. Create a Mail Flow for Rule for Mesh in Exchange

    In order to allow email filtered by Mesh to be delivered safely without any double filtering from Microsoft, you need to create a mail flow rule in Exchange for our IP ranges.

    This video walks you through the process step by step:

    • Ensure that the IP ranges applicable to your region are used. You can find more information on this here.

    • View our step by step guide on creating a mail flow rule.

    • Visit Microsoft’s documentation on this here.

  2. Populating Users via CSV Import

    In order to allow users to receive quarantine digests and to be able to create their own allow/block rules, users need to be populated in the users table.

  3. Import Allow & Block Rules (optional)

    You can import a list of safe senders or domains using our CSV template.

  4. Update Your MX Records

    Update your MX records with the values applicable to your service region.

    MX records are region specific and there should be no other records present.

    If you use MTA-STS, ensure you also update the MX entries there.

    Note

    Please wait at least 15 minutes after creating your account in Mesh before updating your MX records to ensure there is no interruption to delivery while our system updates.

  5. Create A Connector in Exchange

    In order to prevent threats from bypassing Mesh filtering and ensuring emails from our MTAs can deliver to your mail environment, you should create a Connector for Mesh in Exchange.

    Note

    • Only complete this step after you point your MX records to Mesh. We recommend waiting 24 hours to allow for DNS propagation.

    • If you are moving from another Secure Email Gateway, you will likely have an existing connector in place to reject emails that aren't sent from a specific IP range.

    • You will need to remove this before changing MX records to prevent clean email filtered by Mesh from being rejected.

    This video walks you through the process step by step:

    • Ensure that the IP ranges applicable to your region are used. You can find this here.

    • View our step by step guide on creating a connector.

  6. Enable Outbound Email Scanning (Optional)

    Note

    If your tenant uses an autoforward in some capacity, please ensure you read the above guide.

    1054801944.png

  7. Configure Report Junk & Phishing Button (Optional)

    The Outlook report button can be utilised to share potential false negatives / false positives with your helpdesk and the Mesh detection team. View our step-by-step guide.

    1658159116.png

    Tip

    You’re all set. Your email is now protected by Mesh Gateway.

Mesh Gateway for Google Workspace

This guide outlines how to install Mesh Gateway for organizations on Google Workspace.

Tip: If this is your first time setting up a customer in Mesh (or even if it’s not), it is worthwhile familiarizing yourself with this checklist ⟶ Before You Start Checklist

Tip

Installation Time: 10-15 minutes

Configure internal emails to remain within the tenant in Google Workspace

  1. Create an Inbound Gateway for Mesh in Google Workspace

    In order to allow email filtered by Mesh to be delivered safely without any double filtering from Google, you need to create a mail flow rule for our IP ranges.

    View our step by step guide on creating an inbound gateway.

    Note

    If you are moving from another Secure Email Gateway, you will likely have an existing connector in place to reject emails that aren't sent from a specific IP range.

    You will need to remove this before changing MX records to prevent clean email filtered by Mesh from being rejected.

  2. Configure internal emails to remain within the tenant in Google Workspace

    Unlike Microsoft 365, where internally sent emails are not seen by Mesh Gateway, Google routes internal email through the MX record. This means the emails are subject to filtering by Mesh Gateway and its impersonation detection, which will result in false positives. This can be avoided by configuring internal emails to remain within the Google Workspace tenant.

    View our Routing Internal Emails in Google Workspace guide.

  3. Populate users

    In order to allow users to receive quarantine digests and to be able to create their own allow/block rules, users need to be populated in the users table.

    Users can be populated manually or via our CSV import.

    View more information on user population and role types.

  4. Import Allow & Block Rules (Optional)

    You can import a list of safe senders or domains using our CSV template.

  5. Update your MX records

    Update your MX records with the values applicable to your service region.

    MX records are region specific and there should be no other records present.

    If you use MTA-STS, ensure you also update the MX entries there.

    Note

    Please wait at least 15 minutes after creating your account in Mesh before updating your MX records to ensure there is no interruption to delivery while our system updates.

  6. Reject all mail not from gateway IPs

    We recommend locking down your mail environment to only accept emails from Google and Mesh. To do this check the box Reject all mail not from gateway IPs within the Inbound Gateway section. You can find more info on this here.

    Note

    Please wait 24 hours before completing this step to allow for DNS propagation.

  7. Enable Outbound Email Scanning (Optional)

    View our step-by-step guide on enabling our outbound email scanning.

    1054801944.png

    Tip

    You’re all set. Your email is now protected by Mesh Gateway.

Create an Inbound Gateway for Mesh in Google Workspace

To ensure email filtered by Mesh is delivered safely without any double filtering from Google, you need to create an inbound gateway for Mesh in Google Workspace.

We recommend consulting Google’s official documentation.

Note

  • Complete this procedure only after pointing your MX records to Mesh. We recommend waiting 24 hours to allow for DNS propagation.

  • If you are moving from another Secure Email Gateway, you may have an existing connector that rejects emails not sent from a specific IP range.

  • Remove the existing connector before changing your MX records to prevent clean email filtered by Mesh from being rejected.

  1. Navigate to Google Admin

    Go to Google Admin > Gmail > Spam, Phishing and Malware.

    Alternatively, open the Spam, Phishing and Malware settings directly.

    869105767.png

  2. Edit the inbound gateway

    Select Edit in the Inbound gateway section.

    869105775.png

  3. Add the gateway IP addresses

    Add the following two sets of IP addresses:

    1. Add the Mesh delivery IP ranges specific to your region.

    2. Add Google’s sending IP ranges.

    List of Google IPs
Extracted from _spf.google.com
(Google may change these without notice. We recommend verifying the current ranges.)
66.249.80.0/20
72.14.192.0/18
74.125.0.0/16
108.177.8.0/21
173.194.0.0/16
209.85.128.0/17
216.58.192.0/19
216.239.32.0/19
2001:4860:4000::/36
2404:6800:4000::/36
2607:f8b0:4000::/36
2800:3f0:4000::/36
2a00:1450:4000::/36
2c0f:fb50:4000::/36
172.217.0.0/19
172.217.32.0/20
172.217.128.0/19
172.217.160.0/20
172.217.192.0/19
172.253.56.0/21
172.253.112.0/20
108.177.96.0/19

  4. Select the required options

    Select the following checkboxes:

    • Automatically detect external IP (recommended).

    • Require TLS for connections from the email gateways listed above.

    Note

    Leave Reject all mail not from gateway IPs unchecked for now. You will enable this option at the end of the setup process.

    When enabling Reject all mail not from gateway IPs, include Google’s sending IP ranges to prevent Google from rejecting emails sent from its own servers.

    If you leave Reject all mail not from gateway IPs unchecked, senders may bypass the Mesh or Google gateway.

  5. Create a regular expression

    Select Message is considered spam if the following header regexp matches.

    • Enter a random string in the Regexp field.

    • The value does not matter, provided that it does not appear in email headers.

  6. Disable spam evaluation

    Select Disable Gmail spam evaluation on mail from this gateway; only use header value.

    The configuration should now look as follows:

    image-20250310-133744.png

  7. Continue the Mesh Gateway setup

    Continue the Mesh Gateway setup by configuring internal emails to remain within Google Workspace.

    Follow the Routing Internal Emails in Google Workspace guide.

    Tip

    You’re all set.

Route internal email in Google Workspace

Note

If you do not complete this configuration, internally sent email is likely to be quarantined as impersonation by Mesh. Internal email should remain within the Google tenant and must not pass through Mesh Gateway.

Create a mail route

  1. Go to the Google Admin console.

  2. Go to Apps > Google Workspace > Gmail.

  3. Scroll to Hosts, and then select Add route.

  4. Enter a name for the route, such as Internal Emails Route.

  5. Under Specify email server, select Single host, enter aspmx.l.google.com, and use port 25. Alternatively, you can use smtp.google.com. For more information, see Google SMTP relay service.

  6. Important: Clear Perform MX lookup.

  7. Enable the following options:

    • Require mail to be transmitted via a secure (TLS) connection.

    • Require CA-signed certificate.

    • Validate certificate hostname.

  8. Select Save.

Apply a routing rule

  1. Go to Apps > Google Workspace > Gmail.

  2. Scroll to the Routing section.

  3. Select Configure or Add another rule.

  4. Enter a name for the rule, such as Internal Emails Route Rule.

  5. Select Internal - Sending.

  6. In section 2, select Modify message. Enable Change route, and then select the host configured earlier.

  7. Scroll to the bottom, and then select Show options.

  8. Enable the following options:

    • Users.

    • Groups.

  9. Under section C, select Only affect specific envelope senders. Select Pattern match, and then enter the customer domain in the Regexp field, for example, example.com.

  10. Select Save.

Disable SPF and DKIM checks

SPF and DKIM checks are performed by Mesh. Revalidating email after it passes through the service can cause Gmail to incorrectly mark it as spam.

  1. Go to Apps > Google Workspace > Gmail.

  2. Open the Safety section.

  3. Select Spoofing and authentication.

  4. Clear Protect against any unauthenticated emails and Apply future recommended settings automatically.

  5. Select Save.

Continue the Mesh Gateway setup

Return to the setup guide to complete the remaining steps:

Mesh Gateway for Google Workspace 

Tip

You’re all set.

Mesh Gateway for all other email platforms

This guide outlines how to install Mesh Gateway for organizations NOT using Microsoft 365, Exchange, or Google Workspace.

Tip

If this is your first time setting up a customer in Mesh(or even if it’s not), it is worthwhile familiarizing yourself with the Before You Start Checklist.

Tip

Installation Time: 10-15 minutes

  1. Create an Allow Rule for Mesh

    In order to allow email filtered by Mesh to be delivered safely you need to create an allow rule for Mesh on your mail server. Please use the IP range for your specific region.

    Note

    If you are moving from another Secure Email Gateway, you will likely have an existing connector in place to reject emails that aren't sent from a specific IP range.

    You will need to remove this before changing MX records to prevent clean email filtered by Mesh from being rejected.

  2. Populating Users via CSV Import

    In order to allow users to receive quarantine digests and to be able to create their own allow/block rules, users need to be populated in the users table.

  3. Import Allow & Block Rules (Optional)

    You can import a list of safe senders or domains using our CSV template.

  4. Update your MX records

    Update your MX records with the values applicable to your service region.

    MX records are region specific and there should be no other records present.

    If you use MTA-STS, ensure you also update the MX entries there.

    Note

    Please wait at least 15 minutes after creating your account in Mesh before updating your MX records to ensure there is no interruption to delivery while our system updates.

  5. Lockdown Your Server to Only Accept Email Filtered by Mesh 

    In order to prevent threats from bypassing Mesh filtering and ensuring emails from our MTAs can deliver to your mail server, you should configure it to reject email not from Mesh’s IP range.

    Note

    We recommend waiting 24 hours before completing this step to allow for DNS propagation.

  6. Enable Outbound Email Scanning (Optional)

    View our step-by-step guide on enabling our outbound email scanning.

    Note

    If your tenant uses an autoforward in some capacity, please ensure you read the above guide.

    1054801944.png

    Tip

    You’re all set. Your email is now protected by Mesh Gateway.

In this section: