Outbound Smarthost

This guide outlines how to enable Outbound Scanning from the customer portal.

This is only available for Mesh Gateway and Mesh Unified customers.

Step 1: Customers page

Navigate to the “Customers” page in the navigation bar.

Step 2: Login as

Select the “Login as” button for the customer you wish to setup.

Step 3: Outbound Smarthost

Once logged in, select the “Settings” page in the nav bar and open the “Outbound Smarthost” tab.

Step 4: Enable Slider

Enable the Outbound Status slider and click save.

Note

Once enabled, it may take up to 15 minutes for the domain to be fully activate. It is recommended to wait this length of time before sending emails outbound to avoid any delivery issues.

Step 5a: O365

If you are using O365, you can move onto setting up your SPF records and Outbound connector.

Step 5b: Exchange/On-premise

If you are using Exchange or another service, please enter the public IP addresses the organisation will send emails from.

Step 6: SPF Records

Update SPF records to include the following depending on your region:

Service Region	SPF Record
Europe	include:spf1.emailsecurity.app
United States	include:spf1.emailsecurity.app

This step is different per domain provider so you will need to consult their documentation if you require additional help.

Mesh does not modify the contents of outbound emails meaning the DKIM signature generated by your mail provider will remain valid. You do not require a DKIM key from Mesh.

If using Microsoft 365, we recommend following this guide:

https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/email-authentication-dkim-configure?view=o365-worldwide

Step 7: Connector Setup

If using O365 or Exchange, please consult our O365/Exchange Outbound setup guide.

Configure Outbound Filtering for Mesh in Office 365/Exchange Admin

If using O365 or Exchange with Exclaimer, please consult our O365/Exchange Outbound setup guide.

Configure Outbound Filtering for Mesh in Office 365/Exchange Admin with Exclaimer

If you are using Google Workspace, please consult our Google Workspace Outbound setup guide.

Create an Outbound Gateway in Google Workspace

Optional Outbound Settings

These are optional settings that you can use depending on your domain’s setup. You may not need to use them but they provide extra flexibility if required.

Outbound Sources

The outbound sources feature allows you to specify a public IP addresses that your organization sends email from. This can be useful if they are using third party tools to send messages.

Note

O365 customers do not need to include O365 IP ranges. This is done automatically.

Note

If using a third party software, connections to the smarthost should use port 25 with no authentication. You can find your region specific smarthost here: https://docs.emailsecurity.app/help-center/connection-details

Sender Relay

The Sender Relay option allows sending domains to be forwarded to a 3rd party destination for further relay. For example, a branding product or encryption service.

Auto Forward

An “Auto Forward” rule allows outbound email that has been sent via an auto forwarding rule on your mail host without the need for a rewrite. This is required because the sending domain will typically not be your own domain. Emails can retain the original envelope address rather than a typical forwarding path which would require an additional user at your domain.

By specifying the destination address, we allow you to make an exception. The reason for using the recipient address rather than the sending address is because it is common for a sending address to be random.

Note

If an email has originated from Microsoft’s high risk delivery pool, traffic will NOT be accepted by our smarthost and a NDR will be generated. More information about Microsoft’s high risk delivery pool can be found here: https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/outbound-spam-high-risk-delivery-pool-about?view=o365-worldwide#relay-pool.

If this is occurring for an autoforward, we recommend creating a mailflow rule to bypass our smarthost.

Tip

You’re all set

Page: Outbound Smarthost
Page: Configure Outbound Filtering for Mesh in Office 365/Exchange Admin

Configure Outbound Filtering for Mesh in Office 365/Exchange Admin

This guide outlines how to create an outbound connector in Microsoft 365 in order to facilitate the routing of outgoing email through Mesh.

We recommend you consult Microsoft’s official documentation to ensure the setup is relevant to your environment.

Using Exclaimer? Please use this guide instead →

Connector Setup

Step 1: Connectors page

Navigate to the “Connectors” page on your Exchange Admin Console.

Step 2: Add a connector

Select “Add a connector”.

Step 3: Specify mail flow

Select “Office 365” under the “Connection From” option. Select “Partner organization” under the “Connection to” option.

Step 4: Connector name

Give the connector a name and optionally a description. Ensure the “Turn it on” box is checked.

Step 5: Use of connector

Select the “Only when I have a transport rule set up that redirects messages to this connector” option.

Step 6: Routing

Select “Route email through these smart hosts”.

Enter the smart host specific to your region.

Step 7: Security restrictions

Select “Always use Transport Layer Security (TLS) to secure the connection” and “Issued by a trusted certificate authority (CA)”.

Step 8: Validate connector

The next step will present a validation screen.

For an outbound connector, the email address should be external to the tenant being configured. If the testing email address is internal, Microsoft 365 will not use the smarthost.

Note

Due to recent changes within Microsoft’s infrastructure, an error “502 5.3.3 Command not implemented” may be generated when attempting to connect to our smarthost. If you receive this error, please skip the validation step, and proceed to manually verify outbound email is routed correctly.

Step 9:Review connector

Review the details you have entered and click save. Your connector list will now be updated to reflect the change.

Transport/Mail Flow Rule Setup

Step 1: Rules page

Navigate to the “Mail Flow” section in your Exchange Admin Center and select “Rules”.

Step 2: Create a new rule

Click “Add a rule” and then “Create a new rule”.

Step 3: Rule conditions

Give the rule a name and apply the following rule conditions.

The sender is external/internal → Inside the organization.
The recipient is external/internal → Outside the organization.
Redirect the message to → the following connector → select the Mesh Outbound connector you created.

Step 4: Exceptions

If you need to add exceptions to emails that should not pass through our smarthost, the “Except If” condition facilitates this.

For example, if configuring an autoforward, please consult our Outbound Smarthost guide to check if this step may be necessary.

Step 5: Set rules settings

Ensure the “Enforce” is selected.

Step 6: Review and Finish

Review the details you have entered are correct.

Tip

You’re all set.

Page: Outbound Smarthost (Mesh Help Center)
- outbound
Page: Configure Outbound Filtering for Mesh in Office 365/Exchange Admin (Mesh Help Center)
- kb-how-to-article
- outbound