G DATA Mail Protection
Why must a connector and a rule be created in Microsoft Exchange Online?
How attackers bypass cloud-based third-party security solutions
Once a domain has been added to your Microsoft Exchange Online and verified, each tenant is assigned a default domain by Microsoft. Attackers know that the standard MX records for onmicrosoft.com domains typically use "companyname.onmicrosoft.com".
Using the results of MX lookups for "companyname.onmicrosoft.com", attackers can build entire databases identifying whose email is hosted in Microsoft 365 and which of those organizations have configured their MX records to route mail through third-party security software.
With this information, attackers can send emails directly to Microsoft Exchange Online, which Microsoft would accept. This allows such a gateway solution to be bypassed.
Using connectors and rules protects Microsoft Exchange Online against these bypasses and can eliminate the need to change the MX record.
As explained in the section "How attackers bypass cloud-based third-party security solutions", changing the MX record to point to a gateway is not sufficient.
In addition, Microsoft’s simplified DNS setup for Microsoft Exchange Online cannot be used with custom DNS routing. For experienced users who manage their own DNS, making an additional MX record change is straightforward; for less experienced users, it can create complicated extra work. For more information, see our section Point your domain’s MX record to G DATA Mail Protection
The inbound connector
A dedicated inbound connector is required to ensure smooth email delivery. Because Microsoft uses greylisting, which temporarily defers email delivery, and G DATA Mail Protection uses different sending IP addresses, unnecessary delays in receiving email may otherwise occur.
Conclusion
To prevent G DATA Mail Protection from being bypassed and to avoid delivery problems caused by greylisting, you must create the partner connectors (inbound and outbound) and a rule.
Include every domain that G DATA Mail Protection is to monitor. As a result, all externally originating emails for the domains included in the rule are first forwarded to G DATA Mail Protection. Microsoft Exchange Online accepts only emails that have been checked and delivered by G DATA Mail Protection.
If certain conditions are met, changing the MX record is no longer necessary, but you can still do so if desired.