Hello everyone,
thanks in advance for any hint. I know I need to update (PMG 8.2.12 → 9), but I doubt that is the cause.
Setup
- PMG 8.2.12, MX points to the PMG, relay via transport map to <tenant>.mail.protection.outlook.com:25
- Exchange Online inbound connector (Partner, TLS required, PMG IP set), Enhanced Filtering with the PMG IP in EFSkipIPs
Problem
Exchange Online checks SPF against the PMG IP instead of the real sender: spf=softfail (sender IP is <PMG IP>), CIP:<PMG IP>. The PMG itself shows Received-SPF: pass for the real sender.
What I found
- SenderIPAddresses only takes effect with RestrictDomainsToIPAddresses = $true. With $false, EF never ran (no X-MS-Exchange-SkipListedInternetSender).
- Two restrictive connectors with SenderDomains * reject each other's IP (550 5.7.51 TenantInboundAttribution), so now one restrictive connector contains both gateway IPs.
- RestrictDomainsToCertificate fails, because Postfix sends no client certificate.
Current state
Only about 2 of 10 test mails got X-MS-Exchange-SkipListedInternetSender: ip=[<real IP>] with SPF against the real IP. Real mail from Gmail and others: none so far, still CIP:<PMG IP>.
Received: from pmg.example.com (<PMG IP>) by <edge>.mail.protection.outlook.com ... via Frontend Transport
Received: from pmg.example.com (localhost.localdomain [127.0.0.1]) by pmg.example.com (Proxmox) ...
Received: from mail-xx.google.com ([209.85.x.x]) by pmg.example.com (Proxmox) with ESMTPS ...
Authentication-Results: spf=softfail (sender IP is <PMG IP>) smtp.mailfrom=gmail.com
Questions
1. Does anyone run PMG in front of Exchange Online with Enhanced Filtering working reliably? Which connector settings?
2. Is it normal that EF takes hours and applies per front end?
3. Could anything in the PMG Received chain (local 127.0.0.1 hop) stop Exchange from finding the real sender hop?
Thank you very much in advance!
Best regards
thanks in advance for any hint. I know I need to update (PMG 8.2.12 → 9), but I doubt that is the cause.
Setup
- PMG 8.2.12, MX points to the PMG, relay via transport map to <tenant>.mail.protection.outlook.com:25
- Exchange Online inbound connector (Partner, TLS required, PMG IP set), Enhanced Filtering with the PMG IP in EFSkipIPs
Problem
Exchange Online checks SPF against the PMG IP instead of the real sender: spf=softfail (sender IP is <PMG IP>), CIP:<PMG IP>. The PMG itself shows Received-SPF: pass for the real sender.
What I found
- SenderIPAddresses only takes effect with RestrictDomainsToIPAddresses = $true. With $false, EF never ran (no X-MS-Exchange-SkipListedInternetSender).
- Two restrictive connectors with SenderDomains * reject each other's IP (550 5.7.51 TenantInboundAttribution), so now one restrictive connector contains both gateway IPs.
- RestrictDomainsToCertificate fails, because Postfix sends no client certificate.
Current state
Only about 2 of 10 test mails got X-MS-Exchange-SkipListedInternetSender: ip=[<real IP>] with SPF against the real IP. Real mail from Gmail and others: none so far, still CIP:<PMG IP>.
Received: from pmg.example.com (<PMG IP>) by <edge>.mail.protection.outlook.com ... via Frontend Transport
Received: from pmg.example.com (localhost.localdomain [127.0.0.1]) by pmg.example.com (Proxmox) ...
Received: from mail-xx.google.com ([209.85.x.x]) by pmg.example.com (Proxmox) with ESMTPS ...
Authentication-Results: spf=softfail (sender IP is <PMG IP>) smtp.mailfrom=gmail.com
Questions
1. Does anyone run PMG in front of Exchange Online with Enhanced Filtering working reliably? Which connector settings?
2. Is it normal that EF takes hours and applies per front end?
3. Could anything in the PMG Received chain (local 127.0.0.1 hop) stop Exchange from finding the real sender hop?
Thank you very much in advance!
Best regards