Exchange Online Protection servers send SMTP emails using a TLS connection usually to the hybrid or Edge Transport server to enable mail flow between cloud and on-prem users. Microsoft does not support any sort of SMTP gateway or appliance between EOP and the Edge or hybrid server. For this reason, customers normally have to open TCP port 25 on the firewall to the hybrid server from the Exchange Online Protection servers.
Companies can secure this SMTP traffic by configuring the perimeter firewall to allow inbound TCP 25 traffic only from Exchange Online Protection servers to the hybrid or Edge servers.
I've seen a number of articles that list the public IP addresses used by EOP to send SMTP emails to on-prem customers, but the one true list is maintained in the article, Exchange Online Protection IP Addresses. Currently, this article lists seven IPv4 blocks and one IPv6 block for SMTP delivery to on-prem:
- 65.55.88.0/24
- 207.46.51.64/26
- 207.46.163.0/24
- 213.199.154.0/24
- 213.199.180.128/26
- 216.32.180.0/24
- 216.32.181.0/24
- 2a01:111:f400:7c00::/54
Microsoft tries hard to not make changes to this list, but if they do they will update the article. It's important for firewall admins to know that EOP does not use URLs for root domain routing (also known as Top-Level Domains, or TLDs). You must use the IP addresses listed in the article above.
Up until April 2014, Microsoft used many other IP addresses to send emails from Office 365 tenants to on-prem customers. This is because they maintain another set of IP addresses for something called the High Risk Delivery Pool, which is used to protect the production Exchange Online namespace from "spammy" senders. EOP no longer uses the High-Risk Delivery Pool when sending emails between the customer's tenant and their on-prem servers.
It's nice to know that we now have a single source to point to when configuring firewalls for Office 365.Up until April 2014, Microsoft used many other IP addresses to send emails from Office 365 tenants to on-prem customers. This is because they maintain another set of IP addresses for something called the High Risk Delivery Pool, which is used to protect the production Exchange Online namespace from "spammy" senders. EOP no longer uses the High-Risk Delivery Pool when sending emails between the customer's tenant and their on-prem servers.
No comments:
Post a Comment
Thank you for your comment! It is my hope that you find the information here useful. Let others know if this post helped you out, or if you have a comment or further information.