Investigate Microsoft 365 Email Bypassing Third-Party MX Records
Question details
Determine why messages from other Microsoft 365 tenants reach mailboxes without passing through the organization's third-party email security platform.
- Product
- Microsoft 365 Exchange Online
- Device & OS
- not provided
- Scenario
- The organization uses MX records to direct incoming email through a third-party security platform before delivery to Microsoft 365.
- Observed behavior
- Some legitimate messages from other Microsoft 365 tenants reach Microsoft 365 mailboxes directly, bypassing the security platform.
Collect the sender and recipient addresses, approximate delivery time, and message ID for an affected message. Have access to the Exchange admin center, your DNS records, and the security platform's message logs.
Trace the message and check the recipient's primary address
Use this approach to establish the delivery path and identify whether an onmicrosoft.com address or a routing configuration is involved.
In the Exchange admin center, open Mail flow > Message trace. Search for the affected sender, recipient, and time range, then review the message events and available routing details.
Search the third-party platform's message logs for the same message ID, sender, and delivery time. A missing log entry can indicate that the message did not pass through the platform.
In the Microsoft 365 admin center, open Users > Active users, select the recipient, and review their username and email aliases. Check whether the primary address uses the initial onmicrosoft.com domain and whether the sender addressed that domain or the custom domain.
In the Exchange admin center, check Mail flow > Accepted domains, Connectors, and Rules for settings that could affect attribution or delivery. Compare the configuration with Microsoft's Message Attribution FAQ and the security provider's routing guidance.
If appropriate, make the verified custom-domain address primary using the user's email address settings, then send a new test message to that address from another tenant. Check both Message trace and the security platform logs again.
Review MX fallback and inbound connector controls
Use this approach if a Microsoft 365 MX record remains as a lower-priority fallback or direct inbound delivery is allowed.
Use WPS Office as an alternative for everyday Office files
WPS Office is a free, lightweight alternative for working with documents, spreadsheets, and presentations in a familiar interface. Its Microsoft Office format support helps you move existing files without a major workflow change. It does not change Microsoft 365 email routing or fix Exchange connector settings.
Frequently Asked Questions
Can Microsoft 365 route mail between tenants without using my MX records?
Direct tenant-to-tenant routing can occur in some circumstances, including scenarios involving the initial onmicrosoft.com domain. Review Microsoft's Message Attribution FAQ and use Exchange message trace to investigate the specific message.
How do I see whether the security gateway processed a message?
Search the gateway's message logs for the message ID, sender, and delivery time, then compare the result with Mail flow > Message trace in the Exchange admin center.
Why might a sender use my higher-numbered Microsoft 365 MX record?
A higher-numbered MX preference can serve as a fallback when preferred, lower-numbered destinations are unavailable. Check your public DNS records and the security provider's configuration guidance.
Will changing the primary email address guarantee that mail goes through the gateway?
No. A custom-domain primary address may be appropriate, but routing also depends on the address used by the sender and the tenant's configuration. Send a new test message and check both Exchange and gateway logs.
