How to Keep MX Records Pointed to a Third-Party Filter During Exchange Hybrid Migration
Question details
The user needs to know if MX records must point directly to Microsoft 365 during an Exchange hybrid migration or if they can remain configured to route through a third-party filtering service.
- Product
- Microsoft Exchange Server, Microsoft 365
- Device & OS
- not provided
- Scenario
- Migrating from an on-premises Exchange 2013 server to Microsoft 365 using a hybrid configuration.
- Observed behavior
- Microsoft 365 prompts the administrator to change the MX records to point directly to Microsoft 365, which conflicts with their existing third-party email security setup.
Verify that you have administrative access to your DNS provider, the Microsoft 365 admin center, your third-party filtering service dashboard, and your on-premises Exchange servers.
Configure Connectors for Third-Party Filtering Services
Use this configuration to retain your third-party spam and security filtering while ensuring seamless mail delivery between your on-premises Exchange and Microsoft 365.
In a hybrid configuration, pointing the MX record directly to Microsoft 365 is only a recommended practice, not a strict requirement. You can retain your existing third-party filtering service as the MX destination, provided that inbound and outbound connectors are configured correctly to handle the mail flow.
Leave your domain's DNS MX records unchanged so that they continue pointing to your third-party email filtering service (e.g., Proofpoint, Mimecast, or Barracuda).
Navigate to the Exchange Admin Center and create inbound connectors that explicitly accept mail delivered from your third-party filtering service's IP addresses to both your on-premises Exchange and Microsoft 365 environments.
Configure outbound connectors to ensure that all external mail sent from users on Microsoft 365 and on-premises Exchange routes back through your third-party filtering service.
Once your connectors are successfully tested, you can safely ignore or dismiss the automated setup notification in Microsoft 365 that warns you about the MX record not pointing to Exchange Online.
Empower Your Users with WPS Office After Migration
While you handle complex Exchange server migrations and backend routing, your team needs a reliable, lightweight application for their daily document tasks. WPS Office offers a completely free, highly compatible alternative to Microsoft Office that ensures your users experience zero downtime.
- 1. Download the Installer: Visit the official WPS Office website and click the free download button for your operating system.
- 2. Install the Suite: Run the downloaded executable file and follow the straightforward on-screen instructions to install the software.
- 3. Open Existing Documents: Launch WPS Office and instantly open your existing .docx, .xlsx, or .pptx files with perfect formatting preservation.
Frequently Asked Questions
Will ignoring the Microsoft 365 MX record warning cause email delivery failures?
No, the warning in the Microsoft 365 admin center is just a standard recommendation. As long as your third-party filtering service is properly configured to route emails to your Exchange and Microsoft 365 environments via designated connectors, your email delivery will function normally.
Can I switch my MX record directly to Microsoft 365 later?
Yes. If you decide to deprecate your third-party email filter, you can update your DNS MX record to point directly to Microsoft 365 at any time. Before doing so, ensure that your spam filtering policies are fully migrated to Exchange Online Protection (EOP).
How do I test my mail flow after configuring the third-party filter connectors?
You can utilize the Microsoft Remote Connectivity Analyzer to run inbound and outbound SMTP tests. Additionally, you should manually send test emails from an external address to your domain, and from your domain to an external address to verify proper routing.
Do I need separate connectors for my on-premises Exchange and Microsoft 365?
Yes, in an Exchange hybrid setup utilizing a third-party filter, you must ensure connectors properly govern mail routing between your on-premises environment, Microsoft 365, and your external filter to prevent mail loops and authentication failures.
