Outbound Connector Smart Host Behavior

If you have an on-premises mail environment that you are protecting with Exchange Online Protection (EOP) then you’ll need to create some connectors in the cloud. This article is going to focus on EOP Outbound Connectors and how they deliver mail when configured with a smart host.

Keep in mind that with EOP connectors, the naming convention is EOP centric (from EOPs point of view). When we talk about incoming mail, we are referring to mail that has originated on the Internet and is destined to our on-premises mail servers. This Internet originating message will be directed to EOP first because this is where your MX record is pointing. Once EOP processes the message, it needs an Outbound Connector to deliver the message to your on-premises mail environment. Here’s what we’re looking at.

Because your MX record will be pointed towards EOP, the EOP Outbound Connector (type is on-premises) will need a smart host to be able to deliver mail to your on-premises mail environment. For the smart host, you can enter either an IP or a Fully Qualified Domain Name (FQDN).

Customers that use an FQDN as the smart host typically ask me the following question.

How does the lookup for the FQDN smart host work? Does the EOP Outbound Connector look up the MX record or the A record for the smart host FQDN?

The Outbound Connector respects RFC 5321 section 5 which clearly states the following must happen once the recipient domain is known.

  1. Look up the MX record of the recipient domain.
  2. If no MX is present, lookup the A record and if present, treat this as the MX record.
  3. If an MX record is present, clients MUST NOT use the A record.

Note: In our scenario we are using a smart host and not the recipient domain to determine routing, however this same MX/A logic still applies.

Because the EOP Outbound connector first does an MX lookup on the smart host FQDN, MX priorities are also respected just like you would expect. This in a nutshell is exactly what an EOP Outbound Connector does when it finds an FQDN entered for the smart host.


Configure custom mail flow by using connectors
Create required connectors to set up basic email flow through EOP

Comments (7)

  1. Thanks for the comment Kevin! I’ve added a note to the article to help clarify that.

  2. Hi Jim, you are correct, our on-premises server will need to smart host outbound mail to EOP which will then relay the messages out to the Internet. For this to work you will need to create an EOP Inbound connect of type on-premises. Your on-premises mail
    environment will then need to smart host to the same MX record that Office 365 provided for your domain. Ex. You add contoso.com to your tenant and are given an MX record of contoso-com.mail.protection.outlook.com. This would also be the address that your
    on-premises mail environment would use as a smart host for outbound mail. EOP would then accept the message, run rules, and then deliver to the internet.

  3. Kevin A says:

    Thanks much for documenting this. It is good to know there is a way to weight the on-premises receivers. I would suggest that the explanation around RFC 5321 is a little off, though. When you tell an MTA that it should use a smarthost, you are specifically
    telling it NOT to use MX or A records for the recipient domain you are sending to. Instead, what's happening here is that EOP uses MX/A logic to resolve the smarthost itself, not the recipient domain.
    A nit I am picking, of course.

  4. Anonymous says:

    Organizations with on-premises mail environments often will have a primary site and at least one backup

  5. Jim Paulus says:

    What about mail coming from the On-Premise Server outbound for delivery to the Internet… There is setup info on the connector for EOP to receive mail from your on-premise server… but don't you have to configure your Hub Transport Connector on the Exchange
    Server to send outbound to the OEP Server? Smart Host Info? I can not find info on how to configure my exchange server to rout through the OEP server as the relay…

  6. Anonymous says:

    I only began this blog in June of this year and so it’s hard to believe that it is already six

  7. Hi
    I have question:
    I have hybrid environment, I currently use two dns entries to route outbound(from cloud to onprem) to(two entries on outbound connector).
    is there away to use only one and threat it as if it was 2 mx records with priorities?
    for example my email domain is test.com ,my outbound connector enteries are: datacenter1.of365.com and datacenter2.of365.com
    can I just use: datacenter.of365.com
    with these two entries:
    MX 10 datacenter1.of365.com
    MX 20 datacenter2.of365.com

Skip to main content