Enhanced filtering for connector and Transport rule

Question

Enhanced filtering for connector and Transport rule

Ihka 21

Hi,

my current mailflow is 3rd party Filter > Exchange 2019 > Exchange Edge > Exchange Online
Exchange Online will always see the IP of my Edge server as the sender and therefore SPF fails everytime. If I now use enhanced filtering for connectors and specify the IP addresses of my 3rd party filter as well as the IP of my Edge server, this should be resolved, because Exchange Online will see the actual sending IP, right?
But I have some transport rules which are based on the IP of my Edge server. These will then stop working? Is there any workaround?

0 comments

Answer accepted by question author

Andy David - MVP 160.3K MVP Volunteer Moderator

Yes, in most cases you will need to disable any rules that depend on the IP of the Edge Server and come up with a different way to filter. What do these rules do now?

https://learn.microsoft.com/en-us/answers/questions/617573/enhanced-filtering-for-connector-and-transport-rul.html

Jannes Riedl 0 Reputation points

2026-07-22T08:43:43.5133333+00:00

Hi Andy, out of curiosity, is this still up to date?

As far as i understand, the information in the screenshot, just says you'll need to disable mail flow rules that set the SCL to -1, but not that transport rules with the ip of your external gateway won't work.

We've got a transport rule that sends mails that have been delivered through direct send to our external gateway to check for spam, etc. The rule looks like this:

If recipient domain is in "x" -> then reroute to "xy" -> except if: sender IP is external gw (A) or org-authAs header is "internal or routedthroughonprem header is "yes"

-> after activating enhanced filtering, i expected the rule to hit every mail sent by our gw IP (A) (as none of the headers is set and the sender ip is now the ip of the original sender)

But the transport rule runs smoothly, without any issues after activating enhanced filtering, what let's me guess, that transport rules still see/use the ip of the last gateway.

Is there any difference for transport rules between Sender IP and Originating IP?

I saw this reddit comment, maybe you got some insights:

Jannes

5 additional answers

Your answer

Jannes Riedl 0 Reputation points

2026-07-22T08:43:43.5133333+00:00

Hi Andy, out of curiosity, is this still up to date?

As far as i understand, the information in the screenshot, just says you'll need to disable mail flow rules that set the SCL to -1, but not that transport rules with the ip of your external gateway won't work.

We've got a transport rule that sends mails that have been delivered through direct send to our external gateway to check for spam, etc. The rule looks like this:

If recipient domain is in "x" -> then reroute to "xy" -> except if: sender IP is external gw (A) or org-authAs header is "internal or routedthroughonprem header is "yes"

-> after activating enhanced filtering, i expected the rule to hit every mail sent by our gw IP (A) (as none of the headers is set and the sender ip is now the ip of the original sender)

But the transport rule runs smoothly, without any issues after activating enhanced filtering, what let's me guess, that transport rules still see/use the ip of the last gateway.

Is there any difference for transport rules between Sender IP and Originating IP?

I saw this reddit comment, maybe you got some insights:

Jannes

Answer 1

Andy David - MVP 160.3K MVP Volunteer Moderator

Ok, seems like it would be easy to adjust these rules then... Instead of applying the disclaimer based on the Edge IP, apply based on the internal IP range or if the message is authenticated...

Same with anti-spam, messages going through the hybrid connector should be considered authenticated since they wont lose their Exchange headers
etc..

Why not create some new rules now based on new criteria and apply to some test messages ( based on recipient or sender) and see how that looks?

0 comments

Answer 2

Ihka 21

Actually, we are in hybrid mode with the majority of mailboxes already . But we have some domains pointed to EOP while the most are still pointing to the 3rd party filter. That is, why we have some of these rules currently.

0 comments

Answer 3

Andy David - MVP 160.3K MVP Volunteer Moderator

Yes, I would be ready to change some or all of those rules if you enable enhanced filtering. It sounds like you are not in hybrid Exchange Mode.

0 comments

Answer 4

Ihka 21

I have rules set up to bypass anti spam based on the edge server IP. There are also other rules like adding an external disclaimer except if mails are originating from internal org. I also have some other rules which will reject emails in certain scenarios except from edge server IPs. So I think I cannot use enhanced filtering in an easy way because I would have to reconfigure all transport rules to match another attribute.

0 comments