Inbound filtering: route MX through PXCMail

Gateway protects outbound mail by default; to also check what comes in (spam, malware, lookalike domains, payment-change language), point your MX records at PXCMail and tell Google or Microsoft to accept mail only from our servers.

Before you start

Access to your DNS host, and the outbound relay already working (see Google Workspace or Microsoft 365).
Google: a super-admin who can edit the inbound gateway setting. Microsoft: an Exchange admin who can create an inbound connector. The exact values are generated in the console.

Steps

Console → Domains & connection → Inbound (MX) → Enable. Copy the MX records (10 mx1.pxcmail.com, 20 mx2.pxcmail.com) and the provider setting shown beneath them.
Google: Admin console → Apps → Google Workspace → Gmail → Spam, phishing and malware → Inbound gateway. Add the PXCMail IP ranges from the console; enable “Reject all mail not from gateway IPs” only after step 5. Microsoft: Exchange admin center → Mail flow → Connectors → Add an inbound connector from Partner organization, restricted to the listed IPs.
Add the two MX records at your DNS host. Keep your provider’s MX at priority 30 for 72 hours, then remove it.
Back in the console, choose inbound actions: quarantine or tag for suspected phishing; banner on impersonation and lookalike domains; link rewriting on or off; payment-change language warning on or off.
Send yourself a message from a personal address and confirm it arrives with PXCMail inbound headers.

Verify

Console → Archive & audit shows inbound messages with a verdict (clean, tagged, quarantined) alongside outbound ones. The quarantine screen lists anything held; the DNS wizard shows both MX records green.

Troubleshooting

Mail arrives twice. Cause: the old MX is still answering and the provider is not yet restricted to our IPs. Fix: finish the inbound gateway or connector step, then remove the old MX after 72 hours.
Some senders get “relay denied”. Cause: the provider restriction was enabled before DNS propagated. Fix: disable it until all MX checks are green.
A legitimate sender is quarantined. Cause: a new vendor domain with no reputation, or a bank sending payment-change language on purpose. Fix: release it and add the sender to the allow list; precision improves with feedback.
Internal mail shows the impersonation banner. Cause: practice software sends “as” a staff member from outside your provider. Fix: allow-list that system, or route it through your provider so it carries your DKIM signature.
Inbound pauses during a PXCMail incident. Cause: an ingress problem after the provider MX was removed. Fix: sending servers retry for hours by design; status is public at /trust/status/.

Example

Harbor Title processes wire instructions daily, so impersonation is its biggest inbound risk. Its IT partner enables Inbound (MX), creates the restricted inbound connector in Exchange, and sets the policy to quarantine suspected phishing, banner anything from a lookalike of harbortitle.com or of its underwriters, and warn on payment-change language. A week later, a message from harb0rtitle.com asking escrow officer Maria to “update the wiring details for Thursday’s closing” lands in quarantine with the reason “lookalike domain + payment-change language”, before anyone acts on it.

FAQ

Do I have to route inbound mail to use Gateway?

No. Outbound enforcement, locked delivery, archive and audit work without it. Inbound filtering is an option on Gateway and is always on with Hosted because the mailbox is already here.

Does this replace Google’s or Microsoft’s own spam filter?

It runs first. Your provider still applies its own filter afterwards, so existing inbox rules and safe-sender lists keep working.

What does link rewriting do?

Links in inbound mail are rewritten so a click is checked at the moment it happens. Detonation of attachments in a sandbox is on the roadmap (ROADMAP), not live.

Can I try it on one group first?

MX is per domain, so it applies to everyone at once. Use tag mode instead of quarantine for the first week; see Phased rollout.

Still stuck? A human answers within 15 minutes on chat, 1 hour by email during business hours (24/7 for outages).