Connect Microsoft 365

Microsoft 365 hands your outbound mail to PXCMail through an outbound connector in Exchange Online plus one mail flow rule that sends external mail to it; internal mail never leaves Microsoft, and directory sync from Microsoft Entra keeps your seats in step with your users.

Before you start

Exchange admin center access (Exchange admin or global admin).
DNS records added: the SPF include and DKIM CNAMEs from DNS setup, so mail relayed through PXCMail still passes SPF and carries your DKIM signature.
Your tenant ID, shown on Console → Domains & connection → Microsoft 365. PXCMail recognizes your tenant by the Microsoft certificate, Exchange Online IP ranges and that ID; there is no password to store.
An external test address; connector validation requires one.

Steps

Exchange admin center → Mail flow → Connectors → Add a connector. Connection from: Office 365. Connection to: Partner organization. Name it PXCMail Gateway.
Use of connector: “Only when I have a transport rule set up that redirects messages to this connector”.
Routing: route email through the smart host smtp-out.pxcmail.com. Security restrictions: always use TLS, and connect only if the recipient’s server certificate is issued by a trusted certificate authority.
Validate with your external test address, then save.
Mail flow → Rules → Add a rule. Apply if: the sender is inside the organization and the recipient is outside the organization. Do the following: redirect the message to the connector PXCMail Gateway. For a phased rollout, add a condition that the sender is a member of a pilot group.
Back in the console, turn on Directory sync and grant admin consent for read access to users and groups. Users appear within minutes; removals are disabled within 15 minutes.
Press Send test in the console. It sends through your tenant to a seed mailbox and shows each hop.

Verify

Console → Domains & connection shows “Relay: receiving from Microsoft 365” with a last-message time. The test message appears in Console → Archive & audit with TLS ✓ and your DKIM selector. A message trace in Exchange shows the connector as the last hop.

Troubleshooting

Connector validation fails. Cause: the test recipient is inside your tenant. Fix: use an external address.
The rule is not applying. Cause: rules take up to 30 minutes to propagate, or an earlier rule stops processing. Fix: wait, then check rule priority and “stop processing more rules” on rules above it.
Recipients see “via” or mail lands in spam. Cause: DKIM CNAMEs not live yet. Fix: wait for DNS and recheck the selector in the console; the wizard re-checks every five minutes.
Some users bypass PXCMail. Cause: the rule is scoped to a pilot group. Fix: widen the condition when the pilot is done; see Phased rollout.
Hybrid Exchange on-premises. Cause: on-premises servers send directly. Fix: route on-premises mail through Exchange Online first, or ask support for a direct connector.

Example

Harbor Title’s IT partner creates the connector and rule on a Tuesday evening, scoped to a pilot group of the three escrow officers. Maria sends a closing package with wire instructions to a buyer; the audit trail shows it as locked delivery, rule “wire instructions → encrypt”. Qualia, which sends through the firm’s Microsoft 365 addresses, inherits the same rule with no configuration. After a week with no false holds, the group condition is removed and all 14 users are covered.

FAQ

Does this change how Outlook or phones work?

No. Staff keep Outlook, the Outlook app and their Microsoft mailboxes. Only the path external mail takes after they press send changes.

What happens if PXCMail is unreachable?

Exchange Online queues and retries; nothing is lost. Status is public at /trust/status/.

Can we filter inbound mail too?

Yes, with an inbound connector and MX change; see Inbound filtering.

Is there an Outlook add-in?

Not yet; add-ins are on the roadmap (ROADMAP). Policy runs on the server, so nothing is installed in Outlook.

Still stuck? A human answers within 15 minutes on chat, 1 hour by email during business hours (24/7 for outages).