Background
Microsoft Exchange Online is a widely used email infrastructure employed by a large number of companies and tenants. Because Exchange Online is a shared infrastructure, outgoing emails from different tenants are delivered via the same IP ranges and servers. In certain scenarios, emails from Microsoft Exchange Online could not be additionally assigned to a specific Microsoft 365 tenant. Processing was based on the existing trust relationship with Exchange Online.
What has been improved?
With this update, we are enhancing NoSpamProxy’s protection against spam and phishing emails routed through Exchange Online.
Through improved verification of the incoming email server, we ensure that NoSpamProxy processes only emails from the specifically assigned Microsoft 365 tenant. Emails that are delivered via Exchange Online but belong to a third-party or unconfigured tenant will be rejected in the future and will not be processed further.
Technical Background
Exchange Online adds an `X-OriginatorOrg` header to outgoing emails, which identifies the message’s origin at the tenant level. NoSpamProxy now actively evaluates this header and compares it with the configured Microsoft 365 tenants. If the header does not match a known tenant, the email is rejected with the message “unable to relay.”
Impact on Existing Configurations
The behavior described can, in principle, affect all environments where the Microsoft 365 Connector is in use, regardless of whether the configuration was previously considered correct and complete. We therefore strongly recommend that all customers using the Microsoft 365 Connector install the update as soon as possible.
Affected Versions
All NoSpamProxy Server versions < 16.1.0.4923, except for 15.7.0.4925, are affected. For customers of NoSpamProxy Cloud there is no need for action since the update has already been rolled out across the service.
Download the new version now!
You can always find the latest versions of NoSpamProxy Server on our download page. Update now and enjoy the highest level of email security and the latest features.
