Microsoft 365 / Exchange
Exchange Online, connectors, mail routing, and hybrid scenarios.
MailHeaderAnalyzer: Analyze Email Headers in PowerShell Without Network Access
Reference for the MailHeaderAnalyzer PowerShell module: parameter overview, syntax, description, examples, and parameter properties for Get-MailHeaderAnalysis and ConvertTo-MailHeaderReport, plus the output object with delivery chain, authentication results, Exchange Online classification, and all finding codes.
Mail loop with encryption gateway behind EXO - Prevent spoofing issues
If the encryption gateway (HIN in this example) is behind Exchange Online, every incoming message reaches EOP a second time: with a foreign sender domain, an invalid DKIM signature, and the gateway IP as the source. The result is a spoof verdict and junk. Four settings prevent this without disabling filtering using SCL -1: a PTR record, Enhanced Filtering disabled, a spoof exception for the gateway infrastructure, and CloudServicesMailEnabled on both connectors.
Closing a journaling gap: Exporting from Microsoft Purview and importing into Enterprise Vault
If journal reports from Exchange Online fail for several days, they cannot be generated retroactively. However, the content still exists in the mailboxes. Learn how to export it as PST through the new Purview eDiscovery, why Enterprise Vault's PST Migrator is usually not an option, and how to reimport it through the journal mailbox without displacing the active journal stream, using two generic scripts for importing, moving, and logging.
AuthMechanism 10 and AuthAs Internal: How Exchange Classifies Message Submission in the Header
The X-MS-Exchange-Organization-AuthMechanism header documents how a submitting server authenticated. Value 10 indicates a Receive Connector with Externally Secured and classifies external emails as internal, with consequences for spam filters, mail flow rules, and spoofing protection.
compauth in Microsoft 365: Composite Authentication and All Reason Codes
Microsoft 365 supplements SPF, DKIM, and DMARC with its own evaluation: compauth. What Composite Authentication checks, what pass, softpass, fail, and none mean, and what causes each reason code, from 000 to 905.
Internal or External? Interpreting Exchange Hybrid Mail Headers: AuthAs, MessageDirectionality, and X-originatororg
In Exchange hybrid environments, header classification determines whether an email is treated as internal. Which headers carry the classification, how tenant attribution works through certificates and connectors, and how to identify a misrouted message.
VPN Split Tunneling for Microsoft Teams: Routing Media Traffic Around the Tunnel
Teams calls over a VPN suffer from latency, jitter, and the detour through the VPN gateway. This article explains which Microsoft networks and ports handle media traffic, why IP-based split tunneling is superior to app exclusions, and how to implement it in consumer VPNs, WireGuard, OpenVPN, and enterprise clients.
Analyzing Exchange Mail Flow: Message Tracking, SMTP Logs, and Receive Connectors
How to systematically determine where a message ended up in Exchange On-Premises, Hybrid, and Exchange Online: queries with sample output, how to read the SMTP log correctly, and the issues that regularly lead to incorrect conclusions.
Who Is Actually Delivering to Your Tenant? Aggregating Sending IP Addresses
A single report shows which systems actually deliver mail to your tenant: forgotten connectors, applications sending directly, and service providers nobody documented, including the typical analysis errors involving pagination logic and interpretation.
Common Causes of Mail Loops and How to Fix Them
How to systematically identify and fix SMTP mail loops in Exchange Online, hybrid environments, and upstream mail gateways using NDRs, headers, Message Trace, recipient objects, and connectors.
EXO Migration Without a Remote Move
How to provision on-premises Exchange mailboxes in a controlled manner as new, empty Exchange Online mailboxes: PST backup, CSV approval, RemoteMailbox, synchronization, validation, and rollback.
Ghost Sender in Exchange Online: An MX Record Is Not a Firewall
Direct delivery to Exchange Online bypasses an upstream gateway if the tenant does not explicitly block it. The risk is real; the cause is an incomplete mail flow configuration.
Access Exchange Online with PowerShell: Replace EWS with Microsoft Graph
EWS ends in Exchange Online on October 1, 2026. Learn how to register an app, authenticate a PowerShell script using a certificate, restrict access to individual mailboxes, and process messages and attachments through Microsoft Graph.
