When MPmail filters inbound mail for a tenant, MX records point to the MPmail gateway rather than to Microsoft. An inbound connector in Exchange Online tells Microsoft 365 that mail arriving from MPmail is trusted, and, when the domain restriction is enabled, causes Exchange Online to reject mail that tries to reach the tenant without passing through the filter first.

This article covers creating that connector manually. 

MPmail sending IP ranges

Procedure - Exchange Admin Centre

1. Sign in to the Exchange admin Centre at https://admin.exchange.microsoft.com.
2. Go to Mail flow > Connectors, then select Add a connector.
3. Under Connection from, choose Partner organization. Connection to stays as Office 365. Select Next.
    
4. Give the connector a name that makes its purpose obvious to the next administrator, for example:
   MPmail Inbound Connector. Leave Turn it on ticked. Select Next.
   
   
   
5. On Authenticating sent email, select "by verifying that the sender domain matches one of the following domains". Enter and an asterix '*' and select the plus button. This will mean any domain.
   
   
   
6. On Security restrictions:

• Reject email messages if they aren’t sent over TLS  recommended. MPmail supports TLS on delivery.
• Reject email messages if they aren’t sent from within this IP address range, this is the setting that actually enforces the bypass block. 
  
  Copy and paste the following IP addresses (needs to be done one at a time)
  
  

  83.246.65.0/24       94.100.128.0/24      94.100.129.0/24
  94.100.130.0/24      94.100.131.0/24      94.100.132.0/24
  94.100.133.0/24      94.100.134.0/24      94.100.135.0/24
  94.100.136.0/24      94.100.137.0/24      94.100.138.0/24
  94.100.139.0/24      94.100.140.0/24      94.100.141.0/24
  94.100.142.0/24      94.100.143.0/24      173.45.18.0/24
  185.140.204.0/24    185.140.205.0/24    185.140.206.0/24
  185.140.207.0/24    52.62.114.130          52.62.125.178

  
  
  
  
  

  
  
  

Review the summary and select Create connector, then Done.

Procedure - Exchange Online PowerShell

The equivalent connector can be created in one command via Powershell Exchange Online. 

Connect-ExchangeOnline

$SenderIPs = @(
    '83.246.65.0/24'
    '94.100.128.0/24','94.100.129.0/24','94.100.130.0/24','94.100.131.0/24'
    '94.100.132.0/24','94.100.133.0/24','94.100.134.0/24','94.100.135.0/24'
    '94.100.136.0/24','94.100.137.0/24','94.100.138.0/24','94.100.139.0/24'
    '94.100.140.0/24','94.100.141.0/24','94.100.142.0/24','94.100.143.0/24'
    '173.45.18.0/24'
    '185.140.204.0/24','185.140.205.0/24','185.140.206.0/24','185.140.207.0/24'
    '52.62.114.130'
    '52.62.125.178'
)

New-InboundConnector `
    -Name "MPmail Inbound Connector" `
    -ConnectorType Partner `
    -SenderDomains * `
    -SenderIPAddresses $SenderIPs `
    -RestrictDomainsToIPAddresses $true `
    -RequireTls $true `
    -Enabled $true

To review an existing connector:

Get-InboundConnector | Format-List Name,Enabled,ConnectorType,SenderDomains,

   SenderIPAddresses,RestrictDomainsToIPAddresses,RequireTls,EFSkipLastIP

Troubleshooting