0

I've been doing some research on Office 365 reporting and don't seem to be finding a direct answer to my question.

Essentially, we have a domain that's set up with 2 MX records: the primary MX record points to an on-premises Barracuda spam filter, and the secondary MX record points to Office 365 directly.

There are concerns that a malicious attacker could be, and is, sending emails directly to Office 365, bypassing the Barracuda. Or, the Barracuda could be experiencing a DoS (whether directed by attacker, Internet service interruption, etc) that is causing a failover to the secondary MX record for legitimate sending SMTP systems.

I've been tasked to find, in Office 365, any occurrences of emails sent directly to Office 365 that were not redirected from the on-premises Barracuda. Does Office 365 have such a report I could run to gather this information? Will it allow me to filter out the legitimate Barracuda IP address so that I only see eamils coming from the untrusted Internet?

Both GUI and PowerShell tools for this job would be viable options for me.

Thank you in advance.

  • 1
    we have a domain that's set up with 2 MX records: the primary MX record points to an on-premises Barracuda spam filter, and the secondary MX record points to Office 365 directly. - Out of curiosity, why? – joeqwerty Nov 16 '17 at 18:07
  • For failover purposes. In case MX 1 goes down for any reason, mail systems will deliver directly to MX 2 without any manual intervention required. Minimizing downtime is a top priority. We just want to be able to see how often this is happening, that mail systems and/or spammers are delivering to MX 2. – maff1989 Nov 16 '17 at 18:10
1

I ended up using Get-MessageTrace combined with this workaround and some filters to get the information I needed without being limited to 5000 results

| improve this answer | |
  • Using Get-MessageTrace you can retrieve up to 5 million emails max. Get-MessageTrace allows for a single page size of up to 5000 emails for a total pages of 1000 max. – Juan Avila Sep 6 '18 at 12:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.