Technology evolves rapidly, and to provide you the best possible service, LibraCyber may propose you the migration of your cloud installation to a more powerful, high-performance, stable and reliable datacenter.
Disclaimer
The migration involves an IP address changing. The sudden IP address changing can cause outbound emails delivery rate-limiting by Microsoft. The rate-limiting is a delay that Microsoft receiving servers apply to the delivery of emails.
Normally the Microsoft receiving server delays delivery by about 5 or 10 minutes for each email, but in some cases it may limit it even more. The goal of this rate-limiting is the email flow security as a sudden IP address changing could be the sign of an email exchange system compromise.
The Microsoft rate-limiting lasts approximately 48 hours depending on the amount of outgoing traffic.
LibraCyber team will instantly manage the disservice if all below steps are completed before the migration. If below steps are not completed, LibraCyber can't help you managing delivery issues.
Updating the SPF record
The SPF record is a TXT DNS record that defines the hosts IP addresses that are allowed to send email on behalf of your domain. Below updates must be performed on SPF records of every domains that sends emails through ESG.
Note: the A record of the appliance (if managed by the customer) MUST NOT be updated without an explicit LibraCyber technician confirmation.
Add the new IP address
Add the new IP address to the SPF record (the current appliance IP address must not be removed).
Note: you can set the mx directive to allow the MX records to delivery emails on behalf of the domain. Example: v=spf1 mx -all
Allow LibraCyber relay to avoid rate-limiting
As said before, when you suddenly switch the sending IP address, sometimes Microsoft causes rate-limiting on the email delivery. To avoid disservices, you must add the include:spf.esvacloud.com directive in your SPF record.
Note: this directive allows LibraCyber team to rapidly switch the email flow on delivery servers having a very good reputation avoiding the rate-limiting.
Dealing with Microsoft 365
If one or more domain in your appliance Relay Configuration page are on a Microsoft 365 tenant, the first operation to perform is to add the new IP address to the existing connectors and rules.
The LibraCyber ESG Microsoft 365 setup involves a connector configuration and a rule creation on the Microsoft 365 tenant. The goal of the connector is to avoid the rate-limiting on the delivery stage for incoming emails, while the rule disables Microsoft antispam scan to already scanned email coming from ESG.
To edit your tenant settings you need to login to your Microsoft 365 Exchange admin center with your tenant admin credentials.
Note: if no connector is set on the tenant, you must create it including the new IP address and the current one.
Connector
First of all you need to move on the Connectors configuration page as shown below.
Edit the ESG incoming connector by selecting it and clicking on the Edit sent email identity as shown in the screenshot below.
Type the new appliance IP address in the field and click on the [+] button and click on Save at the bottom right of the page.
Rules
When the connector is successfully updated with the new IP address, you can update the rule going to the Rules page.
Select the rule having the "Do the following" parameter set to "Set the spam confidence level (SCL) to '-1'". Edit the rule by clicking on the "Edit rule settings" button.
Switch to the Conditions tab and click on the pencil icon in the "Apply this rule if" section.
Type the new IP address in the field and click on the Add blue button. Click on the Save button at the bottom right of the page to confirm the rule update.