Skip to content

Commit 368338d

Browse files
Maddy-CloudflareMaddy-Cloudflare
committed
Adding prereq steps and egress ips
1 parent 17503b8 commit 368338d

File tree

6 files changed

+218
-3
lines changed

6 files changed

+218
-3
lines changed

‎src/content/docs/cloudflare-one/email-security/setup/pre-delivery-deployment/egress-ips.mdx‎

Lines changed: 103 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,103 @@
1+
---
2+
title: Egress IPs
3+
pcx_content_type: reference
4+
sidebar:
5+
order: 4
6+
---
7+
8+
When you set up Email Security using an [inline deployment](/cloudflare-one/email-security/setup/pre-delivery-deployment/inline-deployment/), you need to tell your existing email providers to accept messages coming from Email Security's egress IP addresses.
9+
10+
Refer to this page for reference on what IP subnet mask ranges to use.
11+
12+
:::caution[Additional information for O365]
13+
14+
Office 365 does not support IPv6 addresses nor the following IPv4 subnet mask ranges:
15+
16+
* `104.30.32.0/19`
17+
* `134.195.26.0/23`
18+
19+
If you use Office 365, you will have to use the broken down `/24` subnet mask IP addresses. Refer to [Office 365 `/24` addresses](#office-365-24-addresses) for a list of supported IPv4 addresses.
20+
21+
22+
:::
23+
24+
## United States
25+
26+
For customers in the United States, enter the following IP addresses:
27+
28+
### IPv4
29+
30+
```txt
31+
52.11.209.211
32+
52.89.255.11
33+
52.0.67.109
34+
54.173.50.115
35+
104.30.32.0/19
36+
158.51.64.0/26
37+
158.51.65.0/26
38+
134.195.26.0/23
39+
```
40+
41+
### IPv6
42+
43+
```txt
44+
2405:8100:c400::/38
45+
```
46+
47+
## Europe
48+
49+
For customers in Europe, add all our US IP addresses. Additionally, you need to add the following IP addresses for our European data centers:
50+
51+
```txt
52+
52.58.35.43
53+
35.157.195.63
54+
```
55+
56+
## India
57+
58+
For customers in India, add all our US IP addresses.
59+
60+
## Australia / New Zealand
61+
62+
For customers in Australia and New Zealand, add all our US IP addresses.
63+
64+
## Office 365 `/24` addresses
65+
66+
Use these IPv4 addresses for Office 365, instead of the `/19` and `/23` subnets:
67+
68+
```txt
69+
104.30.32.0/24
70+
104.30.33.0/24
71+
104.30.34.0/24
72+
104.30.35.0/24
73+
104.30.36.0/24
74+
104.30.37.0/24
75+
104.30.38.0/24
76+
104.30.39.0/24
77+
104.30.40.0/24
78+
104.30.41.0/24
79+
104.30.42.0/24
80+
104.30.43.0/24
81+
104.30.44.0/24
82+
104.30.45.0/24
83+
104.30.46.0/24
84+
104.30.47.0/24
85+
104.30.48.0/24
86+
104.30.49.0/24
87+
104.30.50.0/24
88+
104.30.51.0/24
89+
104.30.52.0/24
90+
104.30.53.0/24
91+
104.30.54.0/24
92+
104.30.55.0/24
93+
104.30.56.0/24
94+
104.30.57.0/24
95+
104.30.58.0/24
96+
104.30.59.0/24
97+
104.30.60.0/24
98+
104.30.61.0/24
99+
104.30.62.0/24
100+
104.30.63.0/24
101+
134.195.26.0/24
102+
134.195.27.0/24
103+
```

‎src/content/docs/cloudflare-one/email-security/setup/pre-delivery-deployment/inline-deployment-setup.mdx‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
title: Set up inline deployment
33
pcx_content_type: concept
44
sidebar:
5-
order: 2
5+
order: 3
66
---
77

88
To set up MX Inline:
@@ -29,7 +29,7 @@ If you have verified zones on Cloudflare, continue with the following steps:
2929
3. (**Optional**, select **Skip for now** to skip this step) **Configure quarantine policy**: Select dispositions to automatically prevent certain types incoming messages from reaching a recipient's inbox. Select
3030
4. (Optional ) **Update MX records**:
3131
- Email Security can automatically update MX records for domains that proxy traffic through Cloudflare. Under your mail processing location, select your mail processing location.
32-
- You can also choose to allow Cloudflare to update MX records by selecting **I confirm that I allow Cloudflare to update to thew new MX records**.
32+
- You can also choose to allow Cloudflare to update MX records by selecting **I confirm that I allow Cloudflare to update to the new MX records**.
3333
- Select **Continue**.
3434
5. **Review details**: Review your domain, then select **Go to domains**.
3535

‎src/content/docs/cloudflare-one/email-security/setup/pre-delivery-deployment/inline-deployment.mdx‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
title: Inline deployment
33
pcx_content_type: concept
44
sidebar:
5-
order: 1
5+
order: 2
66
---
77

88
With pre-delivery deployment, also known as Inline deployment, Email Security evaluates email messages before they reach a user's inbox.

‎src/content/docs/cloudflare-one/email-security/setup/pre-delivery-deployment/prerequisites/google-prerequisites.mdx‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
---
2+
title: Google Workspace as MX Record
3+
pcx_content_type: concept
4+
sidebar:
5+
order: 4
6+
---
7+
8+
In this tutorial, you will learn how to configure Google Workspace with Email Security as MX record.
9+
10+
## Requirements
11+
12+
- Provisioned Email Security account.
13+
- Access to the Google administrator console ([Google administrator console](https://admin.google.com/) > **Apps** > **Google Workspace** > **Gmail**).
14+
- Access to the domain nameserver hosting the MX records for the domains that will be processed by Email Security.
15+
16+
## Set up Inbound Email Configuration
17+
18+
On the [Google administrative console](https://admin.google.com/), set up [Inbound Email Configuration](https://support.google.com/a/answer/60730?hl=en) with the following details:
19+
- In **Gateway IPs**, select the **Add** link, and add the IPs mentioned in [Egress IPs](cloudflare-one/email-security/setup/pre-delivery-deployment/egress-ips/).
20+
- Select **Automatically detect external IP (recommended)**.
21+
- Select **Require TLS for connections from the email gateways listed above**.
22+
23+
## Set up an email quarantine
24+
25+
[Set up an email quarantine](https://support.google.com/a/answer/6104172?hl=en#:~:text=Sign%20in%20with%20an%20administrator,t%20access%20the%20Admin%20console.&text=Manage%20quarantines.,Click%20Add%20Quarantine.):
26+
- In the quarantine configuration pop-up, enter the following details:
27+
1. **Name**: Email Security Malicious.
28+
2. **Description**: Email Security Malicious.
29+
3. For the **Inbound denial consequence**, select **Drop message**.
30+
4. For the **Outbound denial consequence**, select **Drop message**.
31+
32+
## Create a content compliance filter
33+
34+
Create a [content compliance filter](https://support.google.com/a/answer/1346934?hl=en#zippy=%2Cstep-go-to-gmail-compliance-settings-in-the-google-admin-console%2Cstep-enter-email-messages-to-affect) to send malicious messages to quarantine:
35+
- **Name**: `Quarantine Email Security Malicious`.
36+
- **In 1**: Email message to affect, select **Inbound**.
37+
- **In 2**: **Add expressions that describe the content you want to search for in each message**:
38+
- Select **Add** to add the condition.
39+
- In **Simple content match**, select **Advanced content match**.
40+
- In **Location**, select **Full headers**.
41+
- In **Match type**, select **Contains text**.
42+
- In **Content**, enter `X-EmailSecurity-Disposition: MALICIOUS`.
43+
- Select **SAVE** to save the condition.
44+
- In 3. **If the above expression match, do the following**, select **Quarantine message** and the **Email Security Malicious quarantine** that was created in the previous step.
45+
- Select **SAVE**.
46+
47+
If you would like to quarantine the other dispositions, repeat the above steps and use the following strings for the other dispositions:
48+
49+
- `X-EmailSecurity-Disposition: MALICIOUS`
50+
- `X-EmailSecurity-Disposition: SUSPICIOUS`
51+
- `X-EmailSecurity-Disposition: SPOOF`
52+
- `X-EmailSecurity-Disposition: UCE`
53+
54+
If desired, you can create a separate quarantine for each of the dispositions.
55+
56+
Now that you have completed the prerequisite steps, you can set up [MX/Inline](/cloudflare-one/email-security/setup/pre-delivery-deployment/inline-deployment-setup/) on the Cloudflare dashboard.

‎src/content/docs/cloudflare-one/email-security/setup/pre-delivery-deployment/prerequisites/index.mdx‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
---
2+
title: Prerequisites
3+
pcx_content_type: navigation
4+
sidebar:
5+
order: 1
6+
group:
7+
hideIndex: true
8+
---
9+
10+
import { DirectoryListing } from "~/components"
11+
12+
13+
14+
<DirectoryListing />

‎src/content/docs/cloudflare-one/email-security/setup/pre-delivery-deployment/prerequisites/office365-prerequisites.mdx‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
---
2+
title: Office 365 as MX Record
3+
pcx_content_type: concept
4+
sidebar:
5+
order: 3
6+
---
7+
8+
In this tutorial, you will learn how to configure Microsoft Office 365 with Email Security as its MX record.
9+
10+
## Add Email Security IP addresses to Allow List
11+
12+
1. Go to the [Anti-spam policies page](https://security.microsoft.com/antispam) > Select **Edit connection filter policy**.
13+
2. In **Always allow messages from the following IP addresses or address range**, add IP addresses and CIDR blocks mentioned in Egress IPs.
14+
3. Select **Save**.
15+
4. Microsoft recommends disabling SPF Hard fail when an email solution is placed in front of it:
16+
- Return to the [Anti-spam option](https://security.microsoft.com/antispam).
17+
- Select **Default anti-spam policy**.
18+
- Select **[Edit spam threshold and properties](https://learn.microsoft.com/en-us/defender-office-365/anti-spam-bulk-complaint-level-bcl-about)** > **Mark as spam** > **SPF record: hard fail**, and ensure it is set to **Off**.
19+
5. Select **Save**.
20+
21+
## Enhanced Filtering configuration
22+
23+
### Create an inbound connector
24+
25+
1. [Set up a connector](https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/use-connectors-to-configure-mail-flow/set-up-connectors-to-route-mail#1-set-up-a-connector-from-your-email-server-to-microsoft-365-or-office-365).
26+
2. Select **Partner organization** under **Connection from**.
27+
- Provide a name for the connector:
28+
- **Name**: ```Email Security Inbound Connector```
29+
- **Description**: ```Inbound connector for Enhanced Filtering```
30+
3. In **Authenticating sent email**, select **By verifying that the IP address of the sending server matches one of the following IP addresses, which belongs to your partner organization.**
31+
4. Enter all of the egress IPs in the [Egress IPs](/cloudflare-one/email-security/setup/pre-delivery-deployment/egress-ips/) page.
32+
5. In **Security restrictions**, accept the default **Reject email messages if they aren't sent over TLS** setting.
33+
34+
### Enable enhanced filtering
35+
36+
Now that the inbound connector has been configured, you will need to enable the enhanced filtering configuration of the connector.
37+
38+
1. Go to the [Security admin console](https://security.microsoft.com/homepage), and [enable enhanced filtering](https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/use-connectors-to-configure-mail-flow/enhanced-filtering-for-connectors#use-the-microsoft-defender-portal-to-configure-enhanced-filtering-for-connectors-on-an-inbound-connector).
39+
2. Select **Automatically detect and skip the last IP address** and **Apply to entire organization**.
40+
3. Select **Save**.
41+
42+
Now that you have completed the prerequisite steps, you can set up [MX/Inline](/cloudflare-one/email-security/setup/pre-delivery-deployment/inline-deployment-setup/) on the Cloudflare dashboard.

0 commit comments

Comments
 (0)