diff --git a/src/content/docs/cloudflare-one/email-security/setup/pre-delivery-deployment/prerequisites/gsuite-email-security-mx.mdx b/src/content/docs/cloudflare-one/email-security/setup/pre-delivery-deployment/prerequisites/gsuite-email-security-mx.mdx index e06f21f00a73f0c..b2f85de6d8fe75f 100644 --- a/src/content/docs/cloudflare-one/email-security/setup/pre-delivery-deployment/prerequisites/gsuite-email-security-mx.mdx +++ b/src/content/docs/cloudflare-one/email-security/setup/pre-delivery-deployment/prerequisites/gsuite-email-security-mx.mdx @@ -5,7 +5,7 @@ sidebar: order: 4 --- -import { Render } from "~/components" +import { Render, GlossaryTooltip } from "~/components" ![A schematic showing where Email Security is in the life cycle of an email received](src/assets/email-security/Email_Security_Gmail_MX_Inline.png) @@ -64,4 +64,24 @@ If desired, you can create a separate quarantine for each of the dispositions. ## 4. Set up MX/Inline - \ No newline at end of file + + +## 5. (Recommended) Secure Google Workspace from MX records bypass + +One method of a DNS attack is to search for old MX records and send phishing emails directly to the mail server. To secure the email flow, you should enforce an email flow where inbound messages are accepted by Google Workspace only when they originate from Email Security. This can be done by adding a connector to only allow email from Email Security with TLS encryption. This step is optional but recommended. + +:::caution[Important] +This step should not be performed until 72 hours after all domains in your Google Workspace have been onboarded to Email Security, and Email Security is their MX record. If a domain has not been onboarded or DNS is still propagating, you will impact production email flow for that domain. +::: + +After 72 hours, the MX record DNS update will have sufficiently propagated across the Internet. It is now safe to secure your email flow. This will ensure that Google Workspace only accepts messages that are first received by Email Security. This step is highly recommended to prevent threat actors from using cached MX entries to bypass Email Security by injecting messages directly into Google Workspace. + +1. Access the [Google Administrative Console](https://admin.google.com/), then select **Apps** > **Google Workspace** > **Gmail**. + +2. Select **Spam, Phishing and Malware**. + +3. Go to **Inbound gateway** and select **Edit Inbound gateway**. + +4. Enable **Reject all mail not from gateway IPs** and select **Save**. + +5. Select **Save** once more to commit and activate the configuration change in the Gmail advanced configuration console. \ No newline at end of file diff --git a/src/content/docs/cloudflare-one/email-security/setup/pre-delivery-deployment/prerequisites/m365-email-security-mx/index.mdx b/src/content/docs/cloudflare-one/email-security/setup/pre-delivery-deployment/prerequisites/m365-email-security-mx/index.mdx index 97d31f0129bd4b0..e60e7d369acb47d 100644 --- a/src/content/docs/cloudflare-one/email-security/setup/pre-delivery-deployment/prerequisites/m365-email-security-mx/index.mdx +++ b/src/content/docs/cloudflare-one/email-security/setup/pre-delivery-deployment/prerequisites/m365-email-security-mx/index.mdx @@ -105,4 +105,45 @@ To create the transport rules that will send emails with certain [dispositions]( ## 5. Set up MX/Inline - \ No newline at end of file + + +## 6. (Recommended) Secure Microsoft 365 from MX records bypass + +One method of a DNS attack is to search for old MX records and send phishing emails directly to the mail server. To secure the email flow, you should enforce an email flow where inbound messages are accepted by Microsoft 365 only when they originate from Email Security. This can be done by adding a connector to only allow email from Email Security with TLS encryption. This step is optional but recommended. + +:::caution[Important] +This step should not be performed until 72 hours after all domains in your Microsoft 365 organization have been onboarded to Email Security, and Email Security is their MX record. If a domain has not been onboarded or DNS is still propagating, you will impact production email flow for that domain. +::: + +#### Create Connector + +1. Go to the new [Exchange admin center](https://admin.exchange.microsoft.com/#/homepage). + +2. Go to **Mail flow** > **Connectors**. + +3. Select **Add a connector**. + +4. Go to **Connection from** > **Partner organization**. + +5. Select **Next**. + +6. Set the following options: + + - **Name** - `Secure M365 Inbound` + - **Description** - `Only accept inbound email from Email Security` + +7. Select **Next**. + +8. Make sure **By Verifying that the sender domain matches one of the following domains** is selected. + +9. Enter `*` in the text field, and select **+**. + +10. Select **Next**. + +11. Make sure **Reject email messages if they aren't sent over TLS** is selected. + +12. Still in the same screen, select **Reject email messages if they aren't sent from within this IP address range**, and enter all the egress IPs in the [Egress IPs](/cloudflare-one/email-security/setup/pre-delivery-deployment/egress-ips/) page. + +13. Select **Next**. + +14. Review your settings and select **Create connector**. \ No newline at end of file