How to set up Forced TLS for O365 Exchange Online

Create these connectors in the Exchange admin center in Microsoft 365:

• Outbound connector
• Inbound connector

Step 1. Create outbound connector

To encrypt each email message sent by an Exchange Online (Microsoft 365) organization to an external mail server representing the partner domain name, it needs to fulfill the following requirements:

• The mail communication needs to be implemented using encrypted connection (TLS)
• The internal and external mail server must support TLS
• The internal mail server must identify itself using a trusted public certificate

To create an outbound connector in Exchange admin center, follow these steps:

1. Sign in to Exchange admin center
2. Click Mail flow > Connectors
3. Click Add a connector

4. Select Office 365
5. Select Partner organization
6. Click Next

7. Type the inbound connector Name
8. Select Turn it on
9. Click Next

10. Select Only when email messages are sent to these domains
11. Type the domain (alitajran.com)
12. Click on + to add it

13. Select Use the MX record associated with the partner’s domain
14. Click Next

15. Select Always use Transport Layer Security (TLS) to secure the connection (recommended)
16. Select Issued by a trusted certificate authority (CA)
17. Select Add the subject name or subject alternative name (SAN) matches this domain name
18. Fill in the partner domain
19. Click Next

Important: You must select the Add the subject name or subject alternative name (SAN) matches this domain name. Type the domain name (mail.alitajran.com) that’s included in the certificate, or use a wildcard domain name (*.alitajran.com).

20. Type the email address of your partner domain
21. Click on + to add it
22. Click Validate

23. Check that the Validation successful message appears in green
24. Click Next

25. A test email for connector validation is sent to the email address you provided

26. Click Create connector

27. Click Done

28. Check that the connector shows the status On

The outbound connector is added. In the next step, you will create an inbound connector.

Step 2. Create inbound connector

To encrypt each email message sent by an external mail server that represents the partner domain name to the Exchange Online (Microsoft 365) organization, it needs to fulfill the following requirements:

• The mail communication needs to be implemented using encrypted connection (TLS)
• The internal and external mail server must support TLS
• The external mail server must identify itself using a trusted public certificate

To create an inbound connector in Exchange admin center, follow these steps:

1. Click Add a connector

2. Select Partner organization
3. Click Next

4. Type the outbound connector Name
5. Select Turn it on
6. Click Next

7. Select By verifying that the sender domain matches one of the following domains
8. Type the sender domain
9. Click on the + to add it
10. Click Next

11. Select Reject email messages if they aren’t sent over TLS
12. Select And require that the subject name on the certificate that the partner uses to authenticate with Office 365 matches this domain name
13. Fill in the partner domain
14. Click Next

Important: You must select the And require that the subject name on the certificate that the partner uses to authenticate with Office 365 matches this domain name. Type the domain name (mail.alitajran.com) that’s included in the certificate, or use a wildcard domain name (*.alitajran.com)

15. Click Create connector

16. Click Done

17. Check the inbound connector shows Status On

18. Create a new email and send it from your partner organization to a mailbox in your domain

19. The partner organization needs to open the mail
20. Click File

21. Click Info
22. Select Properties

23. Select the text and copy the message header

24. Go to Message Header Analyzer
25. Paste the message header
26. Click Analyze headers

27. Check the Type column and verify it shows TLS

That’s it!