iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Short answer: Microsoft Defender for Office 365 and a third-party email security gateway are not interchangeable products in a simple scorecard. The more important decision is where mail is inspected, whether the original sender and authentication context survive that inspection, and how many quarantine, reporting, and incident-response systems your team can operate. Microsoft recommends pointing MX records directly to Microsoft 365 to reduce complexity. If a third-party gateway must sit in front of Exchange Online, configure the supported connector design with Enhanced Filtering for Connectors, preserve authentication with ARC when available, and test the complete mail path before production.
Microsoft’s documentation does not establish an independent detection-rate, false-positive, breach-reduction, or total-cost winner between Defender for Office 365 and unnamed third-party gateways. Choose the topology that fits your security requirements, compliance obligations, operational capacity, and tolerance for extra routing and licensing.
What this comparison is really deciding
Defender for Office 365 is Microsoft’s cloud email-protection layer for Exchange Online. A third-party gateway is an additional service that can inspect mail before it reaches Microsoft 365, after delivery through Microsoft Graph, or in a design where messages leave Microsoft 365 and return after inspection. Those are different architectures with different support and failure characteristics.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallThe question is therefore not simply “Which scanner is better?” It is “Which mail path gives us the required protection while retaining trustworthy sender context, usable investigations, predictable quarantine handling, and manageable cost?” Microsoft states that no email-defense stack reaches total protection of 100 percent. Layering another service can address a particular requirement, but it also adds policy interactions and operational work.
#1 Best Overall
- Fortinet FortiMail-VM virtual appliance for all supported platforms. 8 x vCPU cores
- Fortinet SW FML-VM08
- Manufacturer Part: FML-VM08
Microsoft’s official integration guidance is the starting point: Integrate non-Microsoft security services with Microsoft 365. Exchange Online administrators should also read Manage mail flow using a third-party cloud service with Exchange Online before changing DNS or connectors.
Three deployment patterns and their trade-offs
| Pattern | Typical mail path | Microsoft’s support and filtering implications | Main operational risks |
|---|---|---|---|
| Third-party gateway before Exchange Online | Internet sender → third-party gateway → Exchange Online | Supported when connectors are configured correctly. Enhanced Filtering for Connectors (also called skip listing) lets Microsoft 365 identify the original sender instead of treating the gateway as the source. | Extra DNS and connector dependency, a second policy engine and quarantine, possible link-wrapping conflicts, and additional service cost. |
| Post-delivery Microsoft Graph scanning | Internet sender → Exchange Online delivery → service accesses the mailbox through Microsoft Graph | The service can find and remove messages after delivery. It is an integration model rather than a replacement for the normal inbound mail path. | Often requires full mailbox access. Detection happens after a message may have reached a user, and permissions and remediation behavior require careful review. |
| In-and-out routing | Internet sender → Microsoft 365 → third-party inspection → Microsoft 365 again | Microsoft treats the returning copy as a new message. Enhanced Filtering for Connectors is not designed for this pattern. | Duplicate reporting, authentication failures, spoofing false positives, and reduced machine-learning and investigation quality when source data is altered or missing. |
For organizations adding a gateway, the first pattern is generally the cleanest documented integration. Microsoft separately recommends direct MX delivery to Microsoft 365 when no third-party prefilter is required, because every additional hop increases complexity.
How Defender for Office 365 fits when Microsoft 365 receives mail directly
With MX records directed to Microsoft 365, Exchange Online receives the message at the service boundary where Microsoft’s cloud filtering, authentication checks, anti-spam and anti-malware controls, anti-phishing detections, investigation tooling, and policy controls can evaluate it. The exact controls available depend on the tenant’s licensing and configuration; confirm entitlements before promising a feature to users or auditors.
Recommended Free Tools
Direct delivery gives Microsoft the original connecting context without requiring a preceding gateway to be trusted as an intermediary. It also keeps message trace, quarantine, remediation, and user reporting in one administrative environment. That does not make every message safe or eliminate false positives, but it removes an entire class of routing and attribution problems.
Direct MX is especially attractive when your organization:
- Already uses Microsoft 365 as its authoritative mail platform.
- Wants one quarantine and one investigation workflow.
- Does not have a regulatory, geographic, or business requirement for an external mail-security boundary.
- Can meet its protection and monitoring requirements with the licensed Defender controls in the tenant.
- Wants to minimize DNS, connector, certificate, and vendor-integration maintenance.
Do not interpret the direct-MX recommendation as proof that every third-party gateway is ineffective. Microsoft’s guidance is about reducing complexity and preserving a supportable path, not a published independent performance ranking.
When a third-party gateway may be justified
An external gateway can be reasonable when it supplies a requirement that your Microsoft 365 design does not meet or when the organization needs a common control plane across multiple mail platforms. Examples include a staged migration in which some domains still deliver to another system, a policy or residency requirement that places inspection outside Microsoft 365, a centralized gateway for several independent tenants, or an established security-operations process that depends on a particular gateway’s telemetry.
Those are architecture requirements, not evidence that a gateway has a universally higher detection rate. The official material reviewed for this comparison does not provide vendor-neutral tests or current pricing. Ask the prospective provider for current licensing, data-processing, retention, API-permission, and support details, then validate the claims in your own environment.
Adding a service creates costs and failure modes that should be recorded in the design:
Rank #2
- Watchguard T145 Firebox with 3 Year Basic Security Suite License (WGT145033) - The Firebox T145 delivers enterprise-grade protection for branch offices and retail sites. With a blend of 2.5Gb, 1Gb, and SFP/SFP+ ports, it supports high throughput, AI-driven malware protection, and DNS filtering for robust network defense.
- The Basic Security Suite activates core protections on your Firebox, including intrusion prevention, gateway antivirus, URL filtering, and spam blocking in WatchGuard Cloud. Upgrade to Total Security Suite to add AI-powered malware detection, cloud sandboxing, DNS filtering, and advanced correlation.
- The Basic Security Suite equips your WatchGuard Firebox with a robust set of foundational security tools. This bundle delivers intrusion prevention, gateway antivirus, URL filtering, and spam blocking, all managed through WatchGuard Cloud. It’s a cost-effective choice for organizations that need reliable, essential protection without unnecessary extras.
- Interfaces and deployment: 2.5Gb and 1Gb Ethernet with SFP or SFP+ fiber for clean aggregation and segmented backhaul at the edge.
- Performance and scale: UTM up to 710 Mbps with inspection on; flexible VPN topologies for hub and spoke or mesh designs.
- A recurring gateway subscription and possible charges for protected users, domains, mail volume, archiving, or advanced features.
- DNS changes, connectors, transport rules, certificates, allowlists, and change-control procedures.
- Two policy engines that can take different actions on the same message.
- Separate administrator and end-user quarantine experiences.
- More complicated message tracing and incident timelines.
- Additional integration work for SIEM, SOAR, ticketing, and automated remediation.
- A larger support boundary when a message is delayed, rejected, modified, or released incorrectly.
Microsoft explicitly calls out added cost and complexity, increased false positives, confusing multi-quarantine experiences, and integration with existing SecOps processes as factors to assess before adding a service.
Decision framework: compare the mail path, not marketing claims
Use the following questions in a design review. Record an answer for every domain and every inbound route; a single tenant can contain more than one topology during migration.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problems1. Where does the MX record point?
For a Microsoft-first design, the public MX record points to the Microsoft 365 endpoint. For a prefilter design, it points to the gateway and the gateway forwards only to the authorized Exchange Online destination. Document the expected path and reject any route that can deliver directly to a mailbox while bypassing the intended inspection layer.
2. Is the gateway in front once, or does mail leave and re-enter Microsoft 365?
A single pre-Exchange Online hop is the supported third-party pattern described by Microsoft. In-and-out routing creates a second message instance in Microsoft 365 and should not be treated as equivalent. The latter can produce duplicate counts, authentication failures, and weaker investigation data.
3. Does Microsoft retain the originating sender context?
Confirm that the design preserves the original connecting IP and authentication results. Configure Enhanced Filtering for Connectors for the pre-Exchange Online pattern so Microsoft can distinguish the original sender from the gateway. Confirm whether the gateway supports Authenticated Received Chain (ARC), which can preserve authentication results through an intermediary.
4. How are overlapping verdicts resolved?
Define what happens when one system accepts a message and the other quarantines it, or when both systems rewrite headers, URLs, or attachments. Decide which system is authoritative for release, remediation, and user notifications. Avoid broad allowlists that defeat later detection.
5. Can investigators reconstruct one trustworthy timeline?
Require message IDs, original sender information, connector events, verdicts, and remediation actions from every hop. Verify that the gateway can export events to your SIEM or SOAR and that Microsoft message trace remains useful after forwarding.
6. Can users understand quarantine?
Map the user journey for a false positive: where the message appears, who can release it, which policy is evaluated again, and how the user is notified. Two independent quarantine portals are a support burden unless ownership and instructions are explicit.
7. What is the complete cost of operation?
Include subscription fees, migration and testing time, DNS and connector maintenance, on-call troubleshooting, incident-response integration, and the cost of delays or duplicate investigations. A lower license quote can still be more expensive if it requires extensive custom integration.
Recommended design: a gateway in front of Exchange Online
If you retain a third-party gateway, use a one-way inbound path: Internet → gateway → Exchange Online. Microsoft describes Enhanced Filtering for Connectors as designed for this arrangement and strongly recommends it. The feature helps Microsoft identify the original source rather than treating the gateway’s IP address as the sender. That supports source-based reputation, authentication, anti-spoofing, anti-phishing, and automated investigation functions.
Free tools Windows power users keep installed
One-click scans. No signup required.
- Inventory the current path. Record public MX records, accepted domains, inbound and outbound connectors, transport rules, trusted IP ranges, mail-flow exceptions, and any existing gateway or appliance. Capture a normal message, a spoofed message, an attachment test, and a URL test before changing anything.
- Prepare the gateway destination. Configure the gateway to forward inbound mail to the correct Exchange Online protection endpoint for the accepted domain. Restrict inbound delivery so unauthorized systems cannot send directly to the tenant while the gateway is expected to be authoritative.
- Configure the Exchange Online connector. Create or update the inbound connector according to Microsoft’s third-party cloud guidance. Authenticate the gateway with the strongest method it supports, such as certificate or verified source information, and limit trusted sources to the gateway’s documented ranges.
- Enable Enhanced Filtering for Connectors. Apply it to the connector that receives mail from the gateway. Follow the current steps in Microsoft’s Enhanced filtering for connectors in Exchange Online documentation. Verify the configuration on every connector and accepted domain that uses the pattern.
- Plan authentication preservation. Confirm ARC support with the gateway and define how ARC results will be evaluated. Keep SPF, DKIM, and DMARC records aligned with the actual sending and forwarding design. A gateway that modifies content can invalidate a DKIM signature; document whether it signs again and which system is responsible for final policy evaluation.
- Move DNS during a controlled window. Lower the MX-record TTL in advance if appropriate, change the record to the gateway, and monitor DNS propagation, gateway acceptance, Exchange Online receipt, and outbound replies. Do not remove the previous route until the agreed rollback condition is met.
- Validate before declaring success. Test legitimate mail, unauthenticated spoofing, DMARC failures, bulk mail, malware simulators approved by your security team, large attachments, calendar messages, and messages containing Safe Links-protected URLs. Check headers, message trace, quarantine, user notifications, and SIEM events.
The exact connector screens and available options can change. Use the current Microsoft documentation and your tenant’s present Exchange admin center rather than copying an old screenshot or assuming a feature is included in every license.
Enhanced Filtering for Connectors: why it matters
When a gateway forwards a message, Exchange Online may otherwise see the gateway as the immediate sender. That can hide the original IP address and make a legitimate message look as though it came from a trusted intermediary. Enhanced Filtering for Connectors tells Microsoft 365 how to recover the original source information from the forwarding path for the supported inbound architecture.
This is not a generic bypass switch. It is intended to improve attribution while allowing Microsoft’s protection stack to continue evaluating the message. Microsoft’s connector documentation, updated October 30, 2024, explains the feature and its configuration at learn.microsoft.com/en-us/Exchange/mail-flow-best-practices/use-connectors-to-configure-mail-flow/enhanced-filtering-for-connectors.
Do not enable it as a remedy for in-and-out routing. Microsoft states that Enhanced Filtering for Connectors does not work with a design in which mail leaves and re-enters Microsoft 365. Redesign that path or accept that the original context and filtering behavior may not be preserved.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
ARC, SPF, DKIM, and DMARC through an intermediary
Authentication is evaluated against the message as it arrives at each boundary. Forwarding, content changes, and new headers can cause a previously valid result to fail at the next hop. ARC can preserve a chain of authentication results when intermediary services support and validate it; Microsoft advises organizations using a non-Microsoft service in front of Microsoft 365 to consider ARC together with Enhanced Filtering for Connectors.
Review the design as a sequence:
- SPF: Identify which systems send mail for each domain and ensure the published record reflects the real outbound services without exceeding DNS lookup limits.
- DKIM: Determine whether the gateway changes the signed body or headers. Any modification can invalidate the sender’s signature. Decide whether the original signature is retained, whether the gateway signs, and which signature Microsoft should evaluate.
- DMARC: Test alignment for legitimate senders and forwarding paths. A message can pass one authentication check and still fail DMARC alignment.
- ARC: If supported, validate the gateway’s ARC chain and define which internal systems may trust it. Do not treat an ARC seal as proof that the message is safe; it records prior authentication results.
Use real headers from test messages and the tenant’s message trace to verify the result. Do not rely solely on a gateway dashboard that cannot show what Exchange Online received.
Why an SCL -1 bypass is a dangerous shortcut
A mail-flow rule that sets the spam confidence level to -1 effectively bypasses most cloud email protection controls. Microsoft recommends Enhanced Filtering for Connectors for the supported inbound gateway pattern instead of broadly bypassing spam filtering. A bypass can be especially risky when gateway IP ranges are shared, change frequently, or are not the only source of forwarded mail.
Microsoft’s policy-precedence guidance, Order and precedence of email protection, advises organizations with a non-Microsoft service or device in front of Microsoft 365 to consider ARC and Enhanced Filtering rather than an SCL -1 rule. Microsoft’s anti-spam FAQ at Anti-spam protection FAQ also notes that malware and high-confidence phishing checks cannot be skipped through the spam-bypass mechanism. The practical lesson is to preserve source context, not to turn off filtering for everything arriving from a gateway.
Rank #4
- Watchguard T125 Firebox with 1 Year Basic Security Suite License (WGT125031) - The Firebox T125 provides enterprise-grade protection for branch offices and remote sites. Featuring 2.5Gb and 1Gb ports, it delivers fast throughput, advanced malware detection with IntelligentAV, and SD-WAN compatibility in a compact form factor.
- The Basic Security Suite activates core protections on your Firebox, including intrusion prevention, gateway antivirus, URL filtering, and spam blocking in WatchGuard Cloud. Upgrade to Total Security Suite to add AI-powered malware detection, cloud sandboxing, DNS filtering, and advanced correlation.
- The Basic Security Suite equips your WatchGuard Firebox with a robust set of foundational security tools. This bundle delivers intrusion prevention, gateway antivirus, URL filtering, and spam blocking, all managed through WatchGuard Cloud. It’s a cost-effective choice for organizations that need reliable, essential protection without unnecessary extras.
- Interfaces and deployment: 1x 2.5Gb and 4x 1Gb Ethernet to simplify uplinks, carve out segmented zones, and keep branch wiring minimal.
- Performance and scale: UTM up to 510 Mbps with inspection on; sized for small and branch offices with room to grow VPN connectivity.
Safe Links and URL rewriting conflicts
If Defender Safe Links is enabled, check whether the gateway also rewrites or wraps URLs. Microsoft advises against having both services perform link wrapping. Double wrapping can interfere with URL validation, threat detonation, and one-time-use links. Choose one system to perform the user-facing rewrite, or configure the other service not to rewrite links while retaining any inspection that does not alter the URL.
Test links in ordinary messages, messages with expiring or one-time URLs, meeting invitations, and links that require authentication. Inspect the delivered URL and click-time behavior from a managed test account. A message that arrives safely but whose legitimate link no longer works is still an operational failure.
Post-delivery scanning through Microsoft Graph
Some services connect to Microsoft Graph, inspect messages after delivery, and remove those later judged malicious or unwanted. This can be useful when changing MX records is impractical or when an organization needs a remediation layer across existing mailboxes, but it is not equivalent to blocking a message before delivery.
Before granting access, document:
- The exact Graph permissions, including whether the service requests full mailbox access.
- Which mailboxes, shared mailboxes, and groups are in scope.
- How quickly messages are scanned and removed after delivery.
- Whether the service can restore a false positive with original metadata.
- Where message content, attachments, and logs are stored and for how long.
- How access is revoked, audited, and monitored.
- Who supports a missed detection or an incorrectly removed message.
Microsoft cautions that this model typically requires granting the service full mailbox access. Treat that permission as a high-impact security decision and review the provider’s security and support practices before approval.
Why in-and-out routing often causes trouble
In-and-out routing sends a message through Microsoft 365, exports it for third-party inspection, and then brings it back. Microsoft warns that the returning message is treated as new. That behavior can create duplicate entries in reporting and message trace, cause authentication to fail, and make a message appear to be spoofing. If the external service removes or changes the original sender IP or message data, Defender machine learning and automated investigations may have less useful evidence.
Common symptoms include:
- A single user message appearing twice in reports or compliance searches.
- DMARC, SPF, or DKIM results changing after the second arrival.
- Unexpected spoofing verdicts on mail that passed the first hop.
- Rules matching the reintroduced message differently from the original.
- Investigators being unable to correlate gateway and Microsoft events with one message ID.
Enhanced Filtering for Connectors is not designed to correct these problems. If a business process requires this topology, treat it as an exception with documented limitations, additional monitoring, and a tested rollback path. A one-way prefilter or direct MX design is usually easier to support.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Operating two protection systems without losing control
Define policy ownership
Assign one owner for each decision: inbound acceptance, malware blocking, spam scoring, phishing remediation, URL rewriting, attachment detonation, quarantine release, and user notification. Write down precedence when policies conflict. Avoid making both systems administrators of the same control without a clear escalation rule.
Unify investigation data
Forward gateway events to the same SIEM or case-management process used for Microsoft 365. Preserve the original message ID, sender, recipient, timestamps, verdicts, connector name, and remediation action. Build a simple correlation procedure for cases where the gateway and Microsoft generate different IDs.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Measure service health, not just detections
Monitor MX resolution, gateway queue depth, connector errors, delivery latency, rejection rates, quarantine volume, authentication failures, and Safe Links click errors. A protection service that blocks mail for hours or prevents password-reset links from working can create a serious business incident even when its security verdicts are correct.
Best Value
- Watchguard T125 Firebox with 5 Year Basic Security Suite License (WGT125035) - The Firebox T125 provides enterprise-grade protection for branch offices and remote sites. Featuring 2.5Gb and 1Gb ports, it delivers fast throughput, advanced malware detection with IntelligentAV, and SD-WAN compatibility in a compact form factor.
- The Basic Security Suite activates core protections on your Firebox, including intrusion prevention, gateway antivirus, URL filtering, and spam blocking in WatchGuard Cloud. Upgrade to Total Security Suite to add AI-powered malware detection, cloud sandboxing, DNS filtering, and advanced correlation.
- The Basic Security Suite equips your WatchGuard Firebox with a robust set of foundational security tools. This bundle delivers intrusion prevention, gateway antivirus, URL filtering, and spam blocking, all managed through WatchGuard Cloud. It’s a cost-effective choice for organizations that need reliable, essential protection without unnecessary extras.
- Interfaces and deployment: 1x 2.5Gb and 4x 1Gb Ethernet to simplify uplinks, carve out segmented zones, and keep branch wiring minimal.
- Performance and scale: UTM up to 510 Mbps with inspection on; sized for small and branch offices with room to grow VPN connectivity.
Train users on the release process
Publish one short instruction that tells users where to look for a quarantined message and how to request release. Explain that an administrator may need to release a message from a different portal when the gateway, rather than Microsoft 365, made the decision. Review the instruction after every major policy or portal change.
Validation and change checklist
Use this checklist for a new deployment, a gateway replacement, or a major policy change:
- MX records point only to the intended inbound service, and unauthorized direct delivery is rejected.
- The Exchange Online connector trusts only the documented gateway sources and authentication method.
- Enhanced Filtering for Connectors is enabled on the correct inbound connector for the pre-Exchange Online pattern.
- ARC support and trust behavior are documented and tested.
- SPF, DKIM, and DMARC pass or fail as expected for both direct senders and forwarded senders.
- Legitimate messages, spoofed messages, malware test messages approved by policy, bulk mail, large attachments, and calendar messages are tested.
- Safe Links is not being double-wrapped, and one-time links still function.
- Message trace and gateway logs can be correlated by message ID and timestamp.
- Users know which quarantine to check, and administrators can release and remediate messages.
- SIEM/SOAR alerts, retention, and escalation paths work for both systems.
- A rollback plan restores the prior MX and connector state without leaving an open relay or bypass rule.
Troubleshooting common failures
Legitimate mail is treated as spoofing after the gateway is added
Check whether Exchange Online is seeing only the gateway IP, whether Enhanced Filtering is enabled on the receiving connector, and whether the gateway preserved or replaced authentication headers. Compare the original and delivered headers, then verify ARC and DMARC alignment. Do not solve the symptom by applying a tenant-wide SCL -1 bypass.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Messages are counted twice
Confirm that the design is not sending mail into Microsoft 365, out to the gateway, and back into Microsoft 365. Returning messages are treated as new. Move to a one-way prefilter or direct-MX design where possible, and remove duplicate transport routes.
Users cannot find released messages
Identify which system quarantined the message and which system will evaluate it after release. Check whether the release creates a new message that is rescanned by the other service. Document the ownership and ensure notification links point to the correct portal.
Links fail after delivery
Inspect the message for two layers of URL wrapping. Disable rewriting in one system or define a documented exception for link types that cannot tolerate wrapping. Retest validation, detonation, authentication, and one-time-use behavior.
Graph scanning removes messages unexpectedly
Review the service’s mailbox permissions, detection and remediation logs, restore workflow, and scope. Confirm whether the message had already been delivered and whether users received a notification. Narrow permissions or mailbox scope if the provider cannot explain or audit the action.
Recommended Free Tools
Cost, licensing, and evidence limits
There is no reliable universal price comparison in the official guidance for this topic. Defender capabilities vary by Microsoft 365 and Defender licensing, while third-party gateways vary by protected identity, domain, message volume, retention, and optional modules. Obtain current tenant entitlements and provider quotes for your region and contract term.
Likewise, the sources do not establish that Microsoft or any unnamed gateway has better detection, fewer false positives, or lower total cost. A defensible procurement decision should require comparable evaluation criteria, representative traffic testing, transparent permission and data-handling terms, and an operational-cost estimate that includes staff time and incident response.
Bottom line
Use direct MX delivery to Microsoft 365 when Defender for Office 365 meets your requirements and a second mail-security boundary is not necessary. If a third-party gateway must precede Exchange Online, keep the path one-way, configure Enhanced Filtering for Connectors, preserve authentication with ARC where supported, avoid broad spam bypass rules, and prevent duplicate Safe Links wrapping. Use Microsoft Graph post-delivery scanning only after reviewing its mailbox permissions and remediation limits. Treat in-and-out routing as an exception because it can duplicate reporting, break authentication, and reduce the context available to Microsoft’s detections and investigations.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
