Hi, I’m Emmanuel from Sophos Support and in this video series, I'll be introducing
you to the basics of Sophos Email. In this first part, I’ll be covering Gateway Mode
configuration. In the rest of the series, I’ll explain the steps for Policy Configuration
as well as email configuration via Mailflow mode.
The links to each part can be found in the description.
Sophos Email Security protects both your inbound and outbound email against different threats
such as spam, viruses, malware and malicious URLs.
You can configure your mail flow via two methods:
Gateway Mode - for any On-Premise mail servers and cloud services.
And Mailflow mode - for Microsoft 365 domains .
The prerequisites for configuring Central Email are as follows:
First, you need an Email Advanced license from Sophos.
You must have a valid domain.
You must have a public DNS record of that domain.
And finally, you must be able to manage the public DNS record through the domain registrar
In this case, I’ll be demonstrating with Exchange version 2019.
Now, let’s dive into the configuration steps for Gateway Mode using On-Premise Exchange.
3. Configure using On-Premise Exchange
Setup the domain:
First, you’ll need to set up your domain.
Note that you will need access to your Third Party DNS provider to complete the setup.
Go to “Email Security” >> “Settings” >> “Domain Settings/Status”
Then click on “Add domain”.
Enter the email domain you want to protect.
Click on “Verify Domain Ownership”.
A new window which contains a TXT Value will pop up. You will need to copy this value.
Go to your third party domain provider.
Enter this as a TXT record
and save your changes.
Back in Central, click on “Verify”.
It can take a few minutes for the verification to complete, as your new record needs to be
propagated by your provider.
Once verification is complete, we can now configure the Domain.
Sophos Email gives you two options to configure your email flow:
“Inbound only” or “Inbound and Outbound”.
We recommend you choose “Inbound and Outbound”. This allows all the functions of Central Email
to work properly, such as Smart Banners, which we will discuss in the next video.
The Inbound Destination can be set to “Mail Host” or “MX” but we’ll leave it as
the default of “Mail Host”.
In the IP/FQDN enter the Public IP or FQDN where Sophos Central will send all the inbound
email to.
Usually, this is either the Public IP or an FQDN that resolves to the public IP of your
router or a firewall in front of your receiving mail server.
Under “Outbound Gateway”, choose the option “Custom Gateway”.
For “IP/CIDR”, enter the Public IP or IPs that Sophos Central will use to receive
outbound email coming from your organization.
Make sure to enter all the IPs you use to send email. Any emails not coming from these
addresses will be automatically rejected.
And finally, set the Port used for email flow. In most cases, this is the default Port 25.
Click Save.
Take note of the MX Record and Sophos Delivery IPs shown in the pop-up window.
Now that our domain is set up, let’s add a Test Mailbox and verify our connection.
Here, I’ll quickly add a User and Mailbox manually but later, I’ll outline the three
methods to add users and mailboxes in Sophos Central.
Go to “Mailboxes”
and then click “Add” >> “Add Mailbox”
For “Mailbox Type”, we’ll leave this as the default of “User”.
Enter the relevant details and click “Save”.
Now that we’ve created a test user and mailbox, we can test our outbound email setup.
We’ll configure a send connector on Exchange and try sending an outbound message.
This will cause some downtime, so plan accordingly.
Note that for mail servers other than Exchange, the steps may differ. Refer to your specific
product documentation if needed.
In On-Premise Exchange, go to “Mail Flow”>> “Send connectors”
and click the “+” symbol.
Enter a self-explanatory name such as “Send Connector to Sophos Email”
Set the type to “Internet”,
select “Route mail through smart hosts”,
click the “+” symbol,
and enter the “Outbound Relay Host for Central Email”.
This appears in your Sophos Central email account under “Configure External Dependencies”
under “Outbound Settings”.
Save, then click next.
For Smart host authentication, select “none” and click next.
And for Address Space, click the. “+” symbol.
Under FQDN, enter an asterisk (*).
This will route all outbound emails through Sophos Central once the send connector is
enabled.
In this video, we’ll use a public domain instead to prevent our outbound mail from
being rejected before syncing has completed.
Alternatively, instead of using a public domain, you can wait for all mailboxes to fully sync
first. Then, simply enable the send connector with the asterisk.
Click Next.
For “Source Server”, select your Exchange Server and click “Finish”.
Your new Send Connector is enabled by default.
If your firewall is acting as an email gateway, note that this can affect the outbound email
process. Make sure to configure your settings accordingly.
For an added layer of security, you can configure your Firewall to only allow Ports 25 and 587
for outgoing email communication to the FQDN of Sophos Central.
With the Send Connector now configured, confirm that outbound email is traversing Sophos Central
Email.
Access the test mailbox (or the mailbox you added in Sophos Central) and send an email
to a public email provider.
To check that the message went out via Central Email, you can check directly within Sophos
Central under
“Logs & Reports” >> “Message History”
You can also check via the email received by the user. Search for “hydra.sophos.com”
to confirm.
Note that the full string will differ depending on which region the account is located, but
“hydra.sophos.com” will always be included.
With outbound email correctly traversing Sophos Central, we can now add our actual mailboxes.
Sophos Central Email offers 3 ways to add Mailboxes.
You can use Active Directory or Azure Sync, you can import a CSV File or you can add mailboxes
manually.
To minimize incoming email downtime, we recommend that you import all the email mailboxes that
need email flow into Sophos Central before changing your MX records.
It’s also important to note that Sophos Central Email will only forward and receive
emails for mailboxes added in Central.
Make sure all your organization’s mailboxes are added in before changing the DNS records.
If you use Active Directory or Azure, we highly recommend that you use the Sophos AD Sync
or Azure Sync Utility.
This utility allows Central Administrators to implement a service that maps Users and
Groups from Active Directory to Sophos Central.
To learn more about this tool, refer to the documentation link in the description.
If you don’t use Active Directory, then we recommend importing a CSV file. This is
especially useful if you have multiple mailboxes to add.
If you don’t use Active Directory and cannot import a CSV file, then you’ll have to add
mailboxes manually.
We used this method earlier in the video when creating our test mailbox. Refer to that section
again if needed.
Detailed steps for each method are linked in the description.
Regardless of which method you use to import your mailboxes, once that is completed, it’s
now time to change your Mail Exchange (MX) records.
Again, this will cause mail flow interruption, so plan accordingly.
In Sophos Central, go to “Email Security” >> “Settings” >> “Domain Settings/Status”
>> “Configure External Dependencies” >> “Inbound Settings“
Make sure to use the MX record for your specific Sophos Central account found here. If you
use MX records for a different region, your email traffic will not be accepted.
Copy the records and go to your DNS provider. Change those MX records to point to Sophos
Central.
Note: only keep the Sophos Central MX Records. If you keep any other MX records, some mail
may not flow through your Central Email Gateway, exposing you to spam and other threats.
To confirm if your MX records have been updated, perform a public MX record lookup. There are
various tools available online and we will use mxtoolbox.com here.
Lookup your domain.
If your MX records have propagated, you’ll see the new records in the list.
Once your MX records have propagated, you can now test the Inbound Email flow.
Go to a Public email provider and send a message to the test mailbox previously created in
Sophos Central.
To confirm if the email traversed Central Email, you can check by navigating to “Logs
& Reports” >> “Message History”
Note: Due to the logging process, in some situations, you may see an email appear in
your mailbox but not in Central. To confirm the email came from Central you can open its
details and search for the Sophos delivery IP string “hydra.sophos.com”.
Again, the specific string will differ depending on which region the account is located but
this part will persist.
For an added layer of email security, we highly recommend you restrict delivery of emails
to only Sophos Delivery IPs. This will ensure emails cannot bypass Sophos Central Email
and must be processed and scanned by Sophos first.
To do this, you need to create a Receive Connector in Exchange
Go to:
“Mail Flow” >> “Receive Connectors” >> select your Client Frontend
Then go to “Scoping”.
Under Remote Network settings, add the Sophos Delivery IPs assigned to your region. These
IPs can be found in Sophos Central under the “Configure External Dependencies” setting
we showed earlier.
If your Mail Flow is more complex, please use caution when making any changes.
So that covers the configuration steps for Sophos Email via Gateway Mode. The rest of
this series covers Policy Configuration and Configuration via Mailflow Mode.
I hope you found this useful!
Let us know by giving us a thumbs up on Techvids and let us know if we resolved your
issue.
Links to the documentation and other videos in this series can be found in the description.
For further assistance, view and post questions on community.sophos.com.
And go to techvids.sophos.com for more great videos like this one!
Thanks for watching!