When a connector actually applies
Outbound: a connector is selected when its scope matches — by recipient domain (route contoso-partner.com via their smart host) or for all internet mail (route EVERYTHING via a filtering service). No matching connector = default direct-to-MX delivery, which is the correct state for most tenants.
Inbound: connectors don't 'receive' in the intuitive sense — inbound mail arrives regardless; an inbound connector IDENTIFIES a source (partner cert/IP) to apply treatment: TLS enforcement, skipping some filtering as trusted, or accepting relay from your devices/apps (the OnPremises type for hybrid, Partner type for others).
The two headline scenarios:
- Third-party filtering in front (Mimecast/Proofpoint era): MX points at the filter, filter forwards to EXO. MANDATORY companion: Enhanced Filtering for Connectors (skip-listing the filter's IPs) so EOP reads the TRUE source IP — without it, every message 'comes from' the filter's IPs: SPF evaluates wrongly, spoof intelligence goes blind, and the protection stack grades the postman instead of the sender. Half of 'EOP is useless' complaints in filtered estates are this misconfiguration.
- Device/app relay: printers and LOB apps sending via a certificate/IP-scoped inbound connector — the pattern that competes with SMTP AUTH (retirements concept) and inherits its own hygiene duties (scoped IPs, TLS, no open relay).
Failure signatures
| Symptom | Cause |
|---|---|
| Outbound to ONE domain fails/behaves oddly | A forgotten domain-scoped connector (check scope before blaming the recipient) |
| Everything inbound marked spam after adding a filter service | Enhanced Filtering not configured — EOP sees the filter as sender |
| Partner TLS mail bouncing | Connector's certificate requirements vs what the partner actually presents |
| Devices suddenly can't relay | Connector IP scope vs the device VLAN's new egress IP |
| Hybrid mail loops | Connector + centralized-transport misconfig (hybrid module) |
What to watch (proofs)
- The inventory: Get-InboundConnector / Get-OutboundConnector | fl — scope, TLS settings, enabled state. Most tenants should read SHORT; every entry needs an owner and a reason.
- Enhanced Filtering state: the skip-list configuration vs the filter's current published IPs — vendors change ranges; stale lists re-blind EOP quietly.
- Which connector a message used: message-trace detail names the connector on send/receive events — the routing dispute ender.
- Certificate runway on partner connectors: TLS cert expiry on both ends — the Teams DR lesson (renewal-day outages) applies verbatim.