Client using HRDP after adding second mx record to our domain

Hi to all,

we are experiencing major difficulties with message delivery from our clients to us (we use a third-party anti-spam service only for inbound traffic).

Until the change our domain was configured with one mx record (3rd party spam antifilter) second mx record (domain. mail.protection.outlook.com)

The inbound connector was configured as follows: Identify the partner organization by verifying that messages are coming from these domains: * Reject messages if they don't come from within these IP address ranges: (ip of the spam antifileter)

The transport rule was configured as follows: Apply this rule if sender IP addresses belong to one of these ranges (ip of the antispam) Do the following Set the spam confidence level (SCL) to '-1'

We have NEVER had enhanced filtering (skip listing) enabled.

After adding the second MX record (pointing to our anti-spam service) We modified the inbound connector and the transport rule by adding the IP address associated with the new MX record.

Since modifying the DNS, we have been seeing a large number of emails rejected due to SPF failures on our antispam service portal. This occurs because the user is sending from a Microsoft IP that is not included in the spf.protection.outlook.com SPF record (the IP likely belongs to a high-risk pool or relay pool).

Is that possible that Microsoft routes emails from these senders through this specific pool because it detects that the recipient (us) has made configuration changes?

Thanks to all