What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
There is no evidence-based universal winner between Microsoft Defender for Office 365 and third-party email security gateways. The practical decision is architectural: whether Microsoft 365 should receive mail directly, whether a gateway should inspect mail before Exchange Online, or whether messages should leave Microsoft 365 and return after inspection. Microsoft recommends pointing MX records directly to Microsoft 365 to reduce complexity. A gateway in front can be supported when connectors, source-IP preservation and authentication handling are configured correctly; in-and-out routing introduces documented reporting, authentication and detection problems.
Choose the design that preserves the original sender context, gives your security team one understandable investigation path and meets your regulatory or operational requirements. Do not claim a detection-rate advantage for either approach without independent testing: the official guidance does not provide a vendor-neutral efficacy, false-positive or total-cost comparison.
As an Amazon Associate I earn from qualifying purchases.
What you are actually comparing
Microsoft Defender for Office 365 is Microsoft 365’s integrated email-security layer. A third-party gateway is an additional service that may filter mail before Exchange Online, scan messages after delivery through Microsoft Graph, or receive messages after they have already entered Microsoft 365. Those are different mail-flow architectures, not interchangeable products.
Recommended Free Tools
The MX record determines the first service that receives inbound mail. Connectors, authentication headers, ARC (Authenticated Received Chain), link rewriting and quarantine workflows then determine what the next service can see and trust. A design that looks like “two filters” on a diagram can behave very differently depending on whether the second system sees the original sender IP, the original authentication results and an unmodified message.
#1 Best Overall
- Fortinet FortiMail-VM virtual appliance for all supported platforms. 8 x vCPU cores
- Fortinet SW FML-VM08
- Manufacturer Part: FML-VM08
Microsoft’s integration guidance states that “No matter how many layers of email protection exist, total protection never reaches 100 percent.” The useful question is therefore not which logo is better, but which combination gives your organization acceptable risk, traceability and operational effort.
Decision summary
| Deployment choice | Inbound mail path | Microsoft’s documented position | Main strengths | Main risks or costs |
|---|---|---|---|---|
| Microsoft 365 first | Sender → Microsoft 365 MX → Exchange Online mailboxes | Recommended to reduce complexity | Shortest path; native reporting, policy and investigation context | May not satisfy a requirement for an independent gateway or specialized workflow |
| Third-party gateway before Exchange Online | Sender → gateway MX → connector → Microsoft 365 | Supported when configured with Enhanced Filtering for Connectors | Gateway inspection before delivery while Microsoft protection remains available | Extra service cost, DNS and connector maintenance, duplicate actions and quarantine coordination |
| Post-delivery Graph scanning | Sender → Microsoft 365 → mailbox → Graph-based service inspection | Possible, but review permissions and operating practices | Can remove or remediate messages after delivery | Usually requires full mailbox access; malicious mail may briefly reach a mailbox |
| In-and-out routing | Sender → Microsoft 365 → third party → Microsoft 365 again | Documented complications; Enhanced Filtering for Connectors is not designed for it | May fit a pre-existing inspection workflow | Double reporting, authentication failures, spoofing false positives and weaker machine-learning context |
Option 1: Put a third-party gateway before Exchange Online
In the front-door design, your public MX record points to the third-party service. The service filters inbound mail and forwards accepted messages to Exchange Online through an inbound connector. Microsoft calls Enhanced Filtering for Connectors (also known as skip listing) the supported mechanism for telling Microsoft 365 which upstream addresses belong to the original sender and which belong to the gateway.
Without enhanced filtering, Microsoft 365 can see the gateway as the connecting source. That can obscure the originating IP address and distort source reputation, anti-spoofing, anti-phishing, authentication and investigation data. With it, Microsoft 365 can use the original sender context while still applying its own controls. See Microsoft’s guidance on integrating non-Microsoft security services with Microsoft 365 and Enhanced Filtering for Connectors.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →What this topology preserves
- The gateway can reject obvious spam or malware before a mailbox receives it.
- Microsoft 365 can continue applying its own anti-spam, anti-malware, anti-phishing, investigation and remediation features.
- Original sender information can remain available for reputation and authentication decisions when the connector is configured correctly.
- ARC can preserve authentication results as a message crosses an intermediary, provided the gateway supports ARC and is configured to seal or validate it appropriately.
What it adds
- A second policy engine can increase false positives or produce conflicting actions.
- Users may have to understand two quarantine portals, release processes or notification formats.
- DNS, connectors, certificates, allowlists, routing rules and vendor changes become part of your operating burden.
- Security operations must correlate traces and alerts across both systems.
- You pay for the additional service even though Microsoft 365 protection remains enabled.
Option 2: Scan after delivery through Microsoft Graph
Some services connect through Microsoft Graph, inspect messages after Exchange Online has delivered them and remove items later judged malicious or unwanted. This is operationally different from an MX gateway: the message has crossed the Microsoft 365 delivery boundary before the external service acts.
Microsoft cautions that this integration typically requires granting the service full mailbox access. Evaluate the exact application permissions, whether access is tenant-wide or limited to selected mailboxes, how credentials and tokens are protected, what support staff can access, and how quickly revocation works. Require documented retention and audit behavior for message content and attachments.
Rank #2
- Watchguard T145 Firebox with 3 Year Basic Security Suite License (WGT145033) - The Firebox T145 delivers enterprise-grade protection for branch offices and retail sites. With a blend of 2.5Gb, 1Gb, and SFP/SFP+ ports, it supports high throughput, AI-driven malware protection, and DNS filtering for robust network defense.
- The Basic Security Suite activates core protections on your Firebox, including intrusion prevention, gateway antivirus, URL filtering, and spam blocking in WatchGuard Cloud. Upgrade to Total Security Suite to add AI-powered malware detection, cloud sandboxing, DNS filtering, and advanced correlation.
- The Basic Security Suite equips your WatchGuard Firebox with a robust set of foundational security tools. This bundle delivers intrusion prevention, gateway antivirus, URL filtering, and spam blocking, all managed through WatchGuard Cloud. It’s a cost-effective choice for organizations that need reliable, essential protection without unnecessary extras.
- Interfaces and deployment: 2.5Gb and 1Gb Ethernet with SFP or SFP+ fiber for clean aggregation and segmented backhaul at the edge.
- Performance and scale: UTM up to 710 Mbps with inspection on; flexible VPN topologies for hub and spoke or mesh designs.
Graph scanning can be useful when a service’s remediation workflow is important or when changing MX records is impractical. It should not be described as equivalent to blocking a message before delivery. Define the acceptable exposure window, alerting requirements and rollback procedure before enabling it.
Option 3: Send mail out of Microsoft 365 and back in
In-and-out routing leaves MX pointed at Microsoft 365, sends messages to a third party for inspection and then returns them to Microsoft 365. Microsoft explicitly warns that returning messages are treated as new messages. Its guidance states: “Enhanced Filtering for Connectors doesn’t work with in-and-out mail routing, where mail leaves and re-enters Microsoft 365.”
Operational consequences
- Duplicate reporting: message trace and reporting can count the same logical message twice.
- Authentication failures: SPF, DKIM or DMARC evaluation can change after the second handoff; Microsoft 365 may treat the returned message as spoofing.
- Reduced detection context: if the intermediary changes or removes source IP, headers or content, Defender machine-learning and investigation features have less reliable data.
- Policy ambiguity: a message can be acted on by Microsoft 365 before the external scan, then acted on again when it returns.
- Harder incident response: investigators must reconstruct two message identities and two sets of timestamps.
Use this pattern only when its trade-offs are explicitly accepted and tested. Do not assume Enhanced Filtering for Connectors will restore the original context in this topology.
How Microsoft recommends configuring a front-door gateway
The exact portal labels and connector wizard fields can change with the Microsoft 365 service. Use the current tenant documentation and the gateway’s deployment instructions, but preserve the following sequence and design principles.
- Document the intended flow. Draw sender, gateway, Exchange Online, mailbox and outbound paths. Record which system performs anti-spam, malware, URL and attachment inspection, and which system owns quarantine.
- Confirm the gateway’s supported Exchange Online pattern. Obtain its fixed sending IP ranges or authenticated transport requirements. Do not rely on a broad shared allowlist when a narrower connector restriction is available.
- Change inbound MX records deliberately. Point the domain’s MX record to the gateway only after the connector and acceptance path are ready. Record the previous value and DNS TTL so rollback is possible.
- Create and restrict the inbound connector. In the Exchange admin center, configure the connector to accept mail from the gateway using the strongest available identity method, such as certificate or validated source IP. Restrict it to the gateway’s documented ranges and require TLS where supported.
- Enable Enhanced Filtering for Connectors. Configure the connector so Microsoft 365 can identify the original connecting IP and preserve sender context. Microsoft describes this as the recommended approach for a non-Microsoft service in front of Exchange Online.
- Validate ARC support. If the gateway supports ARC, configure and monitor its chain. ARC can carry authentication results through an intermediary, but it does not excuse incorrect SPF, DKIM or DMARC alignment.
- Coordinate URL protection. If Defender Safe Links is enabled, avoid having the gateway rewrite and wrap the same links. Microsoft warns that double wrapping can interfere with link validation, threat detonation and one-time-use links.
- Test before broad cutover. Send messages from known-good and deliberately suspicious test sources. Check headers, Authentication-Results, ARC-Seal and ARC-Authentication-Results, message trace, quarantine ownership, URL behavior and attachment handling.
- Cut over and monitor. Watch rejected mail, false positives, delayed delivery, connector errors, DMARC reports, user release requests and security alerts for at least one complete business cycle. Keep a tested DNS rollback plan.
Do not bypass Microsoft filtering with an SCL -1 rule
A tempting shortcut is to create a mail-flow rule that sets the spam confidence level to -1 for messages from the gateway. Microsoft warns that bypassing spam filtering this way bypasses most cloud email protection controls and can create exposure, particularly when gateway IP addresses are shared or misconfigured.
Microsoft’s policy-precedence guidance recommends considering ARC and Enhanced Filtering for Connectors instead of using an SCL -1 bypass when a non-Microsoft service or device is in front of Microsoft 365. The anti-spam FAQ also states that malware and high-confidence phishing checks cannot be skipped through the spam-bypass mechanism. Read the current recommendations in Order and precedence of email protection and the Anti-spam protection FAQ.
If a gateway requires an exception, scope it to the smallest possible connector, sender set or transport condition, document why it exists and test that malware and high-confidence phishing protections still operate as intended.
Compare the choices on the dimensions that matter
| Question | Microsoft 365 directly | Gateway before Exchange Online | In-and-out routing |
|---|---|---|---|
| Where does MX point? | Microsoft 365 | Third-party gateway | Microsoft 365 |
| Is the path supported by Enhanced Filtering for Connectors? | Not needed for an upstream gateway | Yes, this is the intended scenario | No; Microsoft says the feature does not work for this pattern |
| Who sees the original sender first? | Microsoft 365 | The gateway; Microsoft can recover context through enhanced filtering | Microsoft 365 first, then a modified message may return |
| Can authentication be altered by an intermediary? | Fewer handoffs | Yes; ARC may preserve results if supported | High risk of changed results on re-entry |
| Quarantine experience | One Microsoft 365 workflow | Potentially two workflows | Potentially two workflows plus duplicate events |
| Primary operational burden | Microsoft policy and tenant administration | DNS, connector, gateway policy and cross-system investigation | All of those plus re-entry troubleshooting and duplicate reporting |
Protection overlap: decide who does what
Two products do not automatically create two independent layers of equal value. Write a control-ownership matrix before deployment.
| Control | Questions to answer |
|---|---|
| Spam and bulk mail | Which system assigns the final disposition? Are thresholds consistent, and can a release in one system trigger reprocessing in the other? |
| Malware and attachments | Does each service detonate or sandbox files? What happens when one allows an attachment the other blocks? |
| Phishing and impersonation | Which service evaluates display-name spoofing, domain impersonation and mailbox intelligence? How are duplicate alerts deduplicated? |
| URL protection | Which system rewrites links? How are Safe Links and gateway rewriting prevented from wrapping the same URL twice? |
| Quarantine and release | Where do users request release, who approves it and which service re-scans released mail? |
| Investigation and remediation | Can analysts trace one message across both systems, search original and rewritten identifiers and remove copies consistently? |
Make the matrix part of change control. When a policy changes, record which service now makes the decision and how the other service responds.
Cost, staffing and governance
The additional gateway’s subscription price is only one part of total cost. Include connector and DNS administration, certificate renewal, support contracts, policy tuning, incident-response time, user training, quarantine administration and SIEM or SOAR integration. Microsoft identifies added cost and complexity, increased false positives, confusing multi-quarantine experiences and integration with existing SecOps processes as factors to assess.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteRank #4
- Watchguard T125 Firebox with 1 Year Basic Security Suite License (WGT125031) - The Firebox T125 provides enterprise-grade protection for branch offices and remote sites. Featuring 2.5Gb and 1Gb ports, it delivers fast throughput, advanced malware detection with IntelligentAV, and SD-WAN compatibility in a compact form factor.
- The Basic Security Suite activates core protections on your Firebox, including intrusion prevention, gateway antivirus, URL filtering, and spam blocking in WatchGuard Cloud. Upgrade to Total Security Suite to add AI-powered malware detection, cloud sandboxing, DNS filtering, and advanced correlation.
- The Basic Security Suite equips your WatchGuard Firebox with a robust set of foundational security tools. This bundle delivers intrusion prevention, gateway antivirus, URL filtering, and spam blocking, all managed through WatchGuard Cloud. It’s a cost-effective choice for organizations that need reliable, essential protection without unnecessary extras.
- Interfaces and deployment: 1x 2.5Gb and 4x 1Gb Ethernet to simplify uplinks, carve out segmented zones, and keep branch wiring minimal.
- Performance and scale: UTM up to 510 Mbps with inspection on; sized for small and branch offices with room to grow VPN connectivity.
Governance questions are equally important:
- Does the external service process regulated or confidential message content in an allowed region?
- Who can search, export or release message content?
- How long are messages, attachments, URLs and telemetry retained?
- Can the service provide complete audit logs and evidence during an incident?
- What is the exit plan if the service is unavailable or the contract ends?
- Which team owns a false-positive appeal, and what is the service-level target?
Confirm that your Microsoft 365 license includes the Defender features you intend to use. Feature availability depends on plan and tenant configuration; do not assume that a control described in documentation is included in every edition.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Choose an architecture by scenario
Use Microsoft 365 directly when simplicity is the priority
Point MX to Microsoft 365 when you want the shortest supported path, a single quarantine and native message investigation. This is Microsoft’s recommended default for reducing complexity. It is the sensible baseline for organizations without a documented requirement for an independent gateway.
Use a gateway before Exchange Online when a requirement justifies the extra hop
Choose the front-door pattern when contractual, regulatory, operational or security requirements call for a separate filtering service before Microsoft 365. Make Enhanced Filtering for Connectors, ARC support, strict connector restrictions and a single-owner quarantine process conditions of acceptance.
Use Graph-based post-delivery scanning for remediation use cases
Consider Graph integration when the primary value is mailbox-wide detection and removal after delivery, and your organization accepts the permission scope and exposure window. Limit permissions where possible and review access continuously.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallAvoid in-and-out routing unless you can prove the need
Require a written exception for a design that sends mail out of Microsoft 365 and back in. Test authentication, reporting, machine-learning detections and incident traceability under realistic traffic before approving it.
Best Value
- Watchguard T125 Firebox with 5 Year Basic Security Suite License (WGT125035) - The Firebox T125 provides enterprise-grade protection for branch offices and remote sites. Featuring 2.5Gb and 1Gb ports, it delivers fast throughput, advanced malware detection with IntelligentAV, and SD-WAN compatibility in a compact form factor.
- The Basic Security Suite activates core protections on your Firebox, including intrusion prevention, gateway antivirus, URL filtering, and spam blocking in WatchGuard Cloud. Upgrade to Total Security Suite to add AI-powered malware detection, cloud sandboxing, DNS filtering, and advanced correlation.
- The Basic Security Suite equips your WatchGuard Firebox with a robust set of foundational security tools. This bundle delivers intrusion prevention, gateway antivirus, URL filtering, and spam blocking, all managed through WatchGuard Cloud. It’s a cost-effective choice for organizations that need reliable, essential protection without unnecessary extras.
- Interfaces and deployment: 1x 2.5Gb and 4x 1Gb Ethernet to simplify uplinks, carve out segmented zones, and keep branch wiring minimal.
- Performance and scale: UTM up to 510 Mbps with inspection on; sized for small and branch offices with room to grow VPN connectivity.
Troubleshooting common failures
Messages show the gateway as the sender
Check that Enhanced Filtering for Connectors is enabled on the correct inbound connector and that the gateway forwards the required headers. Verify that the connector’s source ranges match the gateway’s current published ranges. Re-test message trace and the received-header chain after every change.
Legitimate messages fail DMARC after gateway processing
Inspect SPF, DKIM and DMARC results before and after the gateway hop. Check whether the service changes the visible From domain, signs with a different DKIM domain or removes authentication headers. Configure ARC where supported, then validate alignment rather than broadly bypassing spam filtering.
Users receive two quarantine notifications
Assign one service as the user-facing quarantine owner. Disable redundant notifications where policy allows, document the release path and ensure a released message is still scanned by the remaining controls.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Links fail or require multiple clicks
Look for URL rewriting by both the gateway and Defender Safe Links. Microsoft warns that double wrapping can interfere with validation, detonation and one-time-use links. Select one rewriting layer and test links in desktop, mobile and external-recipient scenarios.
Message trace contains duplicate entries
Confirm whether the architecture is in-and-out routing. Returning messages are treated as new messages, so duplicate reporting can be expected. If the duplicate path is not intentional, remove the re-entry route and retest MX, connectors and transport rules.
Defender detections become less reliable after adding the gateway
Compare original and returned headers, source IPs and message bodies. Altered or missing source information can reduce Defender machine-learning and investigation effectiveness. Prefer the supported front-door pattern with enhanced filtering over an undocumented re-entry workaround.
How to validate the design before production
- Test inbound mail from authenticated senders, unauthenticated senders, forwarding services and known bulk senders.
- Verify SPF, DKIM, DMARC and ARC results in raw headers at each hop.
- Submit harmless test samples that exercise spam, phishing, attachment and URL policies; do not use live malware.
- Confirm the expected quarantine, notification and release behavior for both administrator and end user.
- Run message trace and security investigations from the original sender through mailbox delivery or rejection.
- Check SIEM/SOAR events, timestamps, message identifiers and deduplication rules.
- Temporarily disable each service in a controlled test to verify fail-open or fail-closed behavior and document the result.
- Record rollback steps for MX, connectors, transport rules and application permissions, then have a second administrator execute them from the runbook.
Bottom-line recommendation
Start with Microsoft 365 receiving mail directly unless you have a clearly documented reason to add another gateway. If you do place a third-party service in front of Exchange Online, use the supported connector model, enable Enhanced Filtering for Connectors, preserve authentication with ARC when available, avoid duplicate link rewriting and assign clear ownership for quarantine and investigations. Treat Graph scanning as a permission-sensitive post-delivery control, not a pre-delivery replacement. Treat in-and-out routing as an exception because it can create duplicate reporting, authentication failures and weaker detection context.
Free tools Windows power users keep installed
One-click scans. No signup required.
The sources available for this comparison establish Microsoft’s topology and configuration guidance, not an independent performance ranking. Detection rates, false-positive percentages, breach reduction and total cost must be measured in your own environment or by a genuinely independent evaluation.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
