--- title: Email Connector TLS Exception description: "This guide will establish the necessary steps required to create a TLS bypass for a trusted organization whose email servers do not allow TLS encryption. \nAdditionally, there will be the inclusion of known errors that could encountered." --- [Skip to content](https://knowledge.sittadel.com/email-connector-tls-exception#main-content) [![Sittadel-Logo-Icon-Slim-Large-Square-Green-Transparent copy](https://knowledge.sittadel.com/hs-fs/hubfs/Sittadel-Logo-Icon-Slim-Large-Square-Green-Transparent%20copy.png?width=55&height=55&name=Sittadel-Logo-Icon-Slim-Large-Square-Green-Transparent%20copy.png)](https://sittadel.com/) - [About Sittadel](https://sittadel.com/about/) - [Capabilities](https://sittadel.com/capabilities/microsoft-office365-azure-security/) Show submenu for Capabilities - [Microsoft Security Architecture](https://sittadel.com/capabilities/microsoft-office365-azure-security/) - [Detection & Response](https://sittadel.com/capabilities/managed-detection-and-response/) - [Employee Training](https://sittadel.com/capabilities/security-awareness-training/) - [Security Risk Advisors](https://sittadel.com/capabilities/virtual-information-security-officer/) - [Resources](https://sittadel.com/resources/) - [Knowledge Base](https://knowledge.sittadel.com/) Open main navigation Close main navigation - [About Sittadel](https://sittadel.com/about/) - [Capabilities](https://sittadel.com/capabilities/microsoft-office365-azure-security/) Show submenu for Capabilities - [Microsoft Security Architecture](https://sittadel.com/capabilities/microsoft-office365-azure-security/) - [Detection & Response](https://sittadel.com/capabilities/managed-detection-and-response/) - [Employee Training](https://sittadel.com/capabilities/security-awareness-training/) - [Security Risk Advisors](https://sittadel.com/capabilities/virtual-information-security-officer/) - [Resources](https://sittadel.com/resources/) - [Knowledge Base](https://knowledge.sittadel.com/) - [Get Sittadel](https://sittadel.com/start/) [Get Sittadel](https://sittadel.com/start/) Find answers to your security questions. - There are no suggestions because the search field is empty. 1. [Sittadel Knowledge Base](https://knowledge.sittadel.com/?hsLang=en) 2. [Azure Portals](https://knowledge.sittadel.com/azure-portals?hsLang=en) 3. [Exchange Admin Center](https://knowledge.sittadel.com/azure-portals?hsLang=en#exchange-admin-center) # Email Connector TLS Exception ## This guide will establish the necessary steps required to create a TLS bypass for a trusted organization whose email servers do not allow TLS encryption. Additionally, there will be the inclusion of known errors that could encountered. ### **![](https://knowledge.sittadel.com/hs-fs/hubfs/image-png-Jan-19-2024-04-04-16-2156-PM.png?width=125&height=133&name=image-png-Jan-19-2024-04-04-16-2156-PM.png)Role Requirements** Procedure Scope: **Administrators** Required Group Membership: **Admin.Security** **![](https://knowledge.sittadel.com/hs-fs/hubfs/image-png-Jan-19-2024-04-29-09-3760-PM.png?width=670&height=5&name=image-png-Jan-19-2024-04-29-09-3760-PM.png)** **Configuring a TLS Bypass** 1. Access the [Connections – Exchange Admin Center](https://admin.exchange.microsoft.com/#/connectors) portal. Select **Add a connector,** a pop out will be displayed where you will have to specify direction of the traffic. We will need to configure a bi-directional allowance so we will start with configuring an **Outbound Rule.** **![](https://knowledge.sittadel.com/hs-fs/hubfs/image-png-Apr-29-2024-08-02-03-2840-PM.png?width=670&height=356&name=image-png-Apr-29-2024-08-02-03-2840-PM.png)** 2. For an **Outbound Rule** configuration, specify the **Connection From** as **Office 365** and the **Connection to** as **Partner Organization**, this will specify the connection from **Outlook servers** to your **Partners Mail servers**. Select **Next** to continue. **![](https://knowledge.sittadel.com/hs-fs/hubfs/image-png-Apr-29-2024-08-02-36-5479-PM.png?width=670&height=356&name=image-png-Apr-29-2024-08-02-36-5479-PM.png)** 3. You will be asked to supply a **Name** and **Description;** these fields should point to the organization that the TLS bypass is being created for. **Name** should follow the format of **Outbound TLS Bypass for \[Company Domain\], Description** should allude to the **Creation of this rule is for unencrypted emails to be received by \[Company Domain\].** We will want to enable this **Connector** once it has been generated, this is achieved by checking the box next to **Turn it on.** Select **Next** to proceed. **![](https://knowledge.sittadel.com/hs-fs/hubfs/image-png-Apr-29-2024-08-03-21-1811-PM.png?width=670&height=359&name=image-png-Apr-29-2024-08-03-21-1811-PM.png)** 4. We will need to specify the **Use of the connector,** outlining the specific domains that it should enforce the **TLS Bypass** for since we do not want to remove the encryption enforcement on all mail sent from our domain to others. Select **Only when email messages are sent to these domains**, specify the **desired domains** within the provided field and select the **Plus** button to finalize the additions. Select **Next** to continue. **![](https://knowledge.sittadel.com/hs-fs/hubfs/image-png-Apr-29-2024-08-05-36-2839-PM.png?width=670&height=357&name=image-png-Apr-29-2024-08-05-36-2839-PM.png)** 5. You will be asked to specify **Routing** of the emails from Outlook to your Partners Mail servers, utilizing the existing records assigned by the partners domain is usually sufficient. Select **Use the MX record associated with the partner’s domain** and continue by selecting **Next**. **![](https://knowledge.sittadel.com/hs-fs/hubfs/image-png-Apr-29-2024-08-07-00-5791-PM.png?width=670&height=356&name=image-png-Apr-29-2024-08-07-00-5791-PM.png)** 6. We will need to remove **Security restrictions** that could be placed on the desired domain. Make sure to uncheck **Always use TLS to secure the connection** since this has been identified to not be supported from the partner organizations mail servers. Select **Next** to continue. **![](https://knowledge.sittadel.com/hs-fs/hubfs/image-png-Apr-29-2024-08-07-17-6413-PM.png?width=670&height=356&name=image-png-Apr-29-2024-08-07-17-6413-PM.png)** 7. The final step before reviewing the configuration of the connector involves sending a verification email to a live mailbox for the desired domain. Specify an address that you have verified has an active mailbox in the provided field followed by selecting the **Plus** button and hitting the **Validate** button, failure to provide an address with an active mailbox will result in a validation error and you will not be allowed to proceed through to the finalization process. Once validation has been fulfilled, select **Next** to proceed. **![](https://knowledge.sittadel.com/hs-fs/hubfs/image-png-Apr-29-2024-08-10-02-1345-PM.png?width=670&height=358&name=image-png-Apr-29-2024-08-10-02-1345-PM.png)** 8. To finalize the **Outbound TLS bypass,** verify that all the fields listed under the **Review connector** page are correct, if a misconfiguration is detected select the necessary **Edit** hyperlink under the section. Once reviewed select **Create connector** to finalize the **Outbound bypass.** **![](https://knowledge.sittadel.com/hs-fs/hubfs/image-png-Apr-29-2024-08-15-04-3954-PM.png?width=670&height=356&name=image-png-Apr-29-2024-08-15-04-3954-PM.png)** 9. When created select **Done** to return to the main page. We will now be configuring an **Inbound Rule**. Start by selecting **Add a connector,** from the **New connector** popup we will specify the **Connection from** as **Partner Organization** the default **Connection to** will be **Office 365.** This will specify communication from your Partners mail servers to internal Outlook mail servers. Select **Next** to proceed. **![](https://knowledge.sittadel.com/hs-fs/hubfs/image-png-Apr-29-2024-08-16-01-1877-PM.png?width=670&height=357&name=image-png-Apr-29-2024-08-16-01-1877-PM.png)** 10. You will be asked to supply a **Name** and **Description;** these fields should point to the organization that the TLS bypass is being created for. **Name** should follow the format of **Inbound TLS Bypass for \[Company Domain\], Description** should allude to the **Creation of this rule is for unencrypted emails to be received by \[Company Domain\].** We will want to enable this **Connector** once it has been generated, this is achieved by checking the box next to **Turn it on.** Select **Next** to proceed. **![](https://knowledge.sittadel.com/hs-fs/hubfs/image-png-Apr-29-2024-08-18-05-5226-PM.png?width=670&height=357&name=image-png-Apr-29-2024-08-18-05-5226-PM.png)** 11. We will need to **Authenticate sent mail** received by the partner domain**,** outlining the specific domains that it should enforce the **TLS Bypass** for since we do not want to remove the encryption enforcement on all mail received by the internal Outlook server. Select **By verifying that the sender domain matches one of the following domains**, specify the **desired domains** within the provided field and select the **Plus** button to finalize the additions. Select **Next** to continue. **![](https://knowledge.sittadel.com/hs-fs/hubfs/image-png-Apr-29-2024-08-18-49-8220-PM.png?width=670&height=356&name=image-png-Apr-29-2024-08-18-49-8220-PM.png)** 12. We will need to remove **Security restrictions** that could be placed on the desired domain. Make sure to uncheck **Reject email messages if they aren’t sent over TLS** since this has been identified to not be supported from the partner organizations mail servers. Select **Next** to continue. **![](https://knowledge.sittadel.com/hs-fs/hubfs/image-png-Apr-29-2024-08-19-04-7075-PM.png?width=670&height=356&name=image-png-Apr-29-2024-08-19-04-7075-PM.png)** 13. To finalize the **Inbound TLS bypass,** verify that all the fields listed under the **Review connector** page are correct, if a misconfiguration is detected select the necessary **Edit** hyperlink under the section. Once reviewed select **Create connector** to finalize the **Inbound bypass.** **![](https://knowledge.sittadel.com/hs-fs/hubfs/image-png-Apr-29-2024-08-19-41-4712-PM.png?width=670&height=356&name=image-png-Apr-29-2024-08-19-41-4712-PM.png)** 14. When created select **Done** to return to the main page and finalize the bi-directional **TLS Bypass** process. ### **Error Handling Based on User Feedback** The following list includes screen captures of **Errors** that could impact **Internal** or **External Users** mail flow behavior either due to process break down or configuration constraints as well as possible ways to hotfix the issue. 1. **NDR(s)** – While there are a multitude of codes that can associated with a **TLS** failure, the most common occurrences from **Internal Users** failing **TLS** comes from internal mail flowing towards an external server that does not support **TLS,** an **External User** failing **TLS** will not show up within the tenant since the mail has been **rejected** however, they will receive a **NDR** that should then be supplied to the intended recipient**.** **Exchange Message Trace** can be utilized to detect **Internal Users** who have had mail delivery failures, **External Users** will most likely inform their recipient with a generated **NDR** or a message detailing that they received a bounce back message that informed them that their mail had been blocked. Depending on the necessity of having an open line of communication with that partner will impact whether you deploy the **TLS Bypass** or not. **Management will need to make the final decision on whether or not they want to accept the risk of having unencrypted mail being sent over the internet.** **![](https://knowledge.sittadel.com/hs-fs/hubfs/image-png-Apr-29-2024-08-22-08-1545-PM.png?width=527&height=580&name=image-png-Apr-29-2024-08-22-08-1545-PM.png)** 2. How to alleviate this issue: 1. Follow the steps listed in the **Configuring a TLS Bypass** section above to alleviate the error impacting the users. 3. **Phantom Message Trace or Quarantine Search** – If you ever receive messages from an **Internal User** that has not received a message and both the **Exchange Message trace** and **Quarantine Queue** are showing no mail ever being received or held from the designated sender or domain, this is likely the cause of a server-to-server communication failure which is related to **TLS** enforcement being enabled. 1. Follow the steps listed in the **Configuring a TLS Bypass** section above to alleviate the error impacting the users. ### Need Assistance? Reach out to your Customer Success Manager to discuss how a Sittadel cybersecurity analyst can assist in managing these tasks for you. New to our services? [Inquire](https://sittadel.com/start/) about arranging a consultation to explore optimizing your Azure environment for painless management. - [UserOps](https://knowledge.sittadel.com/userops?hsLang=en#main-content) - [Access & Permissions](https://knowledge.sittadel.com/userops?hsLang=en#access-permissions) - [Account](https://knowledge.sittadel.com/userops?hsLang=en#account) - [Devices](https://knowledge.sittadel.com/userops?hsLang=en#devices) - [Document Sharing](https://knowledge.sittadel.com/userops?hsLang=en#document-sharing) - [Email](https://knowledge.sittadel.com/userops?hsLang=en#email) - [Requests](https://knowledge.sittadel.com/userops?hsLang=en#requests) - [Troubleshoot](https://knowledge.sittadel.com/userops?hsLang=en#troubleshoot) - [TechOps](https://knowledge.sittadel.com/techops?hsLang=en#main-content) - [Tenant Foundations](https://knowledge.sittadel.com/techops?hsLang=en#tenant-foundations) - [Collaboration Security](https://knowledge.sittadel.com/techops?hsLang=en#collaboration-security) - [Email Security](https://knowledge.sittadel.com/techops?hsLang=en#email-security) - [Device Security](https://knowledge.sittadel.com/techops?hsLang=en#device-security) - [Identity Security](https://knowledge.sittadel.com/techops?hsLang=en#identity-security) - [SecOps](https://knowledge.sittadel.com/secops?hsLang=en#main-content) - [Email SOC](https://knowledge.sittadel.com/secops?hsLang=en#email-soc) - [Identity SOC](https://knowledge.sittadel.com/secops?hsLang=en#identity-soc) - [Tenant SOC](https://knowledge.sittadel.com/secops?hsLang=en#tenant-soc) - [Device SOC](https://knowledge.sittadel.com/secops?hsLang=en#device-soc) - [Deploy Intune](https://knowledge.sittadel.com/deploy-intune?hsLang=en) - [Deploy MDE](https://knowledge.sittadel.com/deploy-mde?hsLang=en#main-content) - [Overview](https://knowledge.sittadel.com/deploy-mde?hsLang=en#overview) - [Intune Deployment](https://knowledge.sittadel.com/deploy-mde?hsLang=en#intune-deployment) - [Hands-On Deployment](https://knowledge.sittadel.com/deploy-mde?hsLang=en#hands-on-deployment) - [Azure Arc Deployment](https://knowledge.sittadel.com/deploy-mde?hsLang=en#azure-arc-deployment) - [RMM Tool Deployment](https://knowledge.sittadel.com/deploy-mde?hsLang=en#rmm-tool-deployment) - [MECM/SCCM Deployment](https://knowledge.sittadel.com/deploy-mde?hsLang=en#mecm-sccm-deployment) - [GPO Deployment](https://knowledge.sittadel.com/deploy-mde?hsLang=en#gpo-deployment) - [Deploy Services](https://knowledge.sittadel.com/deploy-services?hsLang=en#main-content) - [Cloud Enclave](https://knowledge.sittadel.com/deploy-services?hsLang=en#cloud-enclave) - [Azure Portals](https://knowledge.sittadel.com/azure-portals?hsLang=en#main-content) - [Entra ID](https://knowledge.sittadel.com/azure-portals?hsLang=en#entra-id) - [Intune](https://knowledge.sittadel.com/azure-portals?hsLang=en#intune) - [Defender](https://knowledge.sittadel.com/azure-portals?hsLang=en#defender) - [Purview](https://knowledge.sittadel.com/azure-portals?hsLang=en#purview) - [SharePoint Admin Center](https://knowledge.sittadel.com/azure-portals?hsLang=en#sharepoint-admin-center) - [Teams Admin Center](https://knowledge.sittadel.com/azure-portals?hsLang=en#teams-admin-center) - [Admin Center](https://knowledge.sittadel.com/azure-portals?hsLang=en#admin-center) - [Exchange Admin Center](https://knowledge.sittadel.com/azure-portals?hsLang=en#exchange-admin-center) [![](https://knowledge.sittadel.com/hs-fs/hubfs/Sittadel_LogoH_Color_BlackText.png?width=186&height=55&name=Sittadel_LogoH_Color_BlackText.png)](https://Sittadel.com) Security for Humans. Copyright © 2026, Sittadel