Exchange Online and hybrid
mail flow, reviewed.
We review how mail moves in and out of your Exchange Online and hybrid environment, and what to do about any remaining Exchange 2016 or 2019 servers, using exports you choose to share, and give you a written report of risks, clutter and next steps.
Who it is for
Organisations with Exchange Online, or a hybrid with on-premises Exchange, that have inherited connectors and mail flow rules, share mailboxes widely, or still run Exchange Server 2016 or 2019 and need a plan for what comes next.
What we review
- Exchange Server 2016 and 2019 exit planning. Microsoft’s lifecycle pages list an extended end date of October 2025 for both versions, so both are now out of support. The report sets out your options: complete the migration to Exchange Online; upgrade to Exchange Server Subscription Edition (Microsoft documents an in-place upgrade from Exchange 2019 CU14 or CU15, and a legacy upgrade path); or, where Microsoft’s guidance allows, keep a server for recipient management only. Check current Microsoft guidance.
- Connectors. inbound and outbound connectors and their purpose (on-premises mail flow, partner restrictions, relay from devices and applications), and how each limits its sources, for example by TLS or IP address.
- Mail flow rules. inventory, priority order and purpose of transport rules, rules that reject, delete, redirect or add recipients, broad conditions, and rules nobody can explain.
- Accepted domains and authentication. accepted domains, MX records and how SPF, DKIM and DMARC line up with the services that send as you.
- Shared mailboxes. who holds Full Access and Send As permissions on each shared mailbox, and whether each has a named owner.
- Hybrid configuration. the state of the hybrid configuration, where hybrid is in use.
- Mailbox migrations. migration batches and move requests, the migration method in use, large items and recurring failures in the reports you share.
- Forwarding and inbox rules. external forwarding settings and the policy behind them, and how suspicious inbox rules would be found.
- SMTP submission from devices and applications. how scanners, line-of-business apps and relays send mail, for example through a connector, and which authentication each uses. Check current Microsoft documentation.
- Auditing and retention basics. whether mailbox auditing and message trace data are available and for how long.
What you get
A written report, delivered through the channel agreed in the quote. It contains:
- An executive summary in plain language
- A mail flow map of inbound, outbound and internal paths as found
- Findings with severity and the evidence behind each one
- An Exchange 2016/2019 exit options summary
- A fix-first list, a 30/60/90-day plan, and a list of what was not checked
See the format in the fictional report sample (sample, fictional data).
What we need from you
- A named contact with authority over Exchange Online
- Exports or screenshots of connectors, transport rules, accepted domains, migration reports and shared mailbox permissions named in the scope
- Details of any remaining on-premises Exchange servers, including version and role
How it works
- Send an enquiry. Tell us the question. Keep credentials and customer data out of it.
- Agree the written scope. We propose scope, fee and timing in writing. Nothing starts until both sides accept it.
- We review what you choose to share. We read only the exports and screenshots in the agreed scope. We do not read mailbox content or sign in to your tenant or servers.
- You get a written report. It says what was checked, what was not, and suggested next steps.
- Any change is approved separately. A report does not authorize changes; anything that changes needs its own written approval.
See what the report looks like: Read a fictional report sample (sample, fictional data). How we handle your information: Trust and data handling.
What we need from you. A named contact with authority, and a small set of evidence you choose to share through a channel we agree in writing first. Please do not send credentials, access tokens or customer exports through the enquiry form.
What we do not do. We do not read mailboxes, sign in to Exchange, change connectors or rules, move mailboxes or decommission servers. We give no deliverability guarantee.
What needs separate approval. Any change to connectors, mail flow rules or DNS, any mailbox migration, and any decommissioning of an Exchange server.
Questions before an enquiry
Are Exchange 2016 and 2019 still supported?
Microsoft’s lifecycle pages list an extended end date of October 2025 for both, so they are out of support. Check the current Microsoft lifecycle pages for terms and options.
Do we need to keep an Exchange server after migrating?
Microsoft documents a case where an on-premises server is kept for recipient management only, and separate guidance for shutting it down. Whether you can remove yours depends on how you manage recipients. Check current Microsoft guidance before deciding.
Will you read our mail?
No. We never need mailbox content. We review configuration exports and migration reports.
Will you migrate our mailboxes?
No. This is a review. A migration needs its own scope; see the workspace migration planning page for planning-only work.
How does this relate to the email authentication review?
That review looks at SPF, DKIM, DMARC and one test message for one domain. This review looks at the Exchange configuration behind your mail flow.
Free tools, reading and vendor documentation
- Email domain health score (free)
- Email and domain DNS checker (free)
- Microsoft 365 mail flow troubleshooting
- Enhanced filtering for connectors
- Exchange Server on Windows Server 2016
- Exchange cutover migration
- Exchange inbox rule investigation
Microsoft documentation (opens in a new tab). Product behaviour and licensing change, so check current Microsoft documentation before acting:
Ready to start?
Tell us what you need. We reply to confirm fit and to propose scope, fee and timing in writing.