Hybrid Email with Microsoft 365 and Mailcow: Complete Guide + Checklist

Why a Mailcow + Microsoft 365 hybrid setup is better than the classic approach

In today’s business world, email isn’t just a tool—it’s the backbone of communication. Companies often face a dilemma: full control and flexibility with their own mail server like Mailcow, or the security, reliability, and top deliverability of cloud giants like Microsoft 365?

Why not combine the best of both worlds?

Microsoft 365 (Exchange Online Protection) acts as a powerful gateway for all email traffic, filtering spam and threats and ensuring a spotless sender reputation.

Mailcow serves as a reliable, cost-effective mailbox store for all mailboxes and gives you full data sovereignty on your own server.

Why is the hybrid system the ideal solution?

This approach offers unique advantages, especially for European—and particularly German—companies.

1. GDPR compliance and data control 
   For many companies in Germany and the EU, storing data on local servers is not just a preference but a legal requirement (GDPR). In our hybrid model, Microsoft 365 serves only as a transit hub—it filters and forwards emails but does not store them. All messages, contacts, and calendars reside physically on your Mailcow server, either with your hosting provider or on your company premises, ensuring full data sovereignty and GDPR compliance.
   
   
2. Cost efficiency
   You don’t need to buy expensive Microsoft 365 licenses for every employee. A basic license with Exchange Online Protection (EOP) is enough to handle all email traffic. The mailboxes themselves are created in Mailcow, which significantly reduces monthly costs.
   
   
3. World-class security
   You get access to Microsoft Exchange Online Protection—one of the best filters in the world for protecting against spam, phishing, and malware. All incoming and outgoing emails pass through this reliable system.
   
   
4. Maximum deliverability
   Emails sent via Microsoft servers—using their IP addresses and flawless DKIM—reliably land in the inbox instead of the spam folder.

Hybrid architecture and benefits

Diagram:

Internet → Microsoft 365 (EOP, inbound filtering) → Mailcow (mailboxes) → Microsoft 365 (EOP, outbound filtering) → Internet

Benefits:

• GDPR & control — Emails are stored in Mailcow in your country or on-premises.
• Cost savings — A basic Microsoft 365 license with EOP is sufficient.
• Deliverability — Sending via Microsoft IPs with DKIM.
• Security — Microsoft-grade protection for both inbound and outbound mail.

Step 1: DNS configuration

All DNS records in Cloudflare (or another DNS provider) should be set to “DNS only” (grey cloud).

💡 Metzler IT tip: Don’t include IPv6 in SPF if it isn’t actively used.

Step 2: Microsoft 365 - Gateway Setup

2.1. Add the domain

• Verify the domain in Microsoft 365.
• In the EAC → Mail flow → Accepted domains → set it to Internal relay. ​

2.2. Connectoren

Inbound: ​

• Type: Microsoft 365 → Mailcow
• Smart Host: mail.example.com
• Require TLS, verify the certificate CN.

Outbound:

• Type: Mailcow → Microsoft 365
• Authenticate via IPv4 (203.0.113.10).
• IPv6 is not supported.

Fix for error 550 5.7.64 Relay Access Denied:

In Mailcow → extra.cf: smtp_address_preference = ipv4

Restart Postfix: docker restart mailcowdockerized-postfix-mailcow-1

2.3. DKIM in Microsoft 365

• Enable DKIM in the Defender portal.
• Publish the selector1 and selector2 CNAME records in DNS.

Step 3: Mailcow as the central mailbox store.

3.1. Outbound mail flow via EOP.

In Routing → Sender-dependent transports: example.com → example-com.mail.protection.outlook.com:25

3.2. DKIM

It’s better to disable DKIM in Mailcow and use only Microsoft signatures.

Alternatively, enable dual signing and publish the TXT key.

3.3. Reputation improvement.

In extra.cf:

myhostname = mail.example.com

smtpd_banner = $myhostname ESMTP

smtp_helo_name = $myhostname

Step 4: Fine-tuning in Microsoft 365.

4.1. Reduce false positives.

In the EAC → Mail flow → Rules, create a rule:

If sender = Mailcow IP → set SCL = 0.

4.2. DMARC

Recommended record:

v=DMARC1; p=quarantine; sp=quarantine; adkim=s; aspf=s; fo=1; pct=100; rua=mailto:[email protected]

Testing and debugging.

Check DNS (Linux/macOS):

dig +short TXT example.com

dig +short CNAME selector1._domainkey.example.com

dig +short TXT _dmarc.example.com

dig +short MX example.com

Mailcow logs:

docker logs -f mailcowdockerized-postfix-mailcow-1

In Microsoft 365:

• Message trace — check delivery.
• Threat Explorer — analyze filtering.

Readiness checklist

Common errors and solutions