Overview

Sublime’s default set up analyzes and remediates messages upon receipt in an end-user’s mailbox (”post-delivery”).

Enterprise users can choose to instead analyze and remediate threats before they land in end-user mailboxes (”pre-delivery”) using our inline protection for inbound messages, without losing the ability to complete manual remediations post-delivery.

This page contains instructions for enabling the inline protection as well as FAQs.

Prerequisites

1. You must have access to Microsoft365: Exchange Admin Center to configure connectors and transport rules

Environment-specific onboarding details

Setting up inline protection requires IPs, hostnames, and DNS configurations that are environment-specific. Find your environment-specific details here:

Instructions

1. Update SPF Records

In order to ensure reliable delivery, you must update your domain's SPF (Sender Policy Framework) record to include Sublime's IP addresses. This ensures that messages sent by Sublime on your behalf are properly authenticated.

1. Access your DNS management interface (wherever your domain's DNS records are managed)
2. Locate your SPF record (typically a TXT record for your domain)
3. Add Sublime's IP addresses to the SPF record using the ip4: mechanism

Example SPF record (add to your existing SPF record):

v=spf1 ... ip4:34.197.67.5 ip4:44.194.118.42 ~all

Replace the IP addresses with those from your region. If you already have an SPF record, add the IP addresses to it rather than creating a new record.

1. Save the DNS changes
2. Wait for DNS propagation (typically 15 minutes to 48 hours)

2. Configure Exchange Connectors

You'll need to create two Exchange connectors: one for routing messages to Sublime (pre-analysis) and one for receiving messages back from Sublime (post-analysis).

2.1. Create Outbound from Sublime Connector (post-analysis)

1. Navigate to the Exchange Admin Center Connectors page
2. Click Add a connector
3. Configure the connector with these settings:
   • Connection from: Your Organization's Email Server
   • Connection to: Office 365
   • Name: Outbound from Sublime (or your preferred name)
   • What do you want to do after connector is saved?:
     • ✅ Turn it on
     • ✅ Check "Retain internal Exchange email headers"
   • How do you want Office 365 to identify your partner organization?: Choose one of:
     • Option A: "By verifying that the IP address of the sending server matches one of the following IP addresses" → Add your IP Addresses (from environment specifics)
     • Option B: "By verifying that the subject name on the certificate matches the domain" → Enter your Inbound Domain (the certificate is shared between inbound and outbound routes)
4. Click Create to save the connector

2.2. Create Inbound to Sublime Connector (pre-analysis)

1. Still in the Connectors page, click Add a connector again
2. Configure this connector with these settings:
   • Connection from: Office 365
   • Connection to: Your Organization's Email Server
   • Name: Inbound to Sublime (or your preferred name)
   • What do you want to do after connector is saved?:
     • ✅ Turn it on
     • ✅ Check "Retain internal Exchange email headers"
   • Specify when you want to use this connector: Only when I have a transport rule set up that redirects messages to this connector
   • Routing: Enter your Inbound Domain (from the environment specifics)
   • Security restrictions:
     • ✅ Always use Transport Layer Security (TLS) to secure the connection
     • ✅ Issued by a trusted certificate authority (CA)
     • Add the subject name or subject alternative name (SAN) that matches your Inbound Domain
   • Validation: Use an active email address associated with your Sublime Message Source (this may take a minute or two to complete)
3. Click Create to save the connector

Important: Legacy users may have an inbound connector configured with Connection from: Office 365 -> Connection to: Partner Organization. This configuration is valid for an Inline-only and Inbound-only configuration. Customers who experience problems with one connector type may try the other, although Your Organization's Email Server may be necessary to correctly categorize Internal email.

3. Configure Skip Listing

Skip listing helps ensure that messages from Sublime are trusted and not marked as spam.

1. Navigate to Microsoft 365 Defender Skip Listing
2. Find your Post-Analysis Connector in the list
3. Click on it to configure
4. Under "Skip these IP addresses that are associated with the connector", enter your IP Addresses (from environment specifics) NOTE: The configuration will not save properly if you don't hit "enter" after pasting in each IP Address.
5. Select "Apply to entire organization"
6. Click Save
7. Ensure "Enhanced Filtering" is set to On for your connector

4. Get Your Authentication Header Value

You'll need a signed header value from Sublime to authenticate messages. This value is unique to your message source.

1. Log in to the Sublime dashboard
2. Navigate to Admin > Message Sources
3. Find the message source you're connecting and click the key icon (🔑) next to it
4. Click the code block to copy the X-Sublime-Inline-Message-Meta header value
5. Save this value - you'll need it in the next step

⚠️ Security Note: Treat this header value as a secret. It authenticates messages from your organization.

5. Create Transport Rules

You'll create up to two transport rules: one for inbound messages and one for internal messages.

5.1. Create Inbound Rule

This rule processes messages sent from outside your organization.

1. Navigate to the Exchange Admin Center Transport Rules page

2. Click Add a rule (or + Add rule)

3. Configure the rule:

   Basic Information:

   • Name: Sublime Platform - Inline (Inbound) (or your preferred name - if using Sublime's automatic fail open configured then the given name is required)

   Conditions (Apply this rule if):

   • Select "The sender" → "is external/internal"
   • In the drawer, select "Outside the organization"
   • Click + to add another condition
   • Select "The recipient" → "is external/internal" → "Inside the organization"
   • Click Save
   • (Optional) Add additional conditions to restrict which messages are processed (e.g., specific recipients)

   Actions (Do the following):

   • Action 1: Set Message Header
     • Select "Modify the message properties" → "set a message header"
     • Header name: X-Sublime-Receiving-Inbound
     • Header value: Paste the value you copied from Sublime in Step 4
   • Action 2: Redirect to Connector
     • Click the + button to add another action
     • Select "Redirect the message to" → "the following connector"
     • Select the Inbound to Sublime Connector you created in Step 1

   Exceptions (Except if):

   • Select "The sender" → "IP address is in any of these ranges or exactly matches"
   • Add your IP Addresses (from environment specifics) to prevent routing loops
   • Click Save

4. Click Next through the remaining screens

5. Review your configuration and click Finish

6. Wait for the rule to save

7. In the rules list, find your new rule and toggle the Enabled switch to On

8. Wait for the confirmation message

5.2. Create Internal Rule

This rule processes messages sent between users within your organization.

1. Still in the Transport Rules page, click Add a rule again
2. Configure the rule:
   • Basic Information:
     • Name: Sublime Platform - Inline (Internal) (or your preferred name - if using Sublime's automatic fail open configured then the given name is required)
   • Conditions (Apply this rule if):
     • Select "The sender" → "is external/internal"
     • In the drawer, select "Inside the organization"
     • Click + to add another condition
     • Select "The recipient" → "is external/internal" → "Inside the organization"
     • Click Save
     • (Optional) Add additional conditions to restrict which messages are processed (e.g., specific recipients)
   • Actions (Do the following):
     • Action 1: Set Message Header
       • Select "Modify the message properties" → "set a message header"
       • Header name: X-Sublime-Receiving-Internal
       • Header value: Paste the value you copied from Sublime in Step 2
     • Action 2: Redirect to Connector
       • Click the + button to add another action
       • Select "Redirect the message to" → "the following connector"
       • Select the Inbound to Sublime Connector you created in Step 1
   • Exceptions (Except if):
     • Select "The sender" → "IP address is in any of these ranges or exactly matches"
     • Add your IP Addresses (from environment specifics) to prevent routing loops
     • Click Save
3. Click Next through the remaining screens
4. Review your configuration and click Finish
5. Wait for the rule to save
6. In the rules list, find your new rule and toggle the Enabled switch to On
7. Wait for the confirmation message

6. Configure settings in Sublime

This enables monitoring and metrics collection for your inline protection setup.

1. Log in to the Sublime dashboard
2. Navigate to Admin > Account
3. Toggle "Inline Processing" to On

7. Test your setup

After completing setup, verify that Inline Processing is working:

1. Send a test email from an external sender (outside your organization) to one of your mailboxes (for inbound) or from one internal mailbox to another (for internal).
2. Wait for the message to be delivered.
3. Check the recipient's message headers in a browser (cannot check on mobile).
4. Look for a Received header that references Sublime SMTP Server - this confirms the message was processed by Sublime.
5. Check for a X-Sublime-Processed-ID header. This header should look similar to: v2/01991000-bc0a-72d5-8dd9-260b8107eb76/019b1371-d057-774a-83e4-4367b54e14a7/H9c73pp3GgNtKTfxxwMaaR7KrjjnfISFlJ/4Q89UtTU=. There should be values in each section separated by a slash. If you see two slashes together, it may indicate a problem with your configuration.

Note: Sublime will remove the X-Sublime-Receiving header before delivering the message to the mailbox, so you won't see it in the final message.

Email forwarding behavior

Standard forwarding behavior applies based on your Exchange rules.

Spam Tagging

The inbound gateway is optionally configured to mark messages as spam if they contain the X-Sublime-Spam header (applied when a Sublime Move to Spam Action runs). This allows you to send messages to spam/junk after delivery if Sublime identifies the message as spam.

You can ensure these messages are routed directly to spam by creating a transport rule that applies when you see the X-Sublime-Spam header. See setup instructions below:

Create Spam Tagging Rule

1. Navigate to the Exchange Admin Center Transport Rules page.
2. Click Add a rule → Create a new rule
3. Configure the rule:
   1. Name: Sublime Platform - Mark as Spam (or your preferred name)
   2. Conditions (Apply this rule if):
   3. Select "The sender" → "IP address is in any of these ranges or exactly matches"
      1. Add your Sublime IP Addresses (from the environment specifics table). This ensures the rule only fires on messages returning from the Sublime gateway, not on arbitrary inbound messages that may happen to carry the header.
   4. Click the + button to add another condition.
   5. Select "A message header" → "matches these text patterns"
      1. Header name: X-Sublime-Spam
      2. Pattern: [a-zA-Z0-9]
   6. Actions (Do the following):
      1. Select "Modify the message properties" → "set the spam confidence level (SCL)" Set the SCL value to 9.
   7. Exceptions (Except if): (none required)
   8. Click Next.
   9. On the Set rule settings screen:
      1. Rule mode: Enforce
      2. Leave other settings (severity, activation/deactivation dates, sender address matching) at their defaults unless you have a specific reason to change them. Optionally enable "Stop processing more rules" if you do not want subsequent transport rules to act on flagged spam messages. Leave this off if you have other downstream rules that should still apply (e.g., warning banners, journaling).
   10. Click Next, review your configuration, and click Finish.
   11. Critically, in the rules list, find your new rule and ensure the Enabled switch to On.

Spam False Positives

Adding an SMTP relay (Sublime) can increase the likelihood of legitimate messages being marked as spam, especially with strict SPF checks.

Mitigation Steps:

• Ensure you've configured skiplisting (Microsoft365) in your email provider to trust Sublime's IP addresses
• Ensure you've added an SPF record for Sublime to your domain's DNS
• Monitor spam folders for false positives and adjust rules as needed
• Another option is to turn off spam filtering at your provider and let Sublime handle spam detection (custom Detection Rules for spam identification would be required)

Automatic Failovers

You can allow Sublime to automatically disable inline protection and fall back to async message processing by authorizing the Sublime Inline Monitoring Azure app to update your transport rules through the API. If the Sublime Platform detects an outage, it will then automatically disable the Sublime Inline transport rules.

Once you have authorized the Sublime Inline Monitoring Azure app, you need to give the app the "Compliance Administrator" role so that it can read and modify email routing rules:

1. Navigate to Entra Roles and Administrators.
2. Search for "Compliance Administrator" and click that row when it comes up.
3. Click "Add assignments"
4. Type "Sublime Inline Monitoring" into the Search and then click that row when it comes up.
5. Click Add to save.
6. Verify the Sublime Inline Monitoring app now shows in the "Compliance Administrator | Assignments" page

If you do not want to allow Sublime to automatically disable your Sublime inline transport rules, it is recommended that you set up a webhook notification and route the alert to your Exchange Admin so they can toggle off the transport rule(s).

Disabling Inline Protection

If you need to temporarily or permanently disable Inline Processing for any reason:

1. Navigate to Exchange Admin Center Transport Rules
2. Find the "Sublime Platform - Inline (Inbound)" and/or "Sublime Platform - Inline (Internal)" rules
3. Toggle the Enabled switch to Off

Messages will stop being redirected to Sublime within a few seconds. You can re-enable it at any time by toggling the switch back on.

Note: Disabling the Inline Processing setting at Admin > Account within the Sublime platform does not disable inline protection processing. You have to disable the transport rule in Microsoft Exchange to stop message routing.

Reliability and Monitoring

Automatic Monitoring

When Inline Processing is enabled in Sublime Admin, metrics are collected every minute and evaluated for health. If the system is determined to be unhealthy, high-visibility alerts are sent.

Webhook notification

To receive a webhook alert when the Sublime system is unhealthy, configure your webhook by navigating to Admin > Account > Inline Processing and clicking the "Inline Alert Webhook Configuration" button. Alerts will be sent to the endpoint URL you provide. Retrieve the "Webhook secret" your endpoint will use to validate the alert signature (see below). You can optionally specify custom headers to be included in the notification.

If the Sublime system detects inline is in an unhealthy state, it will send and alert with this payload where "unhealthy_metrics" lists which of Sublimes metrics triggered the alert. Note: the exact metric names in this list may vary over time:

{
  "notification_type": "unhealthy_metrics",
    "notification": {
      "org_id": "12345678-1234-1234-1234-123456789abc",
      "message_source_id": "def01234-def0-def0-def0-def01234def0",
      "unhealthy_metrics": ["inline_heartbeat"]
    }
}

The metrics that can appear in unhealthy_metrics are described below. Metric names can change over time, so use this table to interpret alerts rather than as a stable contract for automation.

Heartbeat metrics (inline_heartbeat, inline_nugget_heartbeat) point to a component that is down or unreachable. The other metrics point to a relay that is running but failing to receive, deliver or analyze mail.

If the system is unable to evaluate the inline health metrics, the Sublime platform will assume there is an outage and an alert will be sent with this payload:

{
  "notification_type": "unable_to_evaluate",
    "notification": {
      "org_id": "12345678-1234-1234-1234-123456789abc",
      "message_source_id": "def01234-def0-def0-def0-def01234def0"
  }
}

The notification will come from Source IPs as described here (link) and your endpoint should respond as described here (link). The payload is signed with the "Webhook secret". Your endpoint should be validate the signature in the same way as described here (link). The signing secret is available on the Webhook configuration page at Admin > Account > Inline Processing and clicking the "Inline Alert Webhook Configuration" button.

After setting up the webhook, test the alert by clicking the "Validate Endpoint" button.

Manual Monitoring

Use Message Trace in Exchange Admin to monitor message flow

What Happens During an Outage?

If Sublime's SMTP server cannot accept connections (this would be expected to be rare, transient, and quickly resolved):

1. Your email provider will retry delivery (up to 7 days).
2. After retry period expires, messages are returned to sender as undeliverable.
3. If monitoring permissions are configured, Sublime can automatically disable the transport rule to "fail open".
   1. If monitoring permissions are not configured, set up a webhook notification and route the alert to your Exchange admin, who can disable the transport rules.

Important: Messages are never lost during normal operation. If Sublime successfully receives a message, it is stored and will be processed even if there are temporary processing delays. If, in the worst case, a message fails to be processed after multiple attempts, it is saved with error details for manual recovery.