Enabling TLS for a company that uses Exchange 2010 hybrid environment O365 and spam gateway[Symantec BrightMail 10.0.2] to route inbound outbound emails

If all inbound/outbound mails are hitting the spam appliance first, and you want to only enforce TLS for specific domain, you should do it on the appliance level. Nothing should be needed on O365 side.

For the sake of completeness, you can enforce TLS in O365 using these two methods:

 - use an inbound/outbound connector: http://technet.microsoft.com/en-us/library/dn751021(v=exchg.150).aspx
 - use a simple transport rule with the "recipient domain is" condition and the "require TLS" action

The first method is generally more secure, as you can require the other side to have a valid publicly trusted certificate with the said domain added as SAN/CN, but it's a bit more difficult to configure. The second method is easier to configure, gives you a lot of flexibility when combined with out actions/exceptions/conditions, but will work against any certificate (even self-signed).

Vasil, are you saying that I need to perform a transport rule on the Symantec BrightMail spam gateway appliance?

Did you read all symantec links posted above?

If everything has to be done on the spam gateway, can you please write down all steps?

Anyone?

Sorry, I'm not an expert on BrightMail, but the first article you linked seems to contain the instructions you need.

Thanks Vasil,

With that being said, everything should be done on the Symantec appliance and the instructions would be below?


TLS for delivery to specific domains:
You may enable TLS for delivery of mail on a per-domain basis.
Select the Protocols tab.
Select Domains under the SMTP sidebar on the left hand side of the page.
Either select the Add button to add a new domain or select a domain and click the Edit button to change an existing domain.
Select the Delivery tab.
In the TLS Encryption box, Check the box for Optional delivery encryption
Select either Attempt TLS encryption or one of the two Require TLS options. Note: If either of the Require TLS encryption options are chosen and the remote mail system does not support TLS, the messages will bounce for that system.
Select Save to commit the changes.

What about the certificates? Should I use a public CA? can you please elaborate this? Where the certificate should be generated? Would it be generated on the Symantec Appliance or from a external or internal PKI CA?

Does anybody from Antivirus team has any thoughts?

Self signed will do, but the most secure way is to use a valid publicly trusted certificate with the domain name added as SAN/CN.

Vasil, so basically you are saying that the public certificate should be a SSL SAN certificate with the domain name of both companies?

Should we exchange the cert across companies?
If so, I guess the cert should be imported onto the Symantec Appliance Gateway?

Can someone else from the AV team provide with your thoughts?