Changing DNS MX records to route all inbound mail through Defender for Office 365

SC-100 By islever Editorial Last updated

Evaluate solutions for securing Microsoft 365

Short answer

B Update the DNS MX records to point to Microsoft EOP/Defender for Office 365 so all inbound mail is routed through and scanned by Defender only.

Question

You have a Microsoft 365 subscription that contains 1,000 Microsoft Exchange Online mailboxes. Incoming email from the internet is scanned for security threats by using a third-party cloud service. You are evaluating whether to replace the third-party service with Microsoft Defender for Office 365. What should you modify to ensure that all the incoming email is scanned by Defender for Office 365 only?
  1. the accepted domains in Exchange Online
  2. the DNS records Correct Answer
  3. the Exchange Online transport rule
  4. the Exchange Online connectors

Key Takeaways

Mail routing is controlled by MX records; pointing MX to Microsoft EOP/Defender reroutes all inbound mail through Defender. Connectors (D) manage flow after delivery and cannot by themselves guarantee that a third party no longer receives and scans the mail first.

To ensure all internet inbound email is scanned exclusively by Microsoft Defender for Office 365 (replacing a third-party filtering service), update the DNS MX records to point to Microsoft's Exchange Online Protection, so mail flows through Defender rather than the third party.

Common mistake: Modifying Exchange Online connectors (D) — connectors manage mail flow after delivery but do not guarantee that a third-party gateway no longer receives and scans the mail first; the MX record controls where mail is delivered.

Expert Analysis

Why the Answer Is Correct

Inbound mail routing on the internet is governed by the domain's MX (Mail Exchanger) DNS records. To make Microsoft Defender for Office 365 the sole scanner of inbound mail, you repoint the MX records to Microsoft's Exchange Online Protection endpoints so all inbound messages are delivered to and filtered by Defender, removing the third-party service from the path.

Why the Other Options Are Wrong

Exchange Online connectors (D) control how mail is accepted/relayed after it arrives but do not move the delivery destination; as long as MX still points at the third party, that service scans first. Accepted domains (A) and transport rules (C) do not change where inbound mail is delivered.

Community Comment Notes

The community was split (B 56 / D 44). The correct control for 'scanned by Defender ONLY' is the MX record, because only changing MX removes the third party from the mail path; connectors alone cannot guarantee exclusivity. Several comments confirm updating MX to Microsoft is required.

Official Reference

https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/mail-flow-best-practices

This link opens the official vendor documentation in a new tab.

Community Votes

B
56%
D
44%

56% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 6 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 6

  1. Softeng 👍 2 Answered B
    Should be: B- DNS Records? To ensure that all incoming email is scanned exclusively by Microsoft Defender for Office 365, you need to modify your MX (Mail Exchange) records.
  2. Ali96 👍 2 Answered D
    D. the Exchange Online connectors
  3. RoboCock 👍 1 Answered B
    To ensure that all incoming email is scanned exclusively by Microsoft Defender for Office 365, you need to modify the DNS records. Specifically, you should update the MX (Mail Exchange) records to point to Microsoft Defender for Office 365 instead of the third-party cloud service. This change will route all incoming email through Defender for Office 365 for scanning and protection.
  4. Saynot 👍 1 Answered B
    Scan by Defender for Office ONLY, if i modify the connectors i cant guarantee that is scanned ONLY from Microsoft message can go thorugh other before. I must change DNS record (MX)
  5. tuyi2 👍 1 Answered B
    The DNS Records should be the correct answer
Show 1 more comment
  1. skz94 👍 1 Answered D
    the Exchange Online connectors

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Using Microsoft Entra Permissions Management to find unused RBAC assignments

S-grade

Scenarios supported by compliant network check in Global Secure Access

S-grade

Removing the inbound firewall rule for an Entra application proxy connector

S-grade

Applying customer-managed key encryption at the file level in Data Lake Storage

S-grade

Practice All SC-100 Questions

Access 110 questions with complete answers and detailed explanations.

View Full SC-100 Practice Test →

← Back to SC-100 Study Guide