A Step-by-Step Implementation Tutorial For IT Admins
Email security is one of the most critical responsibilities for modern IT admins. With the rise in phishing, ransomware, spoofing, and malicious email attachments, businesses need strong cloud email protection.
Trend Micro Email Security (TMES) is a powerful cloud-based service that protects Microsoft 365 organizations from advanced email threats.
In this guide, you’ll learn exactly how to configure Trend Micro Email Security (TMES) with Microsoft 365 using a simple, GUI-based, step-by-step process.
This is a full production-ready configuration, based on official Trend Micro documentation and real-world enterprise deployment experience.
⭐ What You Will Learn in This Guide
- What TMES is and how it protects Microsoft 365
- How to add & verify your domain in Trend Micro
- How to configure inbound & outbound email flow
- How to set up Microsoft 365 connectors
- How to update DNS (MX, SPF, DKIM, DMARC)
- Important security rules to enable
- Testing & final validation steps
Let’s get started.
🔐 What Is Trend Micro Email Security (TMES)?
Trend Micro Email Security is a cloud service that filters:
- Spam
- Malware
- Ransomware
- Phishing
- Business Email Compromise (CEO Fraud)
- Malicious URLs
- Zero-day threats
It acts as a secure email gateway between the internet and Microsoft 365.
Email Flow After Integration:
Inbound:Internet → TMES → Microsoft 365 → User Mailbox
Outbound:Microsoft 365 → TMES → Internet
This gives maximum visibility and real-time threat protection.
🧩 PHASE 1 – Preparation Checklist
Before starting, ensure you have:
✔ Microsoft 365 Admin Access
(Global Admin or Exchange Admin)
✔ Trend Micro Email Security Admin Login
✔ DNS Access
(GoDaddy, Cloudflare, BigRock, Azure DNS, etc.)
✔ Your domain name
Example: company.com
(You can find it in Microsoft 365 Admin Center → Settings → Domains)
🏷️ PHASE 2 – Add Domain in TMES (GUI)
- Login to TMES portal:
https://portal.mail.security.trendmicro.com - Go to:
Administration → Domain Management → Add Domain - Enter your domain, e.g.,
company.com - TMES shows a TXT Record:
TMES-verify=xxxxxxx - Copy this value.
🌐 PHASE 3 – Add TMES TXT Record in DNS
Go to your DNS provider → DNS Records → Add New Record:
- Type: TXT
- Host: @
- Value: TMES-verify=xxxxxx
Save the record → return to TMES → click Verify.
📩 PHASE 4 – Copy TMES Values (VERY IMPORTANT)
After verification, go to:
TMES → Administration → Domain Management → [Your Domain]
Copy these values:
✔ Inbound MX Record (Region based)
Example:
“mx12345.tmep.trendmicro.com“
✔ Outbound Smart Host
Example:
outbound.mx12345.tmep.trendmicro.com
✔ TMES IP ranges
(Used for Microsoft 365 connectors)
📥 PHASE 5 – Configure Microsoft 365 Inbound Connector
Microsoft 365 Admin Center →
Exchange Admin Center → Mail Flow → Connectors → Add
- From: Partner Organization
- To: Microsoft 365
- Name: TMES-Inbound
- Identify by: IP Address
- Add: All TMES IP Ranges
- Enable TLS
- Save
This ensures Microsoft 365 accepts email only from TMES.
🛡️ PHASE 6 – Create Bypass Spam Rule in Microsoft 365
Exchange Admin Center →
Mail Flow → Rules → Add Rule
- Name:
BypassSpamFromTMES - Condition: Sender IP Address is TMES IPs
- Action: Bypass spam filtering (SCL = -1)
- Save
This prevents double-scanning by M365.
🚫 PHASE 7 – Disable Microsoft 365 SPF Hard-Fail
Go to:
Microsoft 365 → Security → Email & Collaboration → Anti-Spam Policies
Inside inbound spam policy:
Turn OFF → SPF Record Hard Fail
(This is recommended in Trend Micro’s official PDF.)
🔐 PHASE 8 – Optional: Lock Down Microsoft 365 (Enhanced Security)
Create a rule:
“Only allow email from TMES → block all direct inbound mail.”
This prevents hackers from bypassing TMES.
📨 PHASE 9 – DNS CUTOVER (MX, SPF, DKIM, DMARC)
1️⃣ Update MX to TMES
Example:
<tenant>.in.tmes-in.trendmicro.com
2️⃣ Update SPF
Add TMES to existing O365 SPF:
=spf1 include:spf.protection.outlook.com include:spf.tmep.trendmicro.com -all
3️⃣ Add DMARC
v=DMARC1; p=quarantine; rua=mailto:dmarc@company.com;
4️⃣ Enable DKIM
- Add 2 CNAME records from O365
- Enable DKIM in Exchange Admin Center
🚀 PHASE 10 – Configure TMES Inbound Protection
In TMES Portal:
Policies → Inbound Protection
Enable:
- Anti-Spam
- Malware Scanning
- URL Time-of-Click
- Attachment Security
- Zero-hour malware detection
- Impersonation Protection
📤 PHASE 11 – Enable TMES Outbound
TMES →
Domain Management → Outbound Protection → Enable → Select Office 365
📬 PHASE 12 – Microsoft 365 Outbound Connector
Exchange Admin Center →
Mail Flow → Connectors → Add
- From: Microsoft 365
- To: Partner Organization
- Smart Host: (paste outbound value from TMES)
- Require TLS
- Save
📤 PHASE 13 – Create Outbound Routing Rule
Mail Flow → Rules → Add Rule
Condition:
- If recipient is outside the organization
Action:
- Route via → TMES-Outbound Connector
🧪 PHASE 14 – Testing
Inbound Test:
✔ Send from Gmail
✔ Send spam → should be quarantined
✔ Send EICAR test string → blocked
Outbound Test:
✔ Check if TMES headers appear
✔ Spoof protection working
🎯 PHASE 15 – Go Live
Monitor:
- TMES Dashboard
- Quarantine logs
- Microsoft 365 Message Trace
- False positives
Your integration is now 100% complete.
🏁 Final Thoughts
Trend Micro Email Security adds an essential extra layer of security beyond Microsoft 365’s native protection. With proper configuration of:
- DNS
- Connectors
- Policies
- Routing rules
You ensure complete protection against modern email threats.
This step-by-step guide simplifies the entire process, making it easy for IT administrators to deploy the solution confidently in production.