Restrict Inbound Mail to the Barracuda Email Security Service IP Range

Use the following steps if you want to restrict inbound mail to the Barracuda Email Security Service IP address range:

1. Log in to the Office 365 admin center, and go to Admin centers > Exchange.
2. In the left pane, click mail flow, and click rules.
3. Click the + symbol, and click Create a new rule.
4. In the new rule page, enter a Name to represent the rule. For example, type: Barracuda ESS IP restriction
5. Scroll down to and click Advanced Options.
6. From the Apply this rule if drop-down menu, select The Sender > Is External/Internal > Outside the organization.
7. From the Do the following drop-down menu, select Reject this message with the explanation.
8. Enter the message you want included in the non-delivery report (NDR) that is sent to the sender. For example, enter:
   You have attempted to bypass our Email Security Service. Please ensure your DNS is up-to-date and try sending your message again.
9. Click Add Exception.

10. Select The Sender > Sender’s IP address is in any of these ranges or exactly matches, and enter the Barracuda Email Security Service IP range based on your Barracuda Email Security Service instance.

11. Enter the Barracuda Email Security Service IP range, for example: 64.235.144.0/20  
12. Click the + symbol.
13. Enter the Barracuda Email Security Service IP range, for example: 209.222.80.0/21
14. Click the + symbol.
15. Click OK.
16. Scroll to the Properties of this rule section, and in the Priority field, type: 0
17. In the new rule page, click Stop processing more rules, and click Save to create the rule.
18. Office 365 is now configured to block any email that does not originate from the Barracuda Email Security Service IP address ranges.

19. Verify the new rule displays at the top of the list of mail flow rules. If the rule is not at the top, click on the rule, and use the Up ( ) arrow to move the rule to the top of the list.