How It Works
Configuring Salesforce outbound encryption with a Customer Hosted Gateway and Microsoft 365 is a two-part setup:
- Microsoft Mail Flow Rule — We create a mail flow rule in your Microsoft 365 environment so that emails sent directly from Outlook can be routed through the Virtru Gateway for encryption.
- Gateway Environment Variable — We update the customer-hosted gateway's .env file to define how outbound mail is processed and delivered.
Once configured, every outbound email from Salesforce will route through the Virtru Gateway. Emails that do not contain the designated encryption keyword will be delivered normally — no encryption applied. Emails that do contain the keyword will be encrypted before being delivered to the recipient. The same keyword-based encryption logic applies to emails sent directly from Microsoft 365 via the mail flow rules.
Transport Maps: Choosing Your Delivery Path
The GATEWAY_TRANSPORT_MAPS setting in each container's /var/virtru/vg/env .env file controls where the gateway sends email after processing. There are two options, and the right choice depends on your organization's compliance and archiving requirements.
Option A — Direct MX Delivery (Default)
When this line is commented out, the gateway performs a live DNS MX lookup for each recipient domain and delivers directly to the recipient's mail server.
| Detail | |
|---|---|
| Outbound | External recipients (Gmail, Yahoo, etc.) receive mail directly — M365 is not involved in final delivery. |
| Inbound | After decryption, the MX lookup naturally routes mail back to M365 (since M365 is the MX for your domain). |
| Best For | Simpler architecture with fewer hops. |
Option B — Route Through M365
When this line is uncommented, all processed email — both inbound and outbound — is sent to M365 first. Microsoft 365 then handles final delivery to external recipients.
| Detail | |
|---|---|
| Outbound | M365 delivers to external recipients on behalf of the gateway. |
| Inbound | Decrypted mail is routed back through M365 for processing. |
| Best For | Organizations that require M365 outbound policies, compliance archiving/journaling, or DLP scanning to apply to all mail. |
A Note on Journaling & Archiving
When sending encrypted emails outbound, it's important to consider your organization's journaling and archiving requirements. If your compliance policies mandate that all outbound mail — including encrypted messages — be captured by M365's journaling or archiving features, Option B (Route Through M365) is the recommended transport configuration.
With Option A, outbound mail bypasses M365 entirely, meaning those messages will not appear in your M365 journal or compliance archive.