Exchange Online Setup

Step 1 — Install the Module

Open PowerShell as Administrator and install the Exchange Online Management module:

Install-Module ExchangeOnlineManagement -Scope CurrentUser -Force
Import-Module ExchangeOnlineManagement

Step 2 — Connect to Exchange Online

Connect-ExchangeOnline -UserPrincipalName [email protected]

A browser window will open for Microsoft authentication. Sign in with your admin account.

Step 3 — Create the Outbound Connector

This routes all outbound mail through the Badex Signature server:

New-OutboundConnector `
  -Name "Badex Signature Outbound" `
  -ConnectorType Partner `
  -SmartHosts "smtp.signature.badex.app" `
  -UseMXRecord $false `
  -TlsSettings Opportunistic `
  -RecipientDomains "*" `
  -Enabled $true

Step 4 — Create the Transport Rule

This prevents signature loops — emails already processed won't be processed again:

New-TransportRule `
  -Name "Badex Signature Route" `
  -FromScope InOrganization `
  -RouteMessageOutboundConnector "Badex Signature Outbound" `
  -ExceptIfHeaderContainsMessageHeader "X-BADEX-Signature-Processed" `
  -ExceptIfHeaderContainsWords "1" `
  -StopRuleProcessing $true

Step 5 — Verify the Setup

# Check connector
Get-OutboundConnector -Identity "Badex Signature Outbound" | Format-List Name, Enabled, SmartHosts

# Check transport rule
Get-TransportRule -Identity "Badex Signature Route" | Format-List Name, State, Mode

Expected output:

Name       : Badex Signature Outbound
Enabled    : True
SmartHosts : {smtp.signature.badex.app}

Name  : Badex Signature Route
State : Enabled
Mode  : Enforce

Step 6 — Test

Send a test email from any mailbox in your organization to an external address. Check the email headers to verify:

• X-BADEX-Signature-Processed: 1 is present
• DKIM-Signature header exists
• SPF, DKIM, DMARC all show PASS

Remove the Connector

To remove Badex Signature and restore normal mail flow:

Remove-OutboundConnector -Identity "Badex Signature Outbound" -Confirm:$false
Remove-TransportRule -Identity "Badex Signature Route" -Confirm:$false