Sophos email domains

When you set up external email services to work with Sophos Email Security, you must use these domains and IP addresses in your email service configuration. This directs messages through our services so that we can scan them for threats.

You must use the values that match the region you chose when you created your Sophos Central account. For each section below find and copy the value that matches that region.

You can change the following:

• Gateway IP addresses. You must restrict delivery to our IPs to make the integration between Sophos Gateway and your mail host more secure. See Sophos email gateway IP addresses.
• MX records. You must change these to direct messages to our servers. See Sophos MX records.
• SPF records. You must add our SPF records so that outgoing email goes through our servers. See Sophos SPF domains.
• Outbound relay host. You might need to set this to integrate with Microsoft Exchange or other clients. See Sophos email outbound relay.

To find out how to configure external email services, see Integrate with external services.

Sophos email gateway IP addresses

Using an IP address other than the one specified for your region prevents mail from flowing correctly.

Copy the IP addresses for your region.

Go back to the configuration instructions for the external email service you're configuring.

Sophos MX records

Copy the MX records for your region.

Take care to ensure that the spelling and numbers are correct. Using MX record names other than those provided prevents mail from flowing correctly.

Go back to the configuration instructions for the external email service you're configuring.

Sophos SPF domains

You must use a Sophos SPF domain to direct outbound messages to us for scanning.

You can use _spf.prod.hydra.sophos.com, which is common to US (West), US (East), Germany and Ireland. You can also use a specific domain for the Sophos data center for your region.

Copy the SPF domain for your region.

Go back to the configuration instructions for the external email service you're configuring.

Sophos email outbound relay

You don't need to add an outbound relay host if you're integrating with Microsoft 365 or Google Workspace.

To find out if you need to set up an outbound relay host, and how to do it, see Configure Exchange and all other clients.

Copy the domain for your region.

Go back to the configuration instructions for the external email service you're configuring.