Do i need CMT for outgoing email via OnPrem

Question

Do i need CMT for outgoing email via OnPrem

ThStLearn 191

Hi Exchange Community,

We have a customer who has a hybrid configuration and sends and receives all incoming and outgoing emails via on-premises. For this purpose, there is an HCW connector of the type on-premises that has the flag Routeallmessagesviaonpremises = $true (CMT).

The customer now has a requirement to have an emergency domain in EXO that does not go through the HCW created CMT connector. This applies to both outgoing and incoming messages. For outgoing messages, we have created a transport rule scoped connector that sends directly to the internet, which works. For incoming messages, we have not found a way to receive the domain only in EXO without going through the CMT.

Now here's the question: Do I need CMT if I want to route all outgoing emails from EXO to OnPrem, or is it sufficient to have an outbound connector of type OnPremises with RecipientDomains * that point to the onprem server? The customer has no use for a compliance tool that requires all emails to always go through onPrem. Only outgoing emails need to be sent via OnPrem.

2 answers

Your answer

Answer 1

Steven-N 15,720 Microsoft External Staff Moderator

Hi ThStLearn

Thank you for reaching out to Microsoft Q&A forum

As states in Transport routing in Exchange hybrid deployments, the Centralized Mail Transport (CMT) is only required when you need both inbound and outbound Internet mail to pass through your on-premises organization for compliance or processing. When CMT is enabled, all inbound mail for Exchange Online mailboxes is hair pinned through on-premises servers before delivery.

User's image

That said, if your requirement is only to route outbound messages from Exchange Online through on-premises, you do not need to enable CMT. Instead, you can:

Disable CMT (RouteAllMessagesViaOnPremises = $false).
Configure an On-Premises outbound connector in Exchange Online, scoped to the appropriate domains, with your on-premises smart hosts as you mentioned above

These approaches ensures outbound mail flows through on-premises while inbound mail for domains hosted in Exchange Online is delivered directly via EOP, avoiding unnecessary hairpin routing.

Hope this clears things up, let me know if you have more details

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

ThStLearn 191 Reputation points

2025-11-21T09:25:05.42+00:00

Hi,

I also read the article, but the term “scoped to the appropriate domains” is not clear to me. If I have to send all outgoing emails via this connector, then “appropriate domains” would mean “*” in the connector, right?
Steven-N 15,720 Reputation points Microsoft External Staff Moderator

2025-11-21T09:52:06.54+00:00

Hi ThStLearn

Thanks for quick reply

The phrase “scoped to the appropriate domains” in the context of Exchange hybrid connectors refers to the domains for which the connector should apply mail flow rules. It does not automatically mean “*” (all domains) unless your design explicitly requires routing every outbound message through that connector. Appropriate domains usually mean the connector is configured to handle mail for specific accepted domains in your organization (for example, contoso.com, externaldomain.com) that are part of your hybrid setup.

Additionally, could you please confirm that when you mention to "*", its mean "all external domain" in this context?

Best regards
ThStLearn 191 Reputation points

2025-11-21T10:38:20.24+00:00
Hi @Steven-N
Yes, exactly for the same subfunction that CMT does today with external emails. The requirement is to send ALL external domains via Onprem to the Internet. This would mean creating the following connector as a replacement for the CMT connector:

Connector Name = "Outbound to Internet via OnPrem"

Connector Type = Onprem

Connector Recipient = *

Connector RouteAllMessagesViaOnPremises = $false

Connector SmartHost = onprem.hostname.com Am I correct?
Steven-N 15,720 Reputation points Microsoft External Staff Moderator

2025-11-21T10:52:01.49+00:00

Hi ThStLearn

So, my opinion in this context, if your goal is to route all outbound mail from EXO through your on-premises system, then yes, you would configure the connector’s scope to include “*” or leave it unrestricted so it applies to all domains.

This wildcard ensures the connector applies universally, rather than being limited to specific accepted domains, which is necessary for centralized mail transport or compliance scenarios where every message must pass through the hybrid route.

Best regards
Steven-N 15,720 Reputation points Microsoft External Staff Moderator

2025-11-24T10:23:44.7566667+00:00

Hi ThStLearn

It has been a while and I am writing to see how things are going with this issue.

Have you had a chance to check the replies provided?

Any update would be appreciated.
ThStLearn 191 Reputation points

2025-11-24T14:03:35.56+00:00

Hi @Steven-N
I will get back to you after the changeover and, depending on the outcome, provide our findings in the answers. I will then mark the request as completed.
Steven-N 15,720 Reputation points Microsoft External Staff Moderator

2025-11-24T14:13:15.6433333+00:00

Hi ThStLearn

I am looking forward to hearing from you

Best regards

Answer 2

ThStLearn 191

Hi @Steven-N
Unfortunately, the implementation did not work. It is not possible to create a connector of type OnPrem that has RecipientDomains *. The error was as follows: "Connector validation failed: Recipient Domain cannot be set to * on an outbound connector of type OnPremises unless RouteAllMessagesViaOnPremises is set to true."

What other options are there for our use case?

Steven-N 15,720 Reputation points Microsoft External Staff Moderator

2025-12-05T13:44:05.6833333+00:00
Hi ThStLearn

Thanks for updating and apologize for the delayed response

Since the proposed workaround approach was not work, seem like it is by design and cannot be bypassed.

Therefore, in this context, you have two primary options to address this issue:

Keep Full Centralized Mail Transport (CMT) Enabled:

Outbound mail will continue to route via on-premises, as expected.

Inbound mail will also be forced through on-premises for all domains, including your emergency domain. Even if MX records are pointed to Microsoft, Exchange Online Protection (EOP) will still route it through on-prem.

Disable CMT and Migrate to Cloud-Native Solutions (Recommended):

This is the more practical and future-proof solution, especially for organizations in your situation. By moving fully to the cloud, you remove on-premises transport as a single point of failure and ensure direct delivery for your emergency domain, even if your on-premises infrastructure is offline.

From my perspective view, Option 2 is the better choice because it removes on-premises transport as a single point of failure, ensuring more reliable and resilient mail flow. By migrating to cloud-native solutions, you eliminate the complexity and risk of relying on on-premises infrastructure, especially since Exchange Server 2019 is no longer in mainstream support as of October 2025. Cloud solutions are now superior for common functions like archiving, disclaimers, DLP, and filtering, offering better performance and simplicity.

Best regards

Share via

Do i need CMT for outgoing email via OnPrem

2 answers

Your answer