Step-by-step Directions:

Create a new Inbound Connector using PowerShell

• If you have an old MailRoute Inbound Connector created before September 2024, you must delete it and set up a new connector using this new configuration.  Visit https://admin.exchange.microsoft.com/#/connectors, select the connector, and then select the small trashcan icon in the detail panel on the right to delete the connector.
  
  
• Install PowerShell if you don't already have it.
  • Windows:
    https://learn.microsoft.com/en-us/powershell/scripting/install/installing-powershell-on-windows?view=powershell-7.4
    
    For Windows 11 and later:
         Install from the Microsoft Store, or you can try:
             winget install --id Microsoft.PowerShell --source winget
    For other versions of Windows, see the above article.
    
    
  • Mac and Linux:
    https://github.com/PowerShell/PowerShell/releases/tag/v7.4.5
    
    
• Run powershell
  • Windows: 
    In a Windows command shell, type "PowerShell"
    
    
  • Mac and Linux:
    In a terminal window, type "pwsh"
    
    
• In your bright, shiny new powershell window, install the Exchange Online powershell cmdlets and install a new connector:
  

  • Install-Module ExchangeOnlineManagement

• Authenticate to Exchange Online:

  • Connect-ExchangeOnline -UserPrincipalName <your exchange admin login>
    
    

    This will open a browser window so you can login to your Exchange Online account.  When you complete logging in, you can close the browser window and return to your powershell window.
    
    Note:   If you are in Germany, China, or using GCC High or GCC DOD, you must also specify your ExchangeEnvironmentName, like this (this is not required for regular Office365 of Office 465 GCC)
    

    Connect-ExchangeOnline -UserPrincipalName <your exchange admin login> -ExchangeEnvironmentName O365USGovGCCHigh 

    The choices for ExchangeEnvironmentName are:
         Microsoft 365 or Microsoft 365 GCC:  <Not required>
         Office 365 Germany: O365GermanyCloud
         Office 365 operated by 21Vianet: O365China
         Microsoft 365 GCC High: O365USGovGCCHigh
         Microsoft 365 DoD: O365USGovDoD
    
    
  • Now create a new connector:
    

    New-InboundConnector -Name "MailRoute Inbound" -ConnectorType Partner -SenderDomains * -RestrictDomainsToCertificate $true -TlsSenderCertificateName *.mailroute.net -RequireTls $true -EFSkipIPS 199.89.0.0/21

    This connector will only accept mail from servers that are encrypted with TLS and that come from servers with the MailRoute TLS certificates, preventing other sites from connecting directly to MS Exchange Online and transferring mail to you, bypassing your filtering.  This also sets up the "Advanced Filtering" for Microsoft Defender.
    
    This can take a minute or two to run.
    
    
  • Verify that the connector is in place and looks correct:
    

    Get-InboundConnector -Identity "MailRoute Inbound" | Format-List *
    
       Enabled : True
       ConnectorType : Partner
       ConnectorSource : Default
       ...
       SenderDomains : {smtp:*;1}
       ...
       RequireTls : True
       RestrictDomainsToIPAddresses : False
       RestrictDomainsToCertificate : True
       TlsSenderCertificateName : *.mailroute.net
       ...
       ...
       Name : MailRoute Inbound
       ...

• Now add mailroute.net as a "Trusted ARC Sealer".  Microsoft recommends this in their article at article about managing mail flow while using third-party services& and here is an Microsoft article about Improving “Defense in Depth” with Trusted ARC Sealers
  
  
  Microsoft also recommends that you add third-party services that modify
  messages in transit as Trusted ARC sealers, if the service supports ARC
  sealing. Add the service as a trusted ARC sealer helps affected messages
  pass email authentication checks, and helps prevent legitimate messages
  from being delivered to the Junk Email folder, quarantined, or rejected.
  
  If you don't have any Trusted ARC Sealers set, or if you want to replace yours with the MailRoute entry, you can use this powershell command:
  

  Set-ArcConfig -Identity Default -ArcTrustedSealers "mailroute.net"

  
  OR
  
  If you already have Trusted ARC Sealers and you want to add MailRoute to the list, you can use this bit of code instead.  It will retrieve any existing list, add mailroute.net to the list, and then set ArcTrustedSealers to the full list of trusted sealers:
  
  

• $DomainsAdd = @(Get-ArcConfig | select -Expand ArcTrustedSealers)
  $DomainsAdd += "mailroute.net"
  Set-ArcConfig -Identity Default -ArcTrustedSealers $DomainsAdd 

Disable Microsoft DirectSend (recommended)

Set-OrganizationConfig -RejectDirectSend $true

Step 5.  Configure Outbound Connector