Enhanced Filtering is a feature of Exchange Online Protection (EOP) that allows EOP to skip back through the hops the messages has been sent through to work out the original sender.
Take for example a message from SenderA.com to RecipientB.com where RecipientB.com uses Mimecast (or another cloud security provider). The MX record for RecipientB.com is Mimecast in this example. When EOP gets the message it will have gone from SenderA.com > Mimecast > RecipientB.com > EOP, or it will have gone SenderA.com > Mimecast > EOP if you are not sending via any other system such as an on-premises network.
EOP though, without Enhanced Filtering, will see the source email as the previous hop – in the above example the email will appear to come from Mimecast or the on-premises IP address – and neither of these are the true sender for SenderA.com and so the message fails SPF if it is set to -all (hard fail) and possibly DMARC if set to p=reject. EOP won’t, because of this complexity in routing, reject hard fails or DMARC rejects immediately.
So how can you tell EOP about your complex routing – this is Enhanced Filtering. You add the IPs of your on-premises network and your cloud filter to the inbound connector that you create in EOP to receive your emails. For any source you need the list of IPs and here are the IPs at the time of writing for Mimecast EU datacenters in an easy to use PowerShell cmdlet to add them to your Inbound Connector in EOP.
Set-InboundConnector "Inbound from Mimecast EU" -EFSkipIPs 126.96.36.199/24,188.8.131.52/24,184.108.40.206/22,220.127.116.11/24,18.104.22.168/24,22.214.171.124/24,126.96.36.199/24
In the above, get the name of the connector correct and it adds the IPs for you. It takes about an hour to take effect, but after this time inbound emails via Mimecast EU are skipped for spf/DMARC checking in EOP. For organisations with complex routing this is something you need to implement.