Defend is built on a cloud-native architecture hosted on AWS, designed to keep your email protection running even in the extremely unlikely event of a major infrastructure failure.

Availability Zones

Each Defend deployment runs across three AWS Availability Zones (AZs). Each AZ is a physically isolated location within an AWS region with independent power, networking, and cooling infrastructure.

This means that even if one or two Availability Zones in a region were to go completely offline, Defend would continue to function without service interruption and with no customer impact.

Dual-Region Active-Active

Defend goes a step further by load-balancing traffic across two independent AWS regions. Both regions are active at all times, with automatic health checks continuously monitoring each deployment. If a deployment becomes unhealthy, traffic is automatically routed to the healthy region without any manual intervention. The regions used per environment are listed in the table below:  

In the extremely unlikely event that an entire AWS region fails, Defend automatically fails over to the healthy region with no interruption to the service.  

What Happens During an Outage

What happens in an outage scenario depends on your Defend deployment mode.

SMTP Mode

Defend sits inline in the email delivery path. A full single-region failure triggers seamless automatic failover, with email continuing to flow with full scanning and banners and no interruption to service. Only if both regions were unavailable at the same time would emails queue temporarily, and they would be delivered once service is restored, arriving with Defend teachable banners intact.

Graph API Mode

Microsoft delivers emails directly to users' inboxes. In an extremely unlikely outage scenario, emails will still arrive in inboxes but will not be scanned by Defend.

Defend IP Addresses by Region

As part of ongoing improvements to maintain high availability and resiliency across our platforms, changes have been made to the Defend backend infrastructure, bringing additional IP addresses into service. The full updated list of Defend IP addresses is below, including the newest ones highlighted in bold.

Alternatively, you can query the relevant Defend SPF record to get the latest set of IP addresses.

• UK - spf.london.aquilaiajax.com
• US - spf.us1.defend.egress.com
• EU - spf.eu1.defend.egress.com
• AU - spf.au1.defend.egress.com