You have a Microsoft Exchange Online tenant.

All users use an email address suffix of @contoso.com.

You need to ensure that all the email messages sent to users who use an email address suffix of @fabrikam.com are encrypted automatically. The solution must ensure that the messages can be inspected for data loss prevention (DLP) rules before they are encrypted.

What should you create?