This topic

Emails being quarantined due to failing DMARC, DKIM and SPF

jezbod — Fri, 26 Apr 2024 09:09:54 GMT

I'm a sysadmin at where I work and just sent an email to my work account to test the system.

It was quarantined due to failing DMARC and DKIM, with a soft fail on SPF.

Has anything changed in the background system?

Re: Emails being quarantined due to failing DMARC, DKIM and SPF

jezbod — Fri, 26 Apr 2024 09:27:58 GMT

Tested from Outlook 2021 (fully up to date) and webmail console. This is the result in our Defender console in Intune.

Re: Emails being quarantined due to failing DMARC, DKIM and SPF

jezbod — Fri, 26 Apr 2024 09:51:22 GMT

After getting access to the full report, it looks like it detected my BT Internet email and my work email as too similar, and classed it as user impersonation.

I'm still wondering why it fails the DMARC, DKIM and SPF tests.

Re: Emails being quarantined due to failing DMARC, DKIM and SPF

BMK — Fri, 26 Apr 2024 12:29:23 GMT

I experienced this problem mid morning. I was just emailing an online store enquiry point address. The non delivery report from the destination server was as follows:

Access denied, sending domain btinternet.com does not pass DMARC verification and has a DMARC policy of reject

This suggests SPF/DKIM was failing on my outbound message and that must be BT's fault as we have no control over that. The destination server was then acting correctly against BT's published DMARC policy by rejecting the message.

I have since sent a test message from my btinternet mailbox to a gmail mailbox I also have. That arrived OK and when I examined the headers, SPF/DKIM/DMARC are fine on that message.

I also checked btinternet.com on the MXTOOLBOX site:

SPF check - comes back OK.

v=spf1 include:_spf.btinternet.com include:bt.com ~all

DKIM check - using the following selector btinternet.com:btmx201904 returns the BT public key OK.

DMARC check - comes back OK

v=DMARC1; p=reject; sp=reject; pct=100; fo=1; rua=mailto:dmarcagg@btinternet.com; ruf=mailto:dmarcf@btinternet.com;

So whatever it was, isn't there now. A blip in the BT email world this morning perhaps?

Re: Emails being quarantined due to failing DMARC, DKIM and SPF

jezbod — Fri, 26 Apr 2024 12:28:31 GMT

Could be, all of mine that failed were from IP 195.130.217.221

This include an email from Google mail last night, which just had a SPF soft fail, DMARC and DKIM were ok.

EDIT: Ignore the IP address, it's our final link in the mail filtering system we use.