DMARC failure on forwarded SharePoint Online emails

Question

I have a client that uses SharePoint Online but insists on using Gmail. Each user has a O365 account with an Exchange Online mailbox and mail flow/delivery options are set to forward all incoming mail to the corresponding user's Gmail address.

From Monday (08/10/2018), all forwarded mail from [email protected] (the default from-address of SharePoint Online used for alerts and workflow email) has ended up in the Spam folder of each user's Gmail account. The same happens when forwarding to a @outlook.com account.

It appears that the forwarded mails are failing DMARC so are being quarantined by the recipient mailbox.

Header:

Authentication-Results: spf=pass (sender IP is 213.199.154.180)
smtp.mailfrom=mytenant.onmicrosoft.com; outlook.com; dkim=pass (signature was
verified) header.d=mytenant.onmicrosoft.com;outlook.com; dmarc=fail
action=oreject header.from=sharepointonline.com;

Received-SPF: Pass (protection.outlook.com: domain of mytenant.onmicrosoft.com
designates 213.199.154.180 as permitted sender)
receiver=protection.outlook.com; client-ip=213.199.154.180;
helo=EUR01-DB5-obe.outbound.protection.outlook.com;

The way I understand it, DKIM and SPF are passing but DMARC is failing because the header.d address does not match the header.from address.

Is that about right? Is there any way around this? Is there some way I can "whitelist" the sharepointonline.com domain so that these forwarded mails are no longer quarantined?

I don't fully understand how all this works but shouldn't this not be a problem as mytenant.microsoft.com and sharepointonline.com are both MS-owned domains?

Answer 1

The way I understand it, DKIM and SPF are passing but DMARC is failing because the header.d address does not match the header.from address. Is that about right?

Yes it is. The same goes for SPF, the smtp.mailfrom and header.from domains don't align.

Is there any way around this?

I won't go into why on earth you'd choose a setup like this, with Office 365 forwarding everything to Gmail... To solve this, you might create a complex transport rule in Exchange Online to match for emails sent on behalf of SharePoint and change the Sender. I would not recommend it though.

Is there some way I can "whitelist" the sharepointonline.com domain so that these forwarded mails are no longer quarantined?

I'm not sure how Google treats safe senders, but excluding those from mail filtering would shoot a hole in your anti-spoofing / anti-phishing defense.

I don't fully understand how all this works but shouldn't this not be a problem as mytenant.microsoft.com and sharepointonline.com are both MS-owned domains?

Google doesn't care. The DMARC rules state that domains used for SPF and DKIM must align with the header.from domain.