1

I have a client that uses SharePoint Online but insists on using Gmail. Each user has a O365 account with an Exchange Online mailbox and mail flow/delivery options are set to forward all incoming mail to the corresponding user's Gmail address.

From Monday (08/10/2018), all forwarded mail from no-reply@sharepointonline.com (the default from-address of SharePoint Online used for alerts and workflow email) has ended up in the Spam folder of each user's Gmail account. The same happens when forwarding to a @outlook.com account.

It appears that the forwarded mails are failing DMARC so are being quarantined by the recipient mailbox.

Header:

Authentication-Results: spf=pass (sender IP is 213.199.154.180)
smtp.mailfrom=mytenant.onmicrosoft.com; outlook.com; dkim=pass (signature was
verified) header.d=mytenant.onmicrosoft.com;outlook.com; dmarc=fail
action=oreject header.from=sharepointonline.com;

Received-SPF: Pass (protection.outlook.com: domain of mytenant.onmicrosoft.com
designates 213.199.154.180 as permitted sender)
receiver=protection.outlook.com; client-ip=213.199.154.180;
helo=EUR01-DB5-obe.outbound.protection.outlook.com;

The way I understand it, DKIM and SPF are passing but DMARC is failing because the header.d address does not match the header.from address.

Is that about right?

Is there any way around this?

Is there some way I can "whitelist" the sharepointonline.com domain so that these forwarded mails are no longer quarantined?

I don't fully understand how all this works but shouldn't this not be a problem as mytenant.microsoft.com and sharepointonline.com are both MS-owned domains?

Many thanks.

  • Has the user been moving the email from Spam into Inbox? This might train Gmail that the emails are not spam even though they are failing dmarc. – Maximillian Laumeister May 19 at 16:09
0

The way I understand it, DKIM and SPF are passing but DMARC is failing because the header.d address does not match the header.from address. Is that about right?

Yes it is. The same goes for SPF, the smtp.mailfrom and header.from domains don't align.

Is there any way around this?

I won't go into why on earth you'd choose a setup like this, with Office 365 forwarding everything to Gmail... To solve this, you might create a complex transport rule in Exchange Online to match for emails sent on behalf of SharePoint and change the Sender. I would not recommend it though.

Is there some way I can "whitelist" the sharepointonline.com domain so that these forwarded mails are no longer quarantined?

I'm not sure how Google treats safe senders, but excluding those from mail filtering would shoot a hole in your anti-spoofing / anti-phishing defense.

I don't fully understand how all this works but shouldn't this not be a problem as mytenant.microsoft.com and sharepointonline.com are both MS-owned domains?

Google doesn't care. The DMARC rules state that domains used for SPF and DKIM must align with the header.from domain.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.