: DMARC failure on forwarded SharePoint Online emails I have a client that uses SharePoint Online but insists on using Gmail. Each user has a O365 account with an Exchange Online mailbox and mail

Posted in: #Dkim #Dmarc #Email #Sharepoint #Spf

I have a client that uses SharePoint Online but insists on using Gmail. Each user has a O365 account with an Exchange Online mailbox and mail flow/delivery options are set to forward all incoming mail to the corresponding user's Gmail address.

From Monday (08/10/2018), all forwarded mail from no-reply@sharepointonline.com (the default from-address of SharePoint Online used for alerts and workflow email) has ended up in the Spam folder of each user's Gmail account. The same happens when forwarding to a @outlook .com account.

It appears that the forwarded mails are failing DMARC so are being quarantined by the recipient mailbox.

Header:

Authentication-Results: spf=pass (sender IP is 213.199.154.180)
smtp.mailfrom=mytenant.onmicrosoft.com; outlook.com; dkim=pass (signature was
verified) header.d=mytenant.onmicrosoft.com;outlook.com; dmarc=fail
action=oreject header.from=sharepointonline.com;

Received-SPF: Pass (protection.outlook.com: domain of mytenant.onmicrosoft.com
designates 213.199.154.180 as permitted sender)
receiver=protection.outlook.com; client-ip=213.199.154.180;
helo=EUR01-DB5-obe.outbound.protection.outlook.com;

The way I understand it, DKIM and SPF are passing but DMARC is failing because the header.d address does not match the header.from address.

Is that about right?

Is there any way around this?

Is there some way I can "whitelist" the sharepointonline.com domain so that these forwarded mails are no longer quarantined?

I don't fully understand how all this works but shouldn't this not be a problem as mytenant.microsoft.com and sharepointonline.com are both MS-owned domains?

Many thanks.