DMARC Error

[Simcfc73]

Morning,

 

This has just come to my attention and I can't figure it out.

 

We use split delivery for our emails. They go into O365 for staff and if they aren't in there they get sent to GMAIL for the pupils. All works lovely.

 

Problem is google emails are getting rejected with a DMARC error. Everything else is fine. Gmailing seems okay, its when they get invitations to edit docs it fails.

 

550-5.7.26 Unauthenticated email from google.com is not accepted due to domain's 550-5.7.26 DMARC policy. Please contact the administrator of google.com domain 550-5.7.26 if this was a legitimate mail. Please visit 550-5.7.26 https://support.google.com/mail/answer/2451690 to learn about the 550 5.7.26 DMARC initiative.

 

Anyone seen this? I'm not sure how to see the emails full headers when they are rejected either in GMAIL

[jthompson]

Is that O365 that's rejecting the email?

[Simcfc73]

No, its from the Gmail delivery report

[jthompson]

I think what's happening there is that Google generates a notification email and sends it from their own mail service, rather than from your G Suite Gmail service. That notification email will arrive at your O365 mail service (I'm assuming your domain's MX records at set to direct mail to O365). O365 routes the message on to G Suite, as per your split delivery setup. Gmail will reject the messages because your O365 service isn't authorised to send @google.com emails.

 

Not using split delivery here, so not 100% on that theory, and not sure how you'd go about resolving it.

[jthompson]

Actually, no. That's probably garbage. How would any external emails arrive into your G Suite otherwise.

 

What does the G Suite email log say that the sender IP is? That might be a place to start.

[chaplic]

I assume your SPF record has the includes for gmail and O365?

[Simcfc73]

Sorted it, I added the DMARC record to block nothing and report to me.. didn't really help till I realised I'd added another SPF record (years ago) for GMAIL. I removed it and they are working now.

 

We use Fusemail too which confuses the matter.