Arbor O365 Email Configuration

[Michael]

Afternoon all,

 

The instructions supplied by Arbor here are not clear.

 

What steps did you take so emails generated by Arbor are not being sent to Junk on a vanilla O365 setup.

[paulkerton]

Have you got SPF/DKIM and DMARC set up?

[Michael]

I've amended the SPF record, so it reads like this:

 

v=spf1 include:spf.protection.outlook.com ip4:50.31.43.182 ip4:168.245.59.25 include:arbor-education.com -all

 

I haven't done anything with DMARC, as in Microsoft's words, any inbound email is taken care of.

[andy_b]

We just had to setup some CNAMES:

 

CNAME AAA.XXX.YYY.ZZZ u189XXX.wl225.sendgrid.net

CNAME XXX._domainkey.XXX.YYY.ZZZ XXX.domainkey.u189XXX.wl225.sendgrid.net

CNAME XXX._domainkey.XXX.YYY.ZZZ XXX.domainkey.u189XXX.wl225.sendgrid.net

 

exact format were provided by support.

Edited April 4, 2022 by andy_b

[paulkerton]

I haven't done anything with DMARC, as in Microsoft's words, any inbound email is taken care of.

Oh....

[Primus]

I've amended the SPF record, so it reads like this:

 

v=spf1 include:spf.protection.outlook.com ip4:50.31.43.182 ip4:168.245.59.25 include:arbor-education.com -all

 

I haven't done anything with DMARC, as in Microsoft's words, any inbound email is taken care of.

 

But it's being sent from your domain so it's following the settings you apply to that domain. If you haven't put in place DMARC then it won't be failing because of DMARC but you really should consider using it.

[Michael]

We just had to setup some CNAMES:

 

CNAME AAA.XXX.YYY.ZZZ u189XXX.wl225.sendgrid.net

CNAME XXX._domainkey.XXX.YYY.ZZZ XXX.domainkey.u189XXX.wl225.sendgrid.net

CNAME XXX._domainkey.XXX.YYY.ZZZ XXX.domainkey.u189XXX.wl225.sendgrid.net

 

exact format were provided by support.

 

Thanks, that looks about right to me.

 

I've asked for the school CNAME record, but been informed it'll take a few days

[Michael]

Oh....

[ATTACH=CONFIG]65203[/ATTACH]

 

But in hindsight, I think the Microsoft advice is a bit bogus, but it's there in black and white -

 

[andy_b]

Thanks, that looks about right to me.

 

I've asked for the school CNAME record, but been informed it'll take a few days

 

Yeah took a couple of days, added to DNS and then it was fine (after a few hours "dns").

 

Only noticed it was happening because NCSC Mail check was flagging the Arbor emails.

[Michael]

But it's being sent from your domain so it's following the settings you apply to that domain. If you haven't put in place DMARC then it won't be failing because of DMARC but you really should consider using it.

 

This is just it - even with the SPF record amended and DMARC disabled, emails generated from Arbor were still going into Junk.

 

I have enabled DKIM now, so just waiting on the CNAME record.

[Primus]

This is just it - even with the SPF record amended and DMARC disabled, emails generated from Arbor were still going into Junk.

 

I have enabled DKIM now, so just waiting on the CNAME record.

 

For what reason - can you see from the headers what's causing the junk filtering?

 

Have you checked your SPF record is now compliant as when I did it for us I had to alter it as their default settings led to the SPF record becoming invalid.

[Michael]

The SPF record looks/tests fine, but it states the maximum number of lookups has exceeded 10.

[Primus]

The SPF record looks/tests fine, but it states the maximum number of lookups has exceeded 10.

 

You'll need to resolve that.

[Michael]

Thanks - this appears to have done the trick -

 

v=spf1 include:spf.protection.outlook.com ip4:167.89.0.0/17 ip4:208.117.48.0/20 ip4:50.31.32.0/19 ip4:198.37.144.0/20 ip4:198.21.0.0/21 ip4:192.254.112.0/20 ip4:168.245.0.0/17 ip4:149.72.0.0/16 ip4:223.165.113.0/24 ip4:223.165.115.0/24 ip4:223.165.118.0/23 ip4:223.165.120.0/23 -all

[Michael]

Hi all,

 

These are the steps I took (to help other Arbor schools in future)

 

Sign into O365 using this URL - https://security.microsoft.com/dkimv2

 

Select your real email domain and select enabled. You'll be prompted to add two CNAME records (if not already enabled):

 

Name: selector1._domainkey
Value: selector1-school-sch-uk._domainkey.school.onmicrosoft.com

Name: selector2._domainkey
Value: selector2-school-sch-uk._domainkey.school.onmicrosoft.com

 

Wait 5/10 minutes, then return back to https://security.microsoft.com/dkimv2 and select Enabled.

 

Amend your SPF record as follows -

 

O365 schools -

 

v=spf1 include:spf.protection.outlook.com ip4:167.89.0.0/17 ip4:208.117.48.0/20 ip4:50.31.32.0/19 ip4:198.37.144.0/20 ip4:198.21.0.0/21 ip4:192.254.112.0/20 ip4:168.245.0.0/17 ip4:149.72.0.0/16 ip4:223.165.113.0/24 ip4:223.165.115.0/24 ip4:223.165.118.0/23 ip4:223.165.120.0/23 -all

 

G Suite schools -

 

v=spf1 include:_spf.google.com ip4:167.89.0.0/17 ip4:208.117.48.0/20 ip4:50.31.32.0/19 ip4:198.37.144.0/20 ip4:198.21.0.0/21 ip4:192.254.112.0/20 ip4:168.245.0.0/17 ip4:149.72.0.0/16 ip4:223.165.113.0/24 ip4:223.165.115.0/24 ip4:223.165.118.0/23 ip4:223.165.120.0/23 -all

 

Hybrid schools (using both O365 and G Suite features) -

 

v=spf1 include:spf.protection.outlook.com include:_spf.google.com ip4:167.89.0.0/17 ip4:208.117.48.0/20 ip4:50.31.32.0/19 ip4:198.37.144.0/20 ip4:198.21.0.0/21 ip4:192.254.112.0/20 ip4:168.245.0.0/17 ip4:149.72.0.0/16 ip4:223.165.113.0/24 ip4:223.165.115.0/24 ip4:223.165.118.0/23 ip4:223.165.120.0/23 -all

 

Contact Arbor support via their web chat facility, give them your school domain name and request the required CNAME records (you'll be given three) -

 

Name: mbs._domainkey
Value: MBS.domainkey.uxxxxxx.wlxxx.sendgrid.net

Name: mbs2._domainkey
Value: MBS2.domainkey.uxxxxxx.wlxxx.sendgrid.net

Name: emxxxx
Value: uxxxxxx.wxxxx.sendgrid.net

[mullet_man]

Hi @Michael

 

Thanks for this information, we've recently moved to Arbor so I've just asked our LA to make the DNS changes for us.

 

Cheers.