Forum Discussion

Pascal Wenders's avatar
Pascal Wenders
Brass Contributor
May 18, 2020

Hybrid Exchange 2016 - SPF record not aligned

We have a Exchange 2016 Hybrid configuration. SPF and DKIM is setup. We use DMARC for monitoring only, not for rejecting. DKIM is 100%, but SPF is only 29%

When spf verification is aligned we see our domain name. But when it is not aligned we see an office365 mail server. Example eur02-am5-obe.outbound.protection.outlook.com.

Our on premise mail servers don't deliver the messages directly to recipients mail server, they are forwarded to office 365 and then delivered to the recipients. 

 

How can I get an 100% SPF alignment when we send mails from on premise or from office 365.

 

I hope someone can give me a hint where to look for.

2016
Exchange Server
hybrid

3 Replies

  • Pierfish's avatar
    Pierfish
    Icon for Microsoft rankMicrosoft
    May 28, 2020

    Hi Pascal Wenders 

     

    if I understand correctly, you send directly to internet the email from your on premises server if the sender mailbox in onprem (the spf check will pass) and directly to internet from O365 if the mailbox is in the cloud (the spf check will fail).

     

    if this is your scenario, you have to add an include in your spf record with spf.protection.outlook.com 

    • Pascal Wenders's avatar
      Pascal Wenders
      Brass Contributor
      Jun 15, 2020

      Pierfish 

      No we send everything thru office 365. The mails from our onpremise mailservers deliver them to office 365 when it will be deliver to the recipient.

      Selector1 and 2 are defined and for the onpremise servers not.

      Is it than necessary to create the dkim records also on the onprem exchange servers

  • ExMSW4319's avatar
    ExMSW4319
    Steel Contributor
    May 19, 2020

    Pascal Wenders

    I take it you have listed your on-premises equipment in your SPF record even though you do not plan to send directly from it, and that you have then tested the SPF record with a third party such as Dmarcian?

    https://dmarcian.com/spf-survey/

    If you are playing around with your DNS records directly, always test with a banked or minor domain before changing the principle records. Set your TTL as short as your provider will permit and monitor propagation with one of the global checkers as well as doing your own digs.

    https://www.whatsmydns.net/

    If you have to ask a third party to amend your DNS records, it might be worth asking them "what do you think?" Some will be able to help and others will cheerfully publish nonsense.