Forum Discussion
SPF, DKIM and DMARC bypassed for guest users
Can you share an example NDR/headers?
Guest users do have a matching recipient object (Mail user/Guest mail user) within Exchange Online and so messages will be "resolved" to it first, then send to where the ExternalEmailAddress points at. This however should not result in bypassing SPF and such, unless you have some fancy routing configured, or the message passes through multiple other MTAs before reaching the recipient.
You are correct. I jumped to the wrong conclusion when I thought I saw a pattern. I tried it again with my personal gmail account added as a guest user, and those emails go through. That said, I still have the problem with other gmail addresses bouncing.
The NDR headers:
And here are headers from a message sent to both my test guest user and one of the problematic guest users. The delivery to the former has since bounced.
Any ideas for next steps?