SOLVED

emails are getting Held because the DMARC Result Fails

%3CLINGO-SUB%20id%3D%22lingo-sub-2394839%22%20slang%3D%22en-US%22%3Eemails%20are%20getting%20Held%20because%20the%20DMARC%20Result%20Fails%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2394839%22%20slang%3D%22en-US%22%3E%3CP%3EOne%20of%20our%20colleagues%20OOF%20message%2C%20does%20not%20arrive%20at%20recipient%20-%20the%20recipients%20IT%20department%20writes%20the%20following%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%22The%20email%20was%20released%20but%20Permitting%2FWhitelisting%20the%20sender%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3CA%20href%3D%22mailto%3Amwn%40operate.dk%22%20rel%3D%22noreferrer%20nofollow%20noopener%22%20target%3D%22_blank%22%3Emwn%40operate.dk%3C%2FA%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3Ewon%E2%80%99t%20help%20from%20our%20end%20as%20the%20emails%20are%20getting%20Held%20because%20the%20DMARC%20Result%20Fails%20as%20shown%20below%20as%20their%20email%20records%20are%20not%20possibly%20correct.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThis%20needs%20to%20be%20checked%20with%20the%20sender%E2%80%99s%20Messaging%20team%20so%20that%20this%20can%20be%20rectified.%22%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Ealbeit%20my%20limited%20experience%20with%20O365%20admin%2C%20I%20found%20the%20relevant%20message%20and%20its%20corresponding%20message%20events%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22Allinilla_0-1622190091024.png%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F284566iFFEF3799145AB816%2Fimage-size%2Fmedium%3Fv%3Dv2%26amp%3Bpx%3D400%22%20role%3D%22button%22%20title%3D%22Allinilla_0-1622190091024.png%22%20alt%3D%22Allinilla_0-1622190091024.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ECan%20anyone%20point%20me%20in%20the%20right%20direction.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EMuch%20obliged%20and%20greetings%20from%20Denmark%20%3A)%3C%2Fimg%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAllin%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%20%26nbsp%3B%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-2394839%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAdmin%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2396309%22%20slang%3D%22en-US%22%3ERe%3A%20emails%20are%20getting%20Held%20because%20the%20DMARC%20Result%20Fails%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2396309%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F586627%22%20target%3D%22_blank%22%3E%40Allinilla%3C%2FA%3E%26nbsp%3BSo%20this%20sounds%20like%20DMARC%2FSPF%2FDKIM%20might%20not%20be%20set%20up%20properly.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Eoperate.dk%20has%20a%20DMARC%20policy%20of%20quarantine%20(see%20_dmarc.operate.dk%20TXT%20record)%3C%2FP%3E%3CP%3ESPF%20record%20is%20%22v%3Dspf1%20include%3Aspf.mailjet.com%20include%3Aspf.protection.outlook.com%20include%3Acmail1.com%20include%3Aspf.emailsignatures365.com%20-all%22%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EDMARC%20requires%20SPF%20and%20DKIM%20to%20be%20valid%20so%20I%20can%20only%20assume%20that%20DKIM%20is%20not%20set%20up%20correctly%20as%20I%20see%20no%20reason%20why%20that%20SPF%20record%20would%20cause%20Out%20of%20Office%20replies%20from%20365%20to%20fail.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EYou%20will%20need%20whoever%20looks%20after%20the%20admin%20side%20of%20operate.dk%20365%20tenancy%20to%20configure%20DKIM%20as%20per%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fmicrosoft-365%2Fsecurity%2Foffice-365-security%2Fuse-dkim-to-validate-outbound-email%3Fview%3Do365-worldwide%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3EHow%20to%20use%20DKIM%20for%20email%20in%20your%20custom%20domain%20-%20Office%20365%20%7C%20Microsoft%20Docs%3C%2FA%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E
Occasional Contributor

One of our colleagues OOF message, does not arrive at recipient - the recipients IT department writes the following:

 

"The email was released but Permitting/Whitelisting the sender mwn@operate.dk won’t help from our end as the emails are getting Held because the DMARC Result Fails as shown below as their email records are not possibly correct.

 

This needs to be checked with the sender’s Messaging team so that this can be rectified."

 

albeit my limited experience with O365 admin, I found the relevant message and its corresponding message events:

 

Allinilla_0-1622190091024.png

 

Can anyone point me in the right direction.

 

Much obliged and greetings from Denmark :) 

 

Allin 

 

    

1 Reply
best response confirmed by Allinilla (Occasional Contributor)
Solution

@Allinilla So this sounds like DMARC/SPF/DKIM might not be set up properly.

 

operate.dk has a DMARC policy of quarantine (see _dmarc.operate.dk TXT record)

SPF record is "v=spf1 include:spf.mailjet.com include:spf.protection.outlook.com include:cmail1.com include:spf.emailsignatures365.com -all"

 

DMARC requires SPF and DKIM to be valid so I can only assume that DKIM is not set up correctly as I see no reason why that SPF record would cause Out of Office replies from 365 to fail.

 

You will need whoever looks after the admin side of operate.dk 365 tenancy to configure DKIM as per How to use DKIM for email in your custom domain - Office 365 | Microsoft Docs