[LBBS-138] mail: Forwarded messages through Office 365 can fail DMARC
This issue is summed up in a few places:
- https://old.reddit.com/r/Office365/comments/1ipfbxh/microsoft_sending_emails_from_ip_addresses_that/
- https://learn.microsoft.com/en-us/defender-office-365/outbound-spam-high-risk-delivery-pool-about
It seems Microsoft will sometimes forward mail through IPs that are not in their SPF record.
For forwarded mail, this causes SPF to fail.
On top of that, DKIM is failing due to the DKIM signature being invalid for some reason:
[2026-03-04 06:28:05.221] DEBUG[3807935]: net_smtp.c:1824 smtp_run_filters: Executing IN SMTP filter PREPEND DKIM Verify...
[2026-03-04 06:28:05.249] ERROR[3807935]: mod_smtp_filter_dkim.c:201 dkim_verify_filter_cb: DKIM verification failed: Bad signature ()The result is messages fail DMARC:
Authentication-Results: RECEIVING-MAIL-SERVER;
spf=fail smtp.mailfrom=SRS+REDACTED@hotmail.com;
arc=none;
dmarc=fail (p=quarantine sp=none dis=quarantine) header.from=phreaknet.org
Received-SPF: fail (bbs: domain of hotmail.com does not designate 40.93.1.36 as permitted sender) client-ip=40.93.1.36; envelope-from=SRS+REDACTED@hotmail.com; helo=SJ2PR03CU001.outbound.protection.outlook.com;The MAIL FROM is an SRS rewritten @hotmail.com address in this case.
And, depending on the DMARC policy, messages may be quarantined or rejected outright - possibly further triggering an inappropriate bounce as described in [LBBS-137].
There should be some way to compensate for Microsoft's stupidity here, perhaps a setting to whitelist certain ranges for certain domain suffixes as provided in HELO/EHLO/MAIL FROM.
Comments
You must be logged in to leave a comment.