Emails being blocked by Gmail from office 365

I have the same issue, this is not an issue with your reputation at gmail, it is not an issue with your SPF or your DKIM setup, this is an issue with the Microsoft server that is sending your email not having a DNS entry that a recieving mail server can use to verify the soruce of your email.

In a quick description of SPF, you create a record on your DNS server to let other servers know who can send emails on your behalf. When you add "spf.protection.outlook.com" to your record, you are letting other email servers know that MS can send emails on behalf of your organisation.

What is causing the issue?

1. The server recieving your email (i,e. Google) will check your SPF record
2. It then tries to resolve the address of the server that sent the email
3. The Microsoft server sending the email does not have a DNS entry
4. The recieving server then treats the email as spam
5. Goggle is nice enough to send you an email letting you know there was a problem, lots of other servers will ditch the emails and not let you know.

To verify this for your self, look in the mail header that google sent to you and try to use a reverse ipv6 DNS lookup (google for an online tool) to resolve the name for the address, if it doesn't resolve to a "protection.outlook.com" address than that is what is causing the issue.

Do mail connectors resolve the issue?

Setting up a connector for a given domain, then specifying IPv4 addresses will force Micosoft to sent the email using an IPv4 address. It just so happens that this IPv4 address resolves correctly to a protection.outlook.com address and the email is accepted as normal.

Unfortunately the described fix will only work for emails to google, you will need to find all the domains that are failing to accept your emails and setup a connector for each. We have about 40 odd connectors to use for customers that are using google to host their email.

How do I know when my emails are being denied?

There is a service provided by Valimail which can collect and analyse email delivery, no affiliation, just a great tool.

How do we fix it?

Provide this information to your MS service rep, if they tell you to modify your SPS or DKIM records, ask them to escalate your call to an engineer or someone who understands that Microsoft is the only one who can fix this issue as they are they ones that publish the DNS records for their servers.

The problem seems to be fixed!

Every so often your tenant is rotated to a new email server, if you happen to get assigned to one where the DNS address is correctly published, then everything works as normal again, the only problem is you will eventually be rotated back to the server with the bad DNS configuration and all the problems come back. This happened to me, took down all the connectors, then a week later all the emails started failing again.

See my reply from March 21st.

In Exchange admin center, I created a connector that forces O365 to use IPv4 when sending emails to gmail accounts.

Updated 22 April 2024

Issue: Your O365 hosted email bounces back as SPAM from any g-mail/google hosted domain.

SOLUTION: Create a DMARC record for your domain

---

The "TRUE" solution is to add a DMARC record to your domains DNS records. I won't go into details of what dmarc is, but you can read it here: https://dmarc.org/  . The simplified version is that "YOU" are sent reports by ISPs regarding how your domain name is being used.

**If you do not know how to add a record into your DNS server, contact the person who manages it for you".

The record is very easy to build. It requires sending to an valid email address. I strongly recommend creating "THIS/AN" special email address (a group based distribution list that can receive email from outside your org). I use dmarc@ for all my domains email.

The format in DNS is as follows

HOST: _dmarc

VALUE: v=DMARC1; p=none; rua=mailto:YourEmailAddress; ruf=mailto:YourEmailAddress fo=1:d:s

TTL: I prefer 1Hour but you can choose anything.

Once it is set up correctly, you can test this by going to https://mx****/dmarc.aspx

That is all there is too it. No need for special mail flow rules.

Michael B. Morell, CISSP #431307 CCSK

Information Security Professional

DirectionWeb Inc.

** I am leaving the below for research purposes on how to properly create a mail flow rule **

Solution: Create a "Mail Flow Connector" within the Exchange Admin Center. The mail flow connecter will be used for the domains you are having issues sending to.

---

Assumptions: 1. You have at a minimum, a properly formatted SPF record published in DNS. 2. You have access to the exchange admin console.

==========================================

--- How to create a Connector to GMAIL/Google MX servers ---

==========================================

1. Get a list of MX servers for the domains you are having issues with.

• Open a command prompt
• Type: nslookup
• Type: set type=mx <enter>
• Type: DOMAINNAME <enter>

** where DOMAINNAME is the domain you are having issues with.

2. Repeat #1 if you are having issues with multiple domains
3. You should see output like this:

DOMAINNAME.com MX preference = 10, mail exchanger = aspmx2.googlemail.com

DOMAINNAME.com MX preference = 10, mail exchanger = aspmx3.googlemail.com

DOMAINNAME.com MX preference = 1, mail exchanger = aspmx.l.google.com

DOMAINNAME.com MX preference = 5, mail exchanger = alt1.aspmx.l.google.com

DOMAINNAME.com MX preference = 5, mail exchanger = alt2.aspmx.l.google.com4

gmail.com MX preference = 40, mail exchanger = alt4.gmail-smtp-in.l.google.com

gmail.com MX preference = 10, mail exchanger = alt1.gmail-smtp-in.l.google.com

gmail.com MX preference = 20, mail exchanger = alt2.gmail-smtp-in.l.google.com

gmail.com MX preference = 30, mail exchanger = alt3.gmail-smtp-in.l.google.com

gmail.com MX preference = 5, mail exchanger = gmail-smtp-in.l.google.com

4. Make a note of the "MX preference = #"** Choose 2 with the highest number value I use these because they are the "last ones in the list a mail server will send to." But you can try to use any.
5. Go to your exchange admin center This URL will bring you to the exact location you need to be at: https://admin.exchange.microsoft.com/#/connectors
6. Press "Add a Connecter"

7. Choose

• Connection from "Office 365"
• Connection to "Your Organization's email server"

Press Next

8. Enter in a name: Route thru Google (it can be anything)

Description: This will route all email to google hosted domains we are having issue with. Any new domains discovered to be having issues can be added to this rule. This rule supports multiple destination domains.

Check the two boxes

• Turn it on
• Retain internal exchange email headers

Press Next

9. Enter a domain you are having issues with. One at a time.

"Only when email messages are sent to these domains"

Type gmail.com and press the Plus sign on the far right.

Enter in the remaining domains. **There is no limit**

Press Next

10. You will enter in the "mail exchangers" from step 3 here.

It is the same procedures as step 9. Add one in at a time.

**Important, you MUST enter in mail exchangers

Press Next

11**.** In the security restrictions, leave the defaults as they are.

Press Next

12. The Validation. This is very misleading. You DO NOT enter in YOUR email. You enter in an email address(s) from at least one of the domains from step 9.

Once you add in the email address(s), press Validate. The validation process takes a minute or two, so be patient.

If the "Send Test Message" does not succeed, you will need to recheck the MX records.

**Tip- If it fails, Make sure you are not trying to add a domain that exists in another transport rule. It will fail.

Press Next

13. Press Create Connector

You can now send emails to those domains that did not work before.

Michael B. Morell, CISSP #431307 CCSK

Information Security Professional

DirectionWeb Inc.

I switched to Office365 from an external domain yesterday and have the exact same issue. Can´t send emails to gmail accounts.

SPF, DKIM and DMARK are all configured and working fine and all the required DNS records were updated.

One other thing I noticed is that if I send emails from the old SMTP server google still accepts them. Google is only rejecting our emails coming from Office 365.

If this is not fixed until tomorrow I will have to rollback to the old server.

This is happening with all the gmail recipients, it was also noticed that i am unable to send email to other clients who are on google workspace hosted email platform..