Emails being blocked by Gmail from office 365

Unfortunately, this is not one of those "agree to disagree" scenarios. In the world of InfoSec and IT in general, things are very black and white, no room for opinions. It is all binary choices. I do not want people reading the posts and getting mislead by wrong information.

Firtst though, I would strongly recommend doing "research" on who I am and what I do for a living: Michael Morell, CISSP - Royal Caribbean Group | LinkedIn before deciding on debating the issue further and disagreeing on technical realities.

Let me put this in a different way; if my current employer, Royal Caribbean, as their Enterprise Security Architect (there is only one of me in the company), and their Enterprise Mail Team that controls 100K+ RCCL email accounts, came to me with the 2 errors that you posted. My analysis of "why" would not change as the one and only solution to fix it. (SPF, DKIM, Sender reputation, cleaning up mail lists, throttling based on domain)

If they came to me regarding not being able to send to Gmail, my analysis of "why" would not change as the one and only solution to fix it. (DMARC).

The same exact solutions that I would do for a multi-national company like RCCL with 100K+ users, is the same exact solutions that I would do if a small, 1 person "mom and pop" company came to me via "DirectionWeb Inc." (my InfoSec consulting firm).

Scale has no bearing on the root causes and the fixes. Sure, you can do band-aids that "may" work in the short term. But as a professional and a CISSP, my job is to provide the correct and competent resolutions. Don't take my word for that, take ISC2's word in their Code of Ethics that we (CISSPs) must adhere to: ISC2 Code of Ethics

The jist is, this is a learning opportunity for you, and others reading this, to absorb knowledge from someone who is a literal expert in this field for now 26years. Someone who has built their own mailservers from postfix, sendmail, and the very first versions of Exchange Server "5.5". I hold other certs such as the CCSK, CCNP, RHCE and MCSE+I (since 1999).

I guess we will have to agree to disagree on the root cause but I'm humble enough to change my opinion if the evidence supports it.

It ain’t what you don’t know that gets you into trouble. It’s what you know for sure that just ain’t so. - Mark Twain

B

J

Sorry, I wrote to the wrong topic. I haven't exchange server. Too many threads about similar issues and I follow them all. I am complaining about outlook.cz domain.

(syntax), nice catch apologies, it was probably me changing mine from "my email" to YourEmailAddress

(I'll fix it so no one else wastes their time...)

Onto the question about sub-domains, which is an excellent btw. The answer is both Yes and No.

So, let's start with no. If your sub-domain has no DMARC record, it will inherit the parent domain as long as you have the policy tag (which my example does, which is set to "none" ).

Policy tags are hierarchal. the tag p= is for the top level domain. sp= is for sub-domains. What this means is that you can force different policies for a TLD and its Sub-Domains. So if you want the TLD to be none and the subdomains to be "quarantine" it would look like this;:

p=none; sp=quarantine;

Now. here is where it get's fun. Let's say you have 4 sub-domains and you set your dmarc record at the TLD to p=none; sp=quarantine; ... BUT you want only 3 out of the 4 SD's to follow the TLD SD policy of quarantine, but then want domain 4 to do something differently like "reject"

THEN you need to have a specific dmarc record on domain 4.

BUT!, like everything it is not how you think. You would think that the dmarc record would be "sp=" but it's not. It would be "p=". And here is why. That sub-domain, for the purpose of dmarc, would think that "it is the root domain".

Now let's say in THAT sub-domain, you have 4 sub-domains that have a different policies, a "sub-sub-domain" if you will. Well then remember that the original sub-domain thinks it is the TLD. So you would need the sp= tag in that sub-domain's dmarc.

Confused?

Well, the answer is actually very simple. Unless you need different policies for your sub-domain(s), just leave the policy tag as "p=[none,reject,quarantine]

HOWEVER, if you want to be extra security conscious (which we all should be) it is a good security practice and practice in general, to be as granular as possible and layered security.

So my answer would change from "no" to "yes". Add dmarc records to EVERY TLD and Sub-Domains that you have.

Does that help?

Thank you for the detailed explanation. I have changed my DMARC setting (did one have v=DMARC1; p=quarantine; so far) and will give it a try. Btw. do I only need to set this for the top level domain if the email adresses are ******@topleveldomain.com ? Or do I also need this for all sub level domains like m365.topleveldomain.com?

Your "Value" appears to have a syntax error though. I believe after the second YourEmailAdress a semicolon is missing? Props to CoPilot helping me correct that in one minute despite researching an hour...

HOST: _dmarc

VALUE: v=DMARC1; p=none; rua=mailto:YourEmailAddress; ruf=mailto:YourEmailAddress; fo=1:d:s

TTL: I prefer 1Hour but you can choose anything.