Updated 22 April 2024
Issue: Your O365 hosted email bounces back as SPAM from any g-mail/google hosted domain.
SOLUTION: Create a DMARC record for your domain
The "TRUE" solution is to add a DMARC record to your domains DNS records. I won't go into details of what dmarc is, but you can read it here: https://dmarc.org/ . The simplified version is that "YOU" are sent reports by ISPs regarding how your domain name is being used.
**If you do not know how to add a record into your DNS server, contact the person who manages it for you".
The record is very easy to build. It requires sending to an valid email address. I strongly recommend creating "THIS/AN" special email address (a group based distribution list that can receive email from outside your org). I use dmarc@ for all my domains email.
The format in DNS is as follows
HOST: _dmarc
VALUE: v=DMARC1; p=none; rua=mailto:YourEmailAddress; ruf=mailto:YourEmailAddress fo=1:d:s
TTL: I prefer 1Hour but you can choose anything.
Once it is set up correctly, you can test this by going to https://mx****/dmarc.aspx
That is all there is too it. No need for special mail flow rules.
Michael B. Morell, CISSP #431307 CCSK
Information Security Professional
DirectionWeb Inc.
** I am leaving the below for research purposes on how to properly create a mail flow rule **
Solution: Create a "Mail Flow Connector" within the Exchange Admin Center. The mail flow connecter will be used for the domains you are having issues sending to.
Assumptions: 1. You have at a minimum, a properly formatted SPF record published in DNS. 2. You have access to the exchange admin console.
==========================================
--- How to create a Connector to GMAIL/Google MX servers ---
==========================================
- Get a list of MX servers for the domains you are having issues with.
- Open a command prompt
- Type: nslookup
- Type: set type=mx <enter>
- Type: DOMAINNAME <enter>
** where DOMAINNAME is the domain you are having issues with.
- Repeat #1 if you are having issues with multiple domains
- You should see output like this:
DOMAINNAME.com MX preference = 10, mail exchanger = aspmx2.googlemail.com
DOMAINNAME.com MX preference = 10, mail exchanger = aspmx3.googlemail.com
DOMAINNAME.com MX preference = 1, mail exchanger = aspmx.l.google.com
DOMAINNAME.com MX preference = 5, mail exchanger = alt1.aspmx.l.google.com
DOMAINNAME.com MX preference = 5, mail exchanger = alt2.aspmx.l.google.com4
gmail.com MX preference = 40, mail exchanger = alt4.gmail-smtp-in.l.google.com
gmail.com MX preference = 10, mail exchanger = alt1.gmail-smtp-in.l.google.com
gmail.com MX preference = 20, mail exchanger = alt2.gmail-smtp-in.l.google.com
gmail.com MX preference = 30, mail exchanger = alt3.gmail-smtp-in.l.google.com
gmail.com MX preference = 5, mail exchanger = gmail-smtp-in.l.google.com
- Make a note of the "MX preference = #"** Choose 2 with the highest number value I use these because they are the "last ones in the list a mail server will send to." But you can try to use any.
- Go to your exchange admin center This URL will bring you to the exact location you need to be at: https://admin.exchange.microsoft.com/#/connectors
- Press "Add a Connecter"

- Choose
- Connection from "Office 365"
- Connection to "Your Organization's email server"

Press Next
- Enter in a name: Route thru Google (it can be anything)
Description: This will route all email to google hosted domains we are having issue with. Any new domains discovered to be having issues can be added to this rule. This rule supports multiple destination domains.
Check the two boxes
- Turn it on
- Retain internal exchange email headers

Press Next
- Enter a domain you are having issues with. One at a time.
"Only when email messages are sent to these domains"
Type gmail.com and press the Plus sign on the far right.
Enter in the remaining domains. **There is no limit**

Press Next
- You will enter in the "mail exchangers" from step 3 here.
It is the same procedures as step 9. Add one in at a time.
**Important, you MUST enter in mail exchangers


Press Next
11**.** In the security restrictions, leave the defaults as they are.

Press Next
- The Validation. This is very misleading. You DO NOT enter in YOUR email. You enter in an email address(s) from at least one of the domains from step 9.
Once you add in the email address(s), press Validate. The validation process takes a minute or two, so be patient.
If the "Send Test Message" does not succeed, you will need to recheck the MX records.
**Tip- If it fails, Make sure you are not trying to add a domain that exists in another transport rule. It will fail.


Press Next
- Press Create Connector

You can now send emails to those domains that did not work before.
Michael B. Morell, CISSP #431307 CCSK
Information Security Professional
DirectionWeb Inc.