I am having issue that Yahoo emails are not reaching recipients.

That's an Exchange management question. Post it here: https://learn.microsoft.com/en-us/answers/tags/342/office-exchange-server-management

Hi everyone,

So yes, I have been having this issue for quite some time now, the issue I have that our email server's DKIM and SPF configuration are a bit incorrect you might say.

So, for starters, I've changed the SPF key on my external DNS, which is quite straight forward.

For my DKIM key, it's a bit tricky since our Exchange Server (Exchange Server 2016) doesn't have support native DKIM signature, so I download the 3rd party signer here: https://github.com/Pro/dkim-exchange/wiki and I changed the public key for the DKIM signer on our Exchange server and external DNS server.

After the troubleshoot, testing out our email to https://www.mail-tester.com/ and MxToolbox, giving result that our SPF and DKIM are up to date. That's okay but I still can't send email to a Yahoo user.

After further checking, we noticed that our PTR records in the original messages (we only checked Gmail) has a bit of difference before and after the issue, our email scanner server cannot be translated to it's public DNS address. Anyone can suggest why this is happening and what I can do to mitigate this issue?

Forget about non admins, I'm a mail admin and your post is still a bit confusing to me but I understand the big picture. No offense but I highly doubt non mail admin can understand the post.

>> They have done things to my domain DNS record that have been ineffective and/or that I learned subsequently breaks DNS - eg entering multiple SPF records. I have escalated to management on 2 occasions but been told it will go away by itself, or been told its a google problem.

The problem is editing a DNS record actually adds a new entry but it does not delete the old entry. That's how you end up with 2 SPF records. Edit normally adds a new one and automatically deletes the old one. Many GoDaddy customers have multiple SPF records problem. It makes it invalid and resulting in their email getting rejected.

>> Why this wasn't done when Microsoft 365 on GoDaddy was set up, I don't know.

I don't know how you get your mail hosting service, I did everything myself. That includes setting up SPF, DMARC and DKIM records correctly since the beginning of my subscription. I suspect GoDaddy didn't take care of it because it wasn't mandatory in the past or they expect customers do that on their own.

Most users who experience this problem are just mail users. They post problem here and wait/expect someone will fix it someday. They don't realize they are the only ones who can fix the problem.

I have been following a few similar discussion threads. I have told them the problem and what needs to be fixed. Occasionally I check back to see if they fix their DNS records. Nope. They're still missing or have invalid records. That tells me they don't understand my replies.

I have been fighting the same (I assume) issue since November 2023. What follows might help, i don't know.

I have 3 domains hosted by Godaddy, with email forwarding to different gmail accounts. It seems that the issues started when gmail began insisting on stricter policies by domain hosts like Godaddy. Yahoo etc followed suit. The support I have had from Godaddy to fix this has been woeful. I have placed many support calls with Godaddy, often hours long, occasionally dropped after hours on the line. They have done things to my domain DNS record that have been ineffective and/or that I learned subsequently breaks DNS - eg entering multiple SPF records. I have escalated to management on 2 occasions but been told it will go away by itself, or been told its a google problem. I am still fighting, with the most recent skirmish on March 19. I am NOT proficient in DNS etc, so do your own research and don't take what I say as gospel, but here's what I have learned so far:

The domain DNS record (ie hosted by Godaddy) must have an SPF record. I read that Google must find a character string in that also, which means you need a combined SPF record, for example: type= TXT, name= "@", data= "v=spf1 a:dispatch-us.ppe-hosted.com include:secureserver.net include:_spf.google.com ~all"

Any and all changes to SPF did not fix the issue, but I understand that it's a necessary precursor. Godaddy tech only put in "v=spf1 a:dispatch-us.ppe-hosted.com include:secureserver.net -all" without Google's recommended: "v=spf1 include:_spf.google.com ~all"

The domain DNS must also have a DKIM record. Only !!yesterday!! did Godaddy Tech support add one!! The process requires someone in godaddy generating a very long character string (a domain key?) and then mailing it to me for ME to paste into the DNS record!! Why this wasn't done when Microsoft 365 on GoDaddy was set up, I don't know.

Adding DKIM also did not fix the issue, but I understand that it's a necessary precursor.

Today I added a DMARC record, since google and an online tool called MXToolbox say it is necessary. The SPF and DKIM are necessary precursors. Time will tell if this - finally - fixes the issue. I'm not holding by breath.

Here is the godaddy page on adding DMARC: https://www.godaddy.com/help/add-a-dmarc-record-to-my-domain-for-microsoft-365-42204 and I recommend the chart in this page to make a bit more sense of of everything: https://dmarc.org/overview/ 

Here's the MXToolbox site that checks the DNS settings of your domain regarding email: https://mx****/MXLookup.aspx 

I also tried adding a Google site verification key in my DNS. Google generates a key that you put as a TXT value in the domain DNS. But doing that didn't help. Here's the link to Google Postmaster tools including the bit that generates the key: https://postmaster.google.com/u/0/managedomains 

Bottom line - This is all stuff I pay Godaddy to do, but they clearly are unable to do it effectively, and meanwhile many vital email communications are still going missing, months later.

Our issue has been occurring for approximately 2 weeks now. I contacted Yahoo, and they stated it's either Microsoft or our host (GoDaddy), and GoDaddy states there is nothing wrong on their end. Microsoft doesn't seem to be taking this very seriously.

Who knows where the problem is originating, but it seems to be somewhat widespread, so it would be nice if whoever's system is causing it would do something to fix it. Especially since we are unable to communicate with our customers who have a Yahoo email account, I'm confident we are not the only company dealing with this right now.

I agree!! It's been happening for months and Microsoft isn't addressing it. Even IF it is on the Yahoo end, as widespread as this is and the # of MS users affected, MS should have a vested interest in the resolution. The fact that they don't makes me want to take the company OFF 365 and go back to what we were using before.

It's a multi-layered issue:

1. Yahoo implemented more stringent email requirements to better block spam. Ultimately this is the root cause, but the issue is that they changed their requirements and it's OTHER web sites (senders) that are not configured to meet their requirements. It doesn't appear that Yahoo is going to relax their requirements.
2. Microsoft 365 email has the capability to comply with the requirements but it has to be enabled. It is not automatic.
3. Even once it's enabled within Microsoft 365, any custom domain (i.e. if you own your domain name) has to have those settings also propagated into DNS, which is outside BOTH Microsoft's and (obv) Yahoo's control, so that's something that neither can fix. BTW if you switch to a new email system without making those DNS changes, you may find yourself in the same boat.

As the IT gurus (not me) in this thread have pointed out, this isn't something you can just wait around for Microsoft or Yahoo to fix, because certain portions of it aren't in their control (and the bit that Yahoo controls was a deliberate act). But any reasonably competent IT professional should be able to read this thread and knock out the fix pretty easily. I'm *not* a competent IT professional (just an engineer / computer geek) and the instructions in the various links in this thread made it pretty easy to do even for me.