Using New Outlook on Windows for personal email, calendar, and contact management
For those still looking for an answer... We ran into this with our Spiceworks Cloud ticket system emails and us using an internal email address for delivery.
You will need access to the 365 Security Admin Center: https://security.microsoft.com/tenantAllowBlockList?viewid=SpoofItem
Add an Internal AND External "allow" for the spoof'd sender address along with the actual sender's DKIM-passing domain. So for us, the entry is: *** Email address is removed for privacy ***, on.spiceworks.com
Note, the email headers will show the DKIM-passing domain. Just look for the domain name just before "dkim=pass (signature was verified)".
Thank you for that URL! I was receiving "Unverified"-tagged emails from Salesforce because they were spoofing as an internal email address we have here.
I have a Power Automate flow that wasn't triggering when these emails came in. I suspected it was due to the "Unverified" tag.
Instead of a "dkim=pass (signature was verified)" line, mine said "dkim=none". ChatGPT told me to add the records as
my_internal_email_at_company_dot_com, salesforce_dot_com
The emails no longer come in as Unverified, and they trigger the Flow. Hopefully it stays that way.