Hi, using Exchange 365 and GMAIL is bouncing all emails -- unsolicited email from your IP address

BTW: if selector2 fails, then you should rotate your DKIM keys...

https://www.alitajran.com/configure-dkim-record-for-office-365/ instructions on how to do this are toward the bottom of the link above...

I just found the same tool - I'm using NO-IP for my DNS provider and there's one thing for sure, NO-IP makes it really HARD to create a CNAME record!

I called No-IP support this morning and was informed that they can't talk about DKIM records -- really??

Kept digging and finally figured out how to create the CNAME DKIM records and that was via the DMARCLY.COM site -- EXCHANGE ONLINE, because MS keeps changing the user interface, is difficult to deal with in that the stuff returned from searching the internet, even if marked relatively current, doens't match the interface!

Oh, and by the way -- MXTOOLBOX DKIM checker says SELECTOR2 is published, but in error (lord knows what that means as there's no explanation).

The DKIM checker on dmarcly.com worked for both selector1 and selector2 and now Exchange Online is happy and DKIM is in place -- even ran a test Email Message to GMAIL and looked at the header -- YEA!! IT PASSED!! -

And to the gentleman that said someone else had documented just what was needed -- sorry, but that's not quite right.

Eric

Thank you for sharing this. Yesterday I just discovered the EasyDmarc site DKIM Checker and Lookup Tool tools | EasyDMARC which has a free DMARC DKIM and SPF checker. That fixed my dmarc record right away. Benjamin was kind enough in the early throws of this thread to provide me with information I had never heard of as I am just a guy that has to manage our 365 because we're a small business and at my age in life (80) I'm not keen on learning too many new tricks. This exercise over the past 10 days has taught me alot though, so for those of you like me, here are some bullet points that worked.

1. You have solve this on your own and you're better for it because it is a protection for you against the bad guys that are trying to take you site down through phishing, trolling, etc.
2. The first hint that something was wrong happened when I went to the 365 admin center. Both the TXT record and CNAME record were red and indicated a problem. When I fixed TXT, CNAME corrected itself also. THIS DOES NOT FIX THE OUTBOUND AUTHENTICATION PROBLEM THOUGH.
3. you have to build DMARC and CNAME records which scared me as I had no idea if I would bring my mail service down or not. My son and I had alot of discussions about this but were finally assured by Benjamin that it would not affect our email and he was correct. Further I learned you can remove you change right away and all is back to where it was.
4. It took me a while to understand that the DMARC and CNAME records are on your domain provider account, in our case GoDaddy

so click on whatever MS has here and go to that account. You will obviously have to log in.

5. Our CNAME records look like:

CNAME Name = selector1._domainkey Data = selector1-stgp-com._domainkey.youronmicrosoftaccount.onmicrosoft.com.

Note that the domainkey is the onmicrosift.com account that gets activated when you install 365 and probably is not your regular domain. These two records are created from the drop down ADD CNAME.

6. The DMARC record is created from the drop down ADD TXT. Our DMARC looks like:

TXT Name = _dmarc Data= v=DMARC1; p=none;pct=100; rua=mailto:abc@yourdomain.com; ruf=mailto:******@yourdomain.com;fo=1:d:s

7. DKIM: https://www.alitajran.com/configure-dkim-record-for-office-365/  (We have not done this part yet, but we can send a single message to multiple gmail addresses implementing the above. I will do the DKIM today.

Hope all this helps. Thanks Benjamin who really guided me.

Same issue.

Went through and added DKIM and DMARC. A little complicated because I use Office 365 for email and google domains.

I found an easy way to check whether SFP, DKIM, and DMARC are set up properly:

https://dmarcly.com/tools/

"You can also get a report on SPF, DKIM, DMARC via email. Simply send an email message from your domain to ******@dmarcly.com, and you will get the report shortly."

I just tried it and it verified that I had set up SPF, DKIM, DMARC properly.

I have tried sending emails to FOUR different gmail addresses all at the same time. It seemed to work...

I had the same issue and was fortunate to find this forum thread.

After reviewing Google documents and running google tools to verify my domain (My Domain verified without issue on Google tools), I was out of ideas. After domain verification with Google, I still experienced this issue.

Reading though these posts I went back to spf, dkim and dmarc and found that because my environment was a hybrid, the only thing that was consistent was my spf record. I filled in my gaps where needed on the Dmarc and dkim settings and my issue is now resolved.

It seems to me that may people here experiencing this issue does not have all three protocols in check. Those who do have all three activated, I would validate them. If you have gaps like I did, then fill them.

In close it appears, if you want to smooth out this issue, then make sure you have all three activated and verified.

I want to thank everyone on this thread. This has been a good learning experience for me and my team.