Hi, using Exchange 365 and GMAIL is bouncing all emails -- unsolicited email from your IP address

To start with, this all started by my wife doing a “Reply All” to a message about her work schedule at a hospital.  This email goes to all of her team members and her supervisor regarding her upcoming work schedule.

The only one to receive her email was her supervisor and all of the others did not because GMAIL rejected the email saying it was “SPAM”.  Of course, it was not!  This happened on September 19^th^, 2023.

Disclaimer: I am documenting what I had to do to resolve this issue at the request of another community member and I have found that what I write today could very easily be not true tomorrow as Microsoft and other change things without prior notice!

Okay – so here we go.

• First thing I did was a search given the GMAIL error that came back and found this thread.  What concerned me was everyone having the same issue and no documentation – so I added my initial documentation for the error…
• Next, I found the community thread regarding this issued starting on September 9^th^, 2023.
• We used Exchange Online (which looks to be Office 365).  I wanted, since we are now stationary, to revert back to an on prem Exchange 2019 server – but ran out of time.
• I logged onto the Exchange Online and went to the Admin Portal – and lo and behold there was a message from MS there – Gosh – why couldn’t they have emailed this message – it was regarding the issue with GMAIL – however not a word of what the issue is.

“Exchange Online: Reminder to authenticate outbound email with SPF, DKIM, and DMARC See Details

• Click on See Details and:

Reminder to authenticate outbound email with SPF, DKIM, and DMARC

EX675941, Last updated: September 21, 2023 at 2:36 PM PDT

Estimated start time: September 19, 2023 at 1:19 PM PDT

Affected services

Exchange Online

Issue type

Advisory

Issue origin

Your environment

Status

Investigating

Manage notifications for this issue

User impact

If your organization hasn't already taken action, bulk messages sent with large BCC recipients may be rejected.

Action needed

If your sending domain is configured with email authentication records like Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting, and Conformance (DMARC) in Domain Name System (DNS), and you're not sending a large rate or volume of email that exceeds the sending limits of the service, you're not impacted and there’s no action required by your organization.

Senders will receive Non-Delivery Reports (NDRs) when sending messages that exceed the sending limits of the service. We recommend that senders don’t send a large rate or volume of email that exceeds the sending limits of the service. This recommendation also includes not sending email to a large list of BCC recipients. 

Avoid using addresses in your primary email domain (for example, contoso.com) as senders for bulk email. Doing so can affect the delivery of regular email from senders in the domain. Consider using a custom subdomain exclusively for bulk email. For example, use "m.contoso.com" for marketing email and "t.contoso.com" for transactional email. 

We recommend configuring any custom subdomains with email authentication records in DNS (SPF, DKIM, and DMARC). Many email service providers (for example, Gmail, Yahoo!, and Outlook.com) are configured to reject messages that don't meet email authentication standards. 

Additional diagnostics

For additional reading and documentation on best practices, please review the links below.

Email authentication in Microsoft 365

Outbound spam protection

Prevent mail to Gmail users from being blocked or sent to spam

• So I started digging around in the Admin Portal and found that my DNS records being reported to Exchange online were in error.  How did I get to that point?
  I went to Settings -> Domains and saw: Oh my – what does this mean – clicked on the BCDCON.COM to see:

Next was to click on DNS Records and found:

The MX record was okay, but the next two where in Error… I use NO-IP for
external DNS (Long Story as to why).  NO-IP is okay for creating a “A”
records, but their user interface for CNAME records is very strange.
finally fixed the SPF and Autodiscover and they turned green – by what about the DMARC and DKIM records?  That’s where the challenge became really ugly.

I found lots of stuff by searching, but none of the stuff matched what the Admin Portal on Exchange Online looked like what I see:

I knew I was missing the DMARC record – found ALI TAJRAN’s web post for creating a DMARC record here: https://www.alitajran.com/configure-dmarc-record-for-office-365/ but wasn’t quite right – found that using: https://dmarcly.com/tools/dmarc-generator worked much better. Of course, there was still the issue of how to add it to NO-IP – since this a TXT record it wasn’t as difficult as a CNAME record.

Okay…what about the DKIM CNAME record?  Using https://www.alitajran.com/configure-dkim-record-for-office-365/ helped, but it’s not quite right either…had to do some additional digging and again using: https://dmarcly.com/tools/dkim-record-generator I was able to create the DKIM record – now how to implement it in Exchange Online?

One of the first things everyone wants you do to is create a Private/Public key combination and then implement it into Exchange – but wait – you can’t do that with Exchange Online!

It turns out, while I could not find any documentation to prove this, that Microsoft has already generated the Key Pair and you don’t have to do anything but us “selector1” and “selector2” names for this.

You go to -> -> Threat policies -> Email authentication settings -> click on DKIM

Now you will see:

In my case, I selected the first item the other two were added by Microsoft!

Because I have everything in place, this is how it looks – but it will be “Disabled” if not!

THE MOST IMPORTANT THING TO REMEMBER IS – BE SURE YOU HAVE THE SPF AND DMARC AND DKIM records in DNS before attempting to get EXCHANGE ONLINE to see them!  Use the tools at https://dmarcly.com/tools/ to test them!

Ronald

Thank you. Its alot of work to document this stuff especially when you need to be doing other things, but I think between a half dozen who have published their experiences on this topic on this thread, most anyone whould be able to follow it through.

Bob

THIS IS THE BEST SOLUTION!

We found ourselves in the predicament with all emails sent by our HR team to employee's personal Gmail addresses failing... We had no issues for years until today.

I implemented Ben's suggestion and it fixed it right away, - after our DNS changes propagated.

Thanks Ben! Brilliant!

I'm having the same issue.

Hello,

I received the same bounce back message (see email below). This issue started in November 2023. I am using Go Daddy's Microsoft Email system.

All email recipients with Yahoo, AOL, Comcast accounts are receiving the emails. Gmail recipients are not.

"Remote server returned '550 5.4.300 Message expired -> 421 4.7.28 Gmail has detected an unusual rate of unsolicited mail originating; from your DKIM domain [ 36]. To protect our users from spam,;mail sent from your domain has been temporarily rate limited. For;more information, go to; https://support.google.com/mail/?p=UnsolicitedRateLimitError to;review our Bulk Email Senders Guidelines. m64-20020a633f43000000b005c67e10f238si4626588pga.492 - gsmtp'"