I work for the support department of a large multinational imaging company. Starting yesterday, we started getting tons of calls from customers who have been sending email from their devices from Gmail domains who are not able to send emails to M365 users. A bit of snooping in our test M365 domain shows that they are being dropped as spam from M365. What’s odd is that I cannot find any mention of this behavior anywhere on the Internet. Has anyone else seen this yet?
Dropped as spam because of DMARC failure ?
I don’t see any indication of that from the simple output provided from the message trace.
Also, it only seems to affect messages sent from Gmail via SMTP. Messages sent from the web interface are delivered properly.
I see. When you wrote :
email from their devices from Gmail domains
I assumed that the customers were sending it from GSuite based custom domains, but this is plain gmail.com and that makes the DMARC part different. Did your company make any DNS changes just before this happened ? SPF records have a maximum length they can have. If it exceeds the maximum length, it can cause failure and email rejections.
A G Suite account was the first thing that I thought of as well, but no, this is straight gmail.com. I actually tested with my personal G Suite account, and I got similar results. Because I’m in the support team for the manufacturer, we’ve been hearing reports from a large number of customers who have been complaining of this over the past 48 hours.
can you drop the header in here: https://mha.azurewebsites.net/pages/mha.html
it might have some more info for you
That’s a great suggestion, but the message gets tossed by the M365 spam filters before it reaches the inbox and I never have a chance to see the headers. All I’m able to see is the snippet of information that doesn’t show anything actionable.
Are you using defender for o365? If so, usually uou can get a copy of Any rejected messages at security.microsoft.com and get more info from the message explorer
Security & Compliance Center reports will provide reasoning for being marked as spam. What’s it say?