Mail sent from authorised 3rd app being marked as junk when sent to internal users

Question

Hi,

We have an external accounting system that sends out invoices to customers, this uses our company domain. The system has it's own DKIM records that are inserted into our DNS and we have update the SPF with the sending servers details. Email sent to customers work perfectly, no issues. The issue arises when invoices are sent internally, they always get marked as junk by EOP. Our domains SPF. DKIM, DMARC records are all setup as per Microsoft best practice. I have analysed the headers and I can see that both SPF and DKIM pass however I do see a DMARC fail as below:

pf=pass (sender IP is xxx.xxx.xxx.xxx) smtp.mailfrom=server.domain.net; dkim=pass (signature was verified) header.d=server.domain.net;dmarc=fail action=none header.from=ourcompany.com;compauth=fail reason=601

Short of asking every employee to add the email address the accounting system uses to their whitelist is there anything else I can do to ensure that these emails are successfully delivered to internal users?

Thanks

Answer 1

 

Hi @ Rob,

 

Based on the information in the message header that you provide, compauth=fail reason=601 means that the message failed compound authentication due to spoofing within your organization.

I recommended that you create allow entries for spoofed senders in the tenant allow/block list, and select Internal for the spoofing type to see if that helps resolve the issue.

Allow or block email using the Tenant Allow/Block List | Microsoft Learn

In addition, please check the SCL value of messages marked as spam.

For messages with SCL values of 5, 6, 8, 9, the default anti-spam policy and the new anti-spam policy are also delivered to the recipient's spam folder.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Adjust your DMARC policy to allow for greater flexibility. You can change the "p=" (policy) tag from "reject" or "quarantine" to "none" initially to monitor DMARC without impacting email delivery. This will allow you to gather DMARC reports and assess the impact on internal emails.

v=DMARC1; p=none; rua=mailto:******@yourdomain.com; ruf=mailto:******@yourdomain.com; sp=none; adkim=s; aspf=s; fo=1;