On premise Exchange SPF/DKIM authentication - google saying I don't got it

Susan Dodds 186

Exchange 2019. I have SPF and DKIM enabled on my microsoft admin portal. Google is still saying I don't have those authentications enabled. I have owa.contoso.com as my email domain and is my custom domain in the microsoft portal. I do not have just contoso.com as a domain on my admin portal. This is the message I get from google: mx.google.com gave this error:
This mail has been blocked because the sender is unauthenticated. Gmail requires all senders to authenticate with either SPF or DKIM. Authentication results: DKIM = did not pass SPF [contoso.com] with ip: [ipv4] = did not pass For instructions on setting up authentication,

1 answer

Kael Yao-MSFT 37,576 Reputation points Microsoft Vendor

2024-01-30T07:10:34.9633333+00:00

Hi @Susan Dodds

Do you have an Exchange hybrid deployment and all outbound emails are routed through Exchange Online to internet?

I have owa.contoso.com as my email domain and is my custom domain in the microsoft portal. I do not have just contoso.com as a domain on my admin portal.

According to the NDR message from Google, your email domain is contoso.com.

Have you enabled DKIM for contoso.com following this link?

Use DKIM to validate outbound email sent from your custom domain

Do you have your on-premises Exchange server's ip address in the SPF record?

Set up SPF to help prevent spoofing

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment". Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Please sign in to rate this answer.
Susan Dodds 186 Reputation points

2024-01-30T08:13:34.6666667+00:00

Exchange is entirely on premis. I had a spf record mx toolbox liked but google didn't. I followed the instructions from the Microsoft admin portal and created spf and dkim records that I put into my dns service. Mx toolbox doesn't like the new spf or dkim records and neither does google. I did not see any powershell to use on premis Exchange so no powershell has been used yet.

Kael Yao-MSFT 37,576 Reputation points Microsoft Vendor

2024-01-30T08:22:59.0866667+00:00

Exchange is entirely on premis

Sorry I may have misunderstood your situation.

But I am still confused by "I have SPF and DKIM enabled on my microsoft admin portal", can you clarify on what the microsoft admin portal is and how did you enable SPF and DKIM?

For on-premises Exchange, there is no built-in DKIM solution and you may need to look for some third-party products.

For SPF record, please make sure you have the ip address of your Exchange server in the public DNS txt record.

If you have trouble with how to configure it, please contact your domain provider.

(For example, if you bought the domain contoso.com from Godaddy, you need to contact Godaddy support for how to configure the SPF record)

Susan Dodds 186 Reputation points

2024-01-30T14:26:21.6833333+00:00

I have dkim setup in security.microsoft.com Already have tried SPF with my ipaddress and no change. If I do have to use a 3rd party dkim software, what is a trustworthy program and the link to it?

Kael Yao-MSFT 37,576 Reputation points Microsoft Vendor

2024-01-30T23:39:04.8833333+00:00

If you are pure on-premises Exchange, do you have a Microsoft 365 tenant and you configured DKIM in the tenant? If yes, it won't work for you. The emails need to be routed through Exchange Online to have the DKIM signature assigned.

If I do have to use a 3rd party dkim software, what is a trustworthy program and the link to it?

Due to our policy, sorry we cannot make recommendations for you.

Susan Dodds 186 Reputation points

2024-01-31T14:42:50.6+00:00

Can a DKIM module be installed on the exchange server itself and not an edge server if there is no edge server?

Kael Yao-MSFT 37,576 Reputation points Microsoft Vendor

2024-01-31T23:55:49.8966667+00:00

No, there is no built-in feature.

Kael Yao-MSFT 37,576 Reputation points Microsoft Vendor

2024-02-02T02:37:20.5166667+00:00

Hi @Susan Dodds Do you have other questions we can help you with? Please feel free to post back.

Susan Dodds 186 Reputation points

2024-02-02T17:30:05.67+00:00

If I create an exchange 2019/exchange online hybrid environment, I will be able to use SPF/DKIM through microsoft? Does this require Azure AD? What all needs to be done to setup exchange 2019/exchange online hybrid? Will having a self-signed certificate affect things?

Kael Yao-MSFT 37,576 Reputation points Microsoft Vendor

2024-02-05T00:35:43.26+00:00

Yes if you route all emails through Exchange Online. It requires Azure AD. You need a commercial certificate.

Susan Dodds 186 Reputation points

2024-02-05T17:18:54.8533333+00:00

Is an edge server required for on premise exchange 2019?

Kael Yao-MSFT 37,576 Reputation points Microsoft Vendor

2024-02-05T23:52:25.59+00:00

Please kindly note that we only support one question per thread unless the questions are related. If you have other questions which are not related to the original question, please create new threads. Thanks for your understanding.
Sign in to comment

Share via

On premise Exchange SPF/DKIM authentication - google saying I don't got it

1 answer