SPF - Spoofed E-Mails False Positives

Question

Hi

I have Office 365 set up for a client

They are using the Office 365 Exchange, but their website is hosted on my server with a general website and an online shop system (OpenCart)

The online shop emails orders to a specific mailbox (naturally on the Office 365 Exchange)

However all e-mails from the OpenCart shop are classed as Junk mail marked as;

[This sender failed our fraud detection checks and may not be who they appear to be. Learn about spoofing at http://aka.ms/LearnAboutSpoofing]

I would suspect this check would be using SPF as that's the only way to see if an email source is authorised to send emails on behalf of the domain.

the DNS are on my server... naturally I added the Microsoft SPF settings as requested when setting up Office 365 Exchange

I also left on the correct IP for the webserver hosting the OpenCart system, I have checked the emails coming in that they are from that IP too and they are.

Does Microsoft have a hidden alternative SPF list or use the one on your DNS settings?

Have I missed something?

MY SPF settings are;

v=spf1 include:spf.protection.outlook.com include:servers.mcsv.net ip4:217.xxx.xxx.xxx-all

In the email received header I see this line that looks most relevant;

Authentication-Results: spf=none (sender IP is 217**.xxx.xxx.xxx**)

 smtp.mailfrom=dsXXXX.dedicated.turbodns.co.uk; domain.co.uk;

Obviously the bits in bold have been edited for protection, but the 217.xxx.xxx.xxx match precisely. I don't quite get why it says 'spf=none'??

do I need to add in the actual domains to? confused as they would just resolve to the IP already listed?

Any Help gratefully appreciated

thanks

Tristan

Answer 1

Hi Tris,

Any updates?

Thanks,

Sam

Answer 2

Hi Tris,

I have checked the information in private message. The SCL value is 5 so the email was marked as spam. Also I checked in the mail headers and found that the email was marked as spam by the spam filter policy in the Office 365 tenant and then moved to the Junk folder. You may refer to the articles below for more details.

https://technet.microsoft.com/en-us/library/mt712724(v=exchg.150).aspx

https://support.microsoft.com/en-us/kb/3089691

And you can add the Opencart domain to the allow list in spam filter to see if the issue can be resolved.

Then about the DKIM and DMARC records, you can refer to the following articles:

Use DKIM to validate outbound email sent from your custom domain in Office 365

Use DMARC to validate email in Office 365

Regards,

Yang

Answer 3

Hi

1. Yes SPF is set up as follows (as said in my original message)

v=spf1 include:spf.protection.outlook.com include:servers.mcsv.net ip4:217.xxx.xxx.xxx-all

The ip4 being the webserver that Opencart is on

2. I have followed your link and that confirms SPF should be fine, however it also talks about DKIM and DMAC but not how to configure them?

I will now go any respond to your private message

thanks

Tris

Answer 4

Hi Tristan,

I understand your client is using Office 365 Exchange and all the emails from the OpenCart shop are not received properly by them. Based on my experience, this kind of issue might be related to an incorrectly configured Sender Policy Framework (SPF). To troubleshoot the issue, I’d like to confirm the following details at first:

1. Generally, the SPF record in Office 365 should be v=spf1 include:spf.protection.outlook.com -all. Based on your description, it seems you’ve customized it, right? If so, I’d like to confirm if you checked the SPF TXT record syntax for Office 365 before doing so?
2. If you’ve followed the syntax strictly, please use the tool suggested in the following article to check if the syntax is correct.

https://support.office.microsoft.com/en-us/article/Tools-you-can-use-to-validate-SPF-records-for-your-domain-92a43f6a-4651-455a-a1cc-300684bedcfa?ui=en-US&rs=en-US&ad=US

3. I have sent you a private message to collect the entire mail header of the ‘junk’ email for further analysis. Here is the link to access the private message:

https://answers.microsoft.com/en-us/privatemessages/list

Thanks,

Sam