Share via

SPF fail

Anonymous
2019-03-31T18:15:07+00:00

I am getting dmarc reports which show an SPF fail from a third party mail server belonging to Heart Internet at IP 79.170.40.96 Host name mail96.extendcp.co.uk I do not understand why my mail is being delivered via this mail server as I only use office 365 online. dmarc reports from the two Microsoft servers always show SPF pass. Any thoughts?

Microsoft 365 and Office | Subscription, account, billing | For home | Windows

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

Answer accepted by question author

Vincent Choy 10,965 Reputation points Volunteer Moderator
2019-04-02T06:08:57+00:00

A few possibilities -

  1. Someone in your organization engaged a 3rd party mail sending service without your knowledge and is doing some sort of marketing blast.
  2. Someone is spoofing your email domain via a 3rd party mail server. SPF and DMARC should fail in this case. DKIM may not fail if the 3rd party mail server has dkim setup properly.

Was this answer helpful?

0 comments

3 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Anonymous
    2019-04-02T05:20:16+00:00

    Hi Simon Eastwood,

    Since your SPF set up correctly, if a third party user(external user) try to send the spam emails with using your domain, this will be detected by the SPF recorded since it's not allowed, so there will be a SPF failed, if this won't affect your usage, you won't need to pay more attention to it. If you have any other issue when using Office, feel free to let us know. We will be happy to help you.

    Regards,

    Bryan

    Was this answer helpful?

    0 comments
  2. Anonymous
    2019-04-01T10:52:55+00:00

    Bryan

    Thanks for the prompt response. It seems as if it may have just been a one off, more recent dmarc reports just have microsoft server details. Unless it was an attempted spoof then I still don't understand why my mail was going through this ip address but strange that dkim is OK, see below.

    Was this answer helpful?

    0 comments
  3. Anonymous
    2019-04-01T10:11:26+00:00

    Hi Simon Eastwood,

    Based on your description, Microsoft servers always show SPF pass, it indicates that the email you send from the Office 365 are well, but if mail from third parties user(third party mail server) try to send on your behalf,  DMARC will identify sources of mail for your domain, the dmarc reports show an SPF fail from a third party mail server. The further detailed information about how SPF and DMARC work together to protect email in Office 365 for your reference.

    https://docs.microsoft.com/en-us/office365/securitycompliance/use-dmarc-to-validate-email

    Regards,

    Bryan

    Was this answer helpful?

    0 comments