Trying to configure SPF record - MS Remote Connectivity Analyzer tool reports errors

Question

We recently switched our email hosting to use Microsoft 365 (resold by GoDaddy). I am trying to test and validate settings for SMTP and email processing - attempting to improve our 'spaminess' scores. So I have added a new SPF record and am trying to test it using the Microsoft Remote Connectivity Analyzer, the Outbound SMTP test ( https://testconnectivity.microsoft.com/tests/OutboundSMTP/input ).

But I'm not sure what to put into the 'Outbound IP address' field. I would guess that this is the MS Exchange servers themselves; we connect to MS Exchange servers via SMTP to start the outgoing email process from our systems, connecting to a specific account hosted on these Exchange servers. But then Exchange needs to turn around and send that out to the final destinations - it sounds like that is what IP they are asking for. (And our system is distributed - it's a built-in/system style account to a database solution; the SMTP connection to initiate the send can be coming from multiple sources, because it could be happening from each user's own machine.)

I found an IP address (52.96.59.162) by doing a ping on the SMTP server we connect to (smtp.office365.com), but when I use that IP the analysis tool reports back errors for that source: Reverse DNS failed... no PTR record.

Attempting reverse DNS lookup for IP address 52.96.59.162.

Reverse DNS lookup failed.

Collapse

Additional Details

IP address 52.96.59.162 doesn't have a PTR record in DNS.

And then the SPF test section also returns some errors - but they seem innocuous... the "-all" flag indicated a negative status. (I pulled this SPF record from some other MS documentation web pages - yes, provided directly by MS.)

Anyone have information or hints on how I should be using this tool?

Thanks,

J

Answer 1

Exchange Online can have multiple endpoints (see the port 25 IP ranges at https://learn.microsoft.com/en-us/microsoft-365/enterprise/urls-and-ip-address-ranges?view=o365-worldwide#exchange-online). What you need is the external MX record for your domain, e.g. contoso-com.mail.protection.outlook.com. Resolve that DNS entry, and use that IP address
in the Outbound SMTP test, e.g. 104.47.4.36, together with a valid e-mail address for that domain, eg admin@Company portal .com.

Answer 2

Thanks for the tip.

I tried it... found the name specified in our MX record, got the IP for that, retried the test.... it worked! All tests passed!

Thanks!
-J

Answer 3

Now, for the next step - need to figure out how to setup a DKIM (and ultimately a DMARC as well) configuration.