1

Having issues with email delivery into outlook.com and hotmail. emails are going into junk mail.

Email flow is "Application > Exchange 2016 > Firewall > Office 365 > Mimecast"

MX records points to Mimecast and goes from there to Office 365.

We do not have our own SPF record, DKIM or DMARC set up for upp-ltd.com and I am not sure if Msft has anything set up for uppgroup.onmicrosoft.com.

besides for SPF, DKIM and DMARC does everything looks ok on the email headers below??

Received: from BY2NAM01HT037.eop-nam01.prod.protection.outlook.com
 (2603:10a6:600:8a::34) by LNXP123MB2217.GBRP123.PROD.OUTLOOK.COM with HTTPS
 via LO2P265CA0262.GBRP265.PROD.OUTLOOK.COM; Wed, 14 Aug 2019 14:11:45 +0000
ARC-Seal: i=2; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=fail;
 b=iGqdpGh8dZ1PolKaSc7GLSNQplFD5cfaiXeJje42bc4KrStG0/xG4UxKF2vzKFB5G33wbHWrQvrLRTxS59mIB0GLIya9mup5e3K53TtqhFAc3fVp9rKJ78bW9D3ij73OwNLumFQwDVQ5+FoHfZ+KMS+4D/QD61cpeOdytVznk5+btciClTDIFoldl0Ts8/un1A/VRP7TA4E96gU5/gwRFEpSgUl/y2xe6yOacbLrTfJ/TljPQUDtiPC8VKgU7TGCqjjtsXQlyT25vp9XysFMN9iuJk0PT74Dsoj1ntBgdLQcgk4HkQQv3h3c847z+u6VR1rKy57hgUoBHZgYmFQvZg==
ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
 s=arcselector9901;
 h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
 bh=hjdRKAv3JPPxdyjOqp/ls+4OhOfFLeNhY2vYne4sP6U=;
 b=NSkzWEcG5PnPFqnZJKgxeyN18naWRr8wVJxPtB3pf+0gNh8BIgXUgOscvufeD3Nq45SDmMr4phoX8uTYWTTEDsCHIeGBBkJG8E7Ay6Vf+nuaWyQ79stAlD3HTshiWjpHDNscd5TKAUbltGvKqST1bSajua2PQ8B/oyaA3hGZzwCC7+GUH3hpjUz+fwjRZ5N+DOW6jk3AXUcno12lRSMwi9unlFamIJ65hEjZXH0xsy9CtOcoyHzEU6dAwyGGGSeHhQKB5bE27xl4nHkYrr0LLL07SPju+mNctjwpaRIyUlf4mz7IODggloBX7zk4NStPaHuP3EQsii/Kwg0trFrH4g==
ARC-Authentication-Results: i=2; mx.microsoft.com 1; spf=pass (sender ip is
 146.101.78.161) smtp.rcpttodomain=outlook.com smtp.mailfrom=upp-ltd.com;
 dmarc=bestguesspass action=none header.from=upp-ltd.com; dkim=fail (signature
 did not verify) header.d=uppgroup.onmicrosoft.com; arc=fail (48)
Received: from BY2NAM01FT047.eop-nam01.prod.protection.outlook.com
 (10.152.68.54) by BY2NAM01HT037.eop-nam01.prod.protection.outlook.com
 (10.152.69.61) with Microsoft SMTP Server (version=TLS1_2,
 cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.2157.15; Wed, 14 Aug
 2019 14:11:44 +0000
Authentication-Results: spf=pass (sender IP is 146.101.78.161)
 smtp.mailfrom=upp-ltd.com; outlook.com; dkim=fail (signature did not verify)
 header.d=uppgroup.onmicrosoft.com;outlook.com; dmarc=bestguesspass
 action=none header.from=upp-ltd.com;
Received-SPF: Pass (protection.outlook.com: domain of upp-ltd.com designates
 146.101.78.161 as permitted sender) receiver=protection.outlook.com;
 client-ip=146.101.78.161; helo=eu-smtp-delivery-161.mimecast.com;
Received: from eu-smtp-delivery-161.mimecast.com (146.101.78.161) by
 BY2NAM01FT047.mail.protection.outlook.com (10.152.68.243) with Microsoft SMTP
 Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id
 15.20.2178.16 via Frontend Transport; Wed, 14 Aug 2019 14:11:43 +0000
X-IncomingTopHeaderMarker:
 OriginalChecksum:ED2B93F1534F4D404DE43B0CE17F126879A62BAE875517B8EBFF2FDBB80BE594;UpperCasedChecksum:027F228F42324C7D6FC2C3D5A2A5A5C3E2D968B77459DFC8E3285B786E3F001E;SizeAsReceived:5993;Count:39
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;
 b=mOc6qu7csDpxsV0YJ98ohhcx24XWg7PxVUPf/dDkNjE31p5SPUMOLM1hkg9jX48zBy/JnLgGF8/R1QhF+6296ApDePTVkgDaSCnRK34IELjDLIcbfzlzuzk4qS/qXsObjNzCYkuiw2ghY/mFF/UnkTPdV5cejBHAsFlHohJKUWOEt/uC+0r9eBuzqg69Z9vWr7Y2U2WgBzQK7qHWbDGdqghHqkg9NP8i6gpryAXUqH0vFEsZ1zRUB5KhBdITbjGWSuhBrJcTtCfdQt7SeES13r3lS1U0nuboY8Q17thme1PQ2kqqC9CgreKfDWDHoCn6ySDbUW9BRr3IKlUrpAiVmQ==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
 s=arcselector9901;
 h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
 bh=hjdRKAv3JPPxdyjOqp/ls+4OhOfFLeNhY2vYne4sP6U=;
 b=KIaHZKQ+gOT89QlIxDCKLs9f2XdA99smKbPu07bsNyj4t20rkG8BVOAUOgulHkgLevIG90+b7xniMtIpbirl0QdBkr9iyCVOrsSBMUp6Rs+VbQetGy5awVqoNctgrPUeWuxIyBu0KLqmk9z1GqZz8aO8JKl0Nux1KR2gLPzvcbTIYYPD7favjaZXBkXEEcWrxhZVFke46dsgRgcSkzQ88z+d4OWe7PotYdyZHc5pYsKHy2G36Jq/QT/NguxJumlx0rBMATIljL1x4umdSLHKHBllG6huo8CraZbB5QTFHGZ2CDnfmvuyFR5GpPb66gyu+eKl9VrgtD0mreAnHCtMPw==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is
 5.148.79.5) smtp.rcpttodomain=outlook.com smtp.mailfrom=upp-ltd.com;
 dmarc=bestguesspass action=none header.from=upp-ltd.com; dkim=none (message
 not signed); arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=uppgroup.onmicrosoft.com; s=selector2-uppgroup-onmicrosoft-com;
 h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
 bh=hjdRKAv3JPPxdyjOqp/ls+4OhOfFLeNhY2vYne4sP6U=;
 b=UxuaZ27XmxXEM2vHiEP9PBCuzmPjQlThNDzFKQkp4A7U+4V8g0nP0Ka4Z/FSa12K+fo6thELvkzNZlr6/gEK+Gnd9qBYVN+X6lilUIH/5dzKZ/OXkT/UPSzpSU+GIf0AQ6oqUWVAioIw7qGuWLXu93jHVTUdXjDe+6cw8h0NiKA=
Received: from EUR04-DB3-obe.outbound.protection.outlook.com
 (mail-db3eur04lp2050.outbound.protection.outlook.com [104.47.12.50]) (Using
 TLS) by relay.mimecast.com with ESMTP id
 uk-mta-71-CV2Xd2PUM32uxn-g3cNB5A-1; Wed, 14 Aug 2019 15:11:40 +0100
Received: from HE1PR0902CA0033.eurprd09.prod.outlook.com (2603:10a6:7:15::22)
 by VI1PR09MB4256.eurprd09.prod.outlook.com (2603:10a6:803:13a::12) with
 Microsoft SMTP Server (version=TLS1_2,
 cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2157.14; Wed, 14 Aug
 2019 14:11:39 +0000
Received: from AM5EUR03FT053.eop-EUR03.prod.protection.outlook.com
 (2a01:111:f400:7e08::205) by HE1PR0902CA0033.outlook.office365.com
 (2603:10a6:7:15::22) with Microsoft SMTP Server (version=TLS1_2,
 cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2157.18 via Frontend
 Transport; Wed, 14 Aug 2019 14:11:38 +0000
Received: from mail.upp-ltd.com (5.148.79.5) by
 AM5EUR03FT053.mail.protection.outlook.com (10.152.16.210) with Microsoft SMTP
 Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id
 15.20.2115.18 via Frontend Transport; Wed, 14 Aug 2019 14:11:38 +0000
Received: from UPPSRVEX4.upp-ltd.local (10.90.2.59) by UPPSRVEX4.upp-ltd.local
 (10.90.2.59) with Microsoft SMTP Server (version=TLS1_2,
 cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.1.1531.3; Wed, 14 Aug
 2019 15:11:32 +0100
Received: from UPPSRVADMIN (10.90.2.65) by UPPSRVEX4.upp-ltd.local
 (10.90.2.59) with Microsoft SMTP Server id 15.1.1531.3 via Frontend
 Transport; Wed, 14 Aug 2019 15:11:32 +0100
From: Joe Blogs <Joe.Blogs@upp-ltd.com>
To: Jane Doe <janedoe@outlook.com>
Date: Wed, 14 Aug 2019 15:11:32 +0100
Subject: This is a sample mail
Message-ID: <e9d02a65-89fe-488f-a752-3e13e5eebce2@UPPSRVEX4.upp-ltd.local>
Return-Path: Joe.Blogs@upp-ltd.com
X-EOPAttributedMessage: 1
X-Forefront-Antispam-Report-Untrusted:
 CIP:5.148.79.5;IPV:NLI;CTRY:GB;EFV:NLI;SFV:NSPM;SFS:(10019020)(346002)(136003)(376002)(39850400004)(396003)(2980300002)(199004)(40134004)(189003)(31696002)(5660300002)(70206006)(66574012)(14444005)(9686003)(5024004)(106002)(70586007)(8676002)(47776003)(126002)(23726003)(486006)(2906002)(44832011)(476003)(31686004)(478600001)(46406003)(7596002)(86362001)(305945005)(26005)(246002)(316002)(336012)(8746002)(6916009)(356004)(8936002)(7636002)(186003)(50466002)(97756001)(212503006);DIR:OUT;SFP:1102;SCL:1;SRVR:VI1PR09MB4256;H:mail.upp-ltd.com;FPR:;SPF:Pass;LANG:en;PTR:mail.upp-ltd.com;A:1;MX:1;
X-MS-PublicTrafficType: Email
X-MS-Office365-Filtering-Correlation-Id: 820361c8-f467-4627-a082-08d720c155d9
X-Microsoft-Antispam-Untrusted:
 BCL:0;PCL:0;RULEID:(2390118)(7020095)(4652040)(8989299)(5600148)(711020)(4605104)(4709080)(1401327)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(2017052603328);SRVR:VI1PR09MB4256;
X-MS-TrafficTypeDiagnostic: VI1PR09MB4256:|BY2NAM01HT037:
X-Microsoft-Antispam-PRVS:
 <VI1PR09MB42564EA5364694A3882F9341CDAD0@VI1PR09MB4256.eurprd09.prod.outlook.com>
X-MS-Oob-TLC-OOBClassifiers: OLM:10000;
X-Forefront-PRVS: 01294F875B
X-MS-Exchange-SenderADCheck: 1
X-Microsoft-Antispam-Message-Info-Original:
 zu5x4sRB0arC3TIrYjETVmA1xX1pScVvvUohKO5MsvTYhyjx5U6QFkUwvEZXdR31CtmKPh6UWQhuqpKmpt/79a8Ignuo1fBJGuU18AOlzG7NSgD+kPhDWHZTxegdwnmAxbWiEMq1Q+4ASkp6vWoGV4Eok1WeQ0iVC1imzHv7NZSs95GoWuY2K+Plh23EtQ+gRME0tYbDggYNFFnZmPAIJKRR8O0nwRZg5Q/3KGjh6pnx4CepC8iLzyanKxnLr444h6AqmbgyvinfHYQZ71bn2EDxesRiic/sdPVCRYQcG4RphbOm0C0ZYMuXCU9z82r9Ob8yHgExurV5vaf8UmZOqi7QgPCIYyj4Lobm4N0cBYQW3gTI4zcnPNKOguGsbaaOsOVwJ8RW+eqp87LwwY6UJ4tVnX9M7CMge1QCWBAPR4o=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1PR09MB4256
X-MC-Unique: CV2Xd2PUM32uxn-g3cNB5A-1
X-Mimecast-Spam-Score: 0
Content-Type: text/plain; charset=WINDOWS-1252
Content-Transfer-Encoding: quoted-printable
X-IncomingHeaderCount: 39
X-MS-Exchange-Organization-ExpirationStartTime: 14 Aug 2019 14:11:43.7317
 (UTC)
X-MS-Exchange-Organization-ExpirationStartTimeReason: OriginalSubmit
X-MS-Exchange-Organization-ExpirationInterval: 1:00:00:00.0000000
X-MS-Exchange-Organization-ExpirationIntervalReason: OriginalSubmit
X-MS-Exchange-Organization-Network-Message-Id:
 820361c8-f467-4627-a082-08d720c155d9
X-EOPTenantAttributedMessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0
X-MS-Exchange-Organization-MessageDirectionality: Incoming
X-MS-Exchange-Transport-CrossTenantHeadersStripped:
 BY2NAM01FT047.eop-nam01.prod.protection.outlook.com
X-Forefront-Antispam-Report: EFV:NLI;
X-MS-Exchange-Organization-AuthSource:
 BY2NAM01FT047.eop-nam01.prod.protection.outlook.com
X-MS-Exchange-Organization-AuthAs: Anonymous
X-MS-UserLastLogonTime: 8/14/2019 2:11:36 PM
X-MS-Office365-Filtering-Correlation-Id-Prvs:
 17915081-b157-41f0-b5d7-08d720c152f1
X-Microsoft-Antispam:
 BCL:0;PCL:0;RULEID:(2390118)(5000188)(710020)(711020)(4605104)(610169)(650170)(1124261)(8291501072);SRVR:BY2NAM01HT037;
X-MS-Exchange-EOPDirect: true
X-Sender-IP: 146.101.78.161
X-SID-PRA: JOE.BLOGS@UPP-LTD.COM
X-SID-Result: PASS
X-MS-Exchange-Organization-PCL: 2
X-MS-Exchange-AtpMessageProperties: SA|SL
X-MS-Exchange-ATPSafeLinks-Stat: 0
X-OriginatorOrg: outlook.com
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 14 Aug 2019 14:11:43.2513
 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 820361c8-f467-4627-a082-08d720c155d9
X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa
X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg:
 00000000-0000-0000-0000-000000000000
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY2NAM01HT037
X-MS-Exchange-Transport-EndToEndLatency: 00:00:01.9405696
X-MS-Exchange-Processed-By-BccFoldering: 15.20.2157.000
X-Microsoft-Antispam-Mailbox-Delivery:
    abwl:0;wl:0;pcwl:0;kl:0;iwl:0;ijl:0;dwl:0;dkl:0;rwl:0;ucf:0;jmr:0;ex:1;auth:1;dest:J;OFR:ExclusiveSettings;ENG:(5062000261)(5061607266)(5061608174)(4900115)(4920090)(6515079)(4950130)(4990090)(9190016);RF:JunkEmail;
X-Message-Info:
    qoGN4b5S4yrfUGew4atb642biW7lq1euRV2F1Jm2Nf1IMtpXXZRh/uqF0jI6rdHDGGErJKU6AhymbPO1WiG5DBzj6+RoCsLnA1cgjMGdVGjFT2jiqMA2/BXhzlzUysgBjqHGl3zyZRb6MGJToFClDREzFMFdB2c5TtSGh9vuT1l5OPCjSwDyJ26j1o9xReO8ErUY6v//W7odgr4hklq72g==
X-Message-Delivery: Vj0xLjE7dXM9MDtsPTE7YT0xO0Q9MjtHRD0xO1NDTD02
X-Microsoft-Antispam-Message-Info:
    m1M/l0ZTwz2t1OqHPIlV0JDrcl6op/H566d98MVo1VTj7sk9i25yDgIlIUaZyUUp8+DbBpVoVhhW/2CfGCXLSR5oZKXeRZ9X3SozarYruhVPHzsZHvTWFMSxAstovjmo0cdJ/qIc/HzeqmaRaS6UQuAIMnYO8SzUrITo5w7QpzSh9sD4MtiKZDR7IzkWjFqNJqWhjTJPoqPC7LsML5dkVVBytj5qxuVW/PQ8f7uPvhKd+y6wdDxoE+mYzn2sQrCaO3ZCRWkAZNV5+y12Tyu/OW+3yRpbpjdR1iBTvHBQjiMYGaFeBiOr+3eXegwv3V8dxGdF0SbCsJIHf8yKvTETwQJDdP9SzIhTWqfgEamqWCsDK7xThuarJKe+27yMfaiy2UlVjmCM4oNzBLNiAaqHv5QZAixaq53WiEs3aGU+9/u8D5kknGBypppaGQ7c5dMfBpph6AhojG9XiwlhrJKRd+n3xVqUFJLFYDX7zULWXsfABW4nLqXioZuDr00diNh8u4qKk/Z0z/iQ95tz1kNVJ+NW+MYWsIxF3Mbm3vGK8dWQYe7admPjcRXZeafYUoUV0zsSIQ8VNHS4iBaSND11IvZow1shDA+z58o14M3SBWe5pyjnItlokHwocE/al33cj8o7BASH/i5H3urRsqr4vda6A93JgBzShcy/g9tgOHEndDoS5obWs4g+7mPwrgSIUrfLgCpOvJXkghCeWZ/QGMpnyZhpsGRZcULRDKOz3g1lLrrQuRX8VtZNSOkZQH99J1P1eeL6a8HTR8MDVXJd1C8RSoQArDNm7GlKeEHzofw3VJeoWiP8C2QoCBO2moBfT+wIiejpSrasyAf0NBEIMLMteoHt+lvAAH2UvbGBmL02AmWax9nprA5ZOxFwOViyNsdFbBLtRdfXfXIkEjZilA==
MIME-Version: 1.0
RippieUK
  • 33
  • 1
  • 3
  • i dont want to be impolite but Look on Google for spf dkim online test – djdomi Aug 14 '19 at 15:40
  • Dont worry, i dont think thats impolite, i asked here because i have some knowledge around email delivery but a far cry from being an expert and just wanted to see if someone else out there that would be better than me could point me in the direction. :) – RippieUK Aug 15 '19 at 10:12
  • From a quick MXToolbox search, I can see that you have a DMARC record published, but your Policy is set to none (p=none). Is better than not having any record published, but isn't doing anything. DMARC = SPF + DKIM. Your SPF record should list permitted sources from where email from that domain will be sent. DKIM is a per-message digital signature authentication, relying on published public keys and your mail server integration. Both Mimecast and Exchange Online support DKIM. So, once you have SPF fully defined with DKIM, you can lock down DMARC record with (p=reject) to help prevent spoofing. – JustaDaKaje Jul 03 '22 at 14:48

1 Answers1

0

Here's a useful tool for you to check your DNS settings. https://mxtoolbox.com/NetworkTools.aspx

It can also be used to check if there is any SPF/DKIM/DMARC set up for the domain. Maybe you should confirm with your ISP, check the reputation of your IP address at related places, verify that you've published accurate SPF data in your external DNS, that your IP address has a valid PTR record in DNS, and so on.

Similar issue for your reference, Emails are being delivered to Junk Folder of Gmail/Hotmail/Yahoo Mail

Beverly Gao
  • 126
  • 4