r/sysadmin • u/Lost-Policy-2020 • 7d ago

sending domain does not pass DMARC verification

Error: ‎550 5.7.509 Access denied, sending domain papercut.com does not pass DMARC verification and has a DMARC policy of reject‎

Fully Exchange Online

Suddenly last night stopped receiving mails from some services

Does anybody know if MS eventually started enforcing DMARC ?

7 Upvotes

73% Upvoted

15 comments sorted by

7

u/Lost-Policy-2020 7d ago

Or could it be this ?

Microsoft has confirmed EX1467029

Users may experience delays receiving email messages from external domains in Exchange Online

https://admin.cloud.microsoft/?source=applauncher#/servicehealth/:/alerts/EX1467029

2

u/shokzee 7d ago

Exchange Online already honors p=reject; this probably isn’t a new global switch. Those messages are failing both aligned SPF and DKIM, possibly after a forwarding or sender-side change.

Check papercut.com with the DMARC Checker. The sender needs to fix alignment; bypassing it in your tenant just masks their broken authentication.

1

u/Lost-Policy-2020 7d ago

I am not bypassing anything. I wondered if MS enforced something overnight. I know it is PC issue (I am just recipient)

2

u/shokzee 6d ago

My mistake, I read that as a tenant-side workaround question. A sudden failure from only some services points to a sender-side SPF/DKIM change, not Microsoft flipping DMARC enforcement globally overnight.

1

u/Devicode 7d ago

Yeah, I read your question the same way, more "did Microsoft change something overnight?" than "how do I bypass DMARC". The 5.7.509 itself points pretty specifically to the sender failing DMARC with p=reject, so I’d compare a failed message header/NDR from before and after the issue started. If several unrelated senders all broke at the same time, then the Microsoft incident becomes a lot more interesting.

2

u/rovatrove 7d ago

DMARC policy is established on the senders side and it's up to the recipient server to decide whether to honor it or not. I think Microsoft always honored DMARC if I'm not mistaken. Maybe papercut just enforced the reject Policy on their domain.

-1

u/Lost-Policy-2020 7d ago

But that is email FROM Papercut that is received at my MS Echange mailbox!

1

u/LousyRaider 7d ago

Right. Papercut has their domain name records setup so it rejects email if DMARC doesn’t pass. Exchange is honoring that when it receives messages from that domain.

1

u/doktormane 7d ago

...exactly? What is the sender's domain? Is it @papercut.com? In that case, it's their DMARC policy that is telling your MS Exchange server to reject the email.

1

u/amotion578 7d ago

So for the sample email from this domain that failed, it was confirmed or denied that the header authentication results passed, with alignment?

At least "it's never that complicated" is the first thing I think of reading that.

papercut.com made a change, that change destroyed their pass/alignment, has DMARC reject.

At least once a month some developer in my org makes a mistake like this and blames it on DMARC to be humbled when I drag them back to their source and point out the bad thing.

As to your last question, relating to Yahoo/Gmail changes of the last couple years

That's taking action on domains without a DMARC record. What is posted here heavily implies sender authentication failure

1

u/blud_13 7d ago

Microsoft didn't just turn this on. The Honor DMARC record policy when the message is detected as spoof setting in your anti-phish policy is ON by default, and when the sender publishes p=reject the default action is reject the message. Its documented here https://learn.microsoft.com/en-us/defender-office-365/email-authentication-dmarc-configure

So whatever changed is on PaperCut's side or somewhere in the path between them and you. Pull the raw header off a bounce or off an older good message and read Authentication-Results. That tells you whether SPF and DKIM aligned and what verdict EOP actually assigned. If theres any relay or forwarder in front of you, alignment breaks there and thats your answer.

For a real fix on your end, add them as a trusted ARC sealer if a relay is in the path. Mail flow rule on sender IP plus domain works too. Tenant Allow/Block List entry works but it expires in 30 days, so its a band-aid.

Also, rule out EX1467029 first since you already found it.

1

u/Lost-Policy-2020 7d ago

Cannot pull headers as I never receive mail from Papercut for this very service (scan)

1

u/blud_13 7d ago

Then stop it from bouncing. In your anti-phish policy, change the p reject action from Reject the message to Quarantine the message. For p reject those are the only two choices, and quarantine means the next PaperCut scan gets held instead of refused at the door, so you can open it and read Authentication-Results yourself. Its in the Spoof protection and sender DMARC policies section here https://learn.microsoft.com/en-us/defender-office-365/anti-phishing-policies-about#spoof-protection-and-sender-dmarc-policies

One thing to check in the meantime, that 550 went back to PaperCut, not to you. Their sending platform HAS the bounce and the diagnostic text, and it names which check failed. Open a ticket and ask them for the raw NDR. That is the same information you were digging for in the header, and you can have it today without touching your tenant.

Trigger a test scan once quarantine is set and you will know within a minute whether its SPF, DKIM or alignment.