Microsoft quarantining community digest email

[dtod]

Microsoft is quarantining my daily digest. Looks like it's due to DMARC, DKIM, and SPF failures. It could be something in our environment of course.

Authentication-Results: spf=fail (sender IP is 35.174.145.124)
smtp.mailfrom=em9032.us.khoros-mail.com; dkim=fail (body hash did not verify)
header.d=us.khoros-mail.com;dmarc=fail action=none
header.from=instructure-contact.com;compauth=fail reason=001

Received-SPF: Fail (protection.outlook.com: domain of
em9032.us.khoros-mail.com does not designate 35.174.145.124 as permitted
sender) receiver=protection.outlook.com; client-ip=35.174.145.124;
helo=us.cloud-sec-av.com;

[nathanatkinson]

Hi @dtod, thanks for bringing this to our attention! I'm not sure if this would be an issue on our end or yours, but I've opened a ticket with our community platform support to look into this. When I get updates from them I'll post here to let you know what is being done to resolve this on our side.

[KathyPalm]

We've also had this issue and have made changes to allow the email through but it failed DMARC at least, maybe the same as shown above. (The specifics have left my brain at this time...) 😃

Please let me know if it would be helpful to send you any specific information for what it looks like on our end!

[nathanatkinson · Accepted solution]

Hi @dtod wanted to give a quick update. We heard back from our Community platform support and they mentioned that all emails going to your domain are showing as successfully delivered on our end, so I'm betting it's an issue with your institution's email servers blocking something.

[dtod]

I may be misunderstanding the response, but you may need to get with someone who really understands DMARC, DKIM, and SPF. It's not about whether emails are delivered to our domain. It's whether or not they are compliant. It's possible the issue is at khoros-mail.com

em9032.us.khoros-mail.com does not designate 35.174.145.124 as permitted sender

https://mxtoolbox.com/SuperTool.aspx?action=spf%3aus.khoros-mail.com&run=toolpage

35.174.145.124 is not specified there.

[nathanatkinson]

Sorry, and that's my fault, I don't have any knowledge of email servers or compliance, I'm just telling you what I was told by my support contact who looked into this on their end. Here's their response:

"I found the errors you included a bit perplexing since your Community is configured to use our SendGrid mail servers, not DKIM.

I have also checked the SPF record and DMARC policy; both seem valid."

---

[dtod]

DKIM, DMARC, and SPF can make my head spin. I'm not going to worry about this too much, but the headers below indicate that the community digest does NOT use SendGrid. It uses khoros-mail.com.

Received: from outbound.us.khoros-mail.com (unknown)
by geopod-ismtpd-7 (SG)
with ESMTP id 2M3bgYkYTk2BEL6mkGELbw
for <dtod@vccs.edu>;
Sat, 19 Aug 2023 12:14:30.251 +0000 (UTC)
Received: from community.canvaslms.com (unknown [10.237.32.27])
by outbound.us.khoros-mail.com (Postfix) with ESMTP id 36B531C0013
for <dtod@vccs.edu>; Sat, 19 Aug 2023 12:14:30 +0000 (GMT)
Date: Sat, 19 Aug 2023 12:14:30 +0000 (UTC)
From: Instructure Community <no-reply-community@instructure-contact.com>
Message-ID: <157c8322-129c-4a9d-83bc-b8c7989a3a69.1692447270228@community.canvaslms.com>
Subject: Instructure Community: Daily Digest