Outlook - Emails from specific sender/domain blocked at server level

Below is the Google Admin Toolbox message header analysis:

Note additional details in the gmail 'show original' output included:

SPF: 'Pass' with IP 149.72.187.194

DMARC: 'FAIL'

Thank you. This is very helpful.

The IP address itself seems fine as it is not listed in any blacklist.

But DMARC failing is the problem. Microsoft is now mandating passing of all three - SPF, DKIM and DMARC for high volume senders.

It is normal for Gmail to let them in now until it hits whatever high volume threshold they set.

I am afraid this is not something that can be fixed from your side as a recipient, but the business needs to set up a valid DMARC policy in their dns record.

See Microsoft's announcement about SPF/DMARC/DKIM requirements here:  https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/strengthening-email-ecosystem-outlook%E2%80%99s-new-requirements-for-high%E2%80%90volume-senders/4399730

I am not convinced that this is the problem.

The sender has added their Outlook email address to the emails and they are receiving them in their Outlook account (same as I am receiving them in my gmail account - but not my Outlook account).

I expect that the business may set up a valid DMARC policy and I will still have an issue.

If they have configured DMARC correctly, why do the Gmail headers show that DMARC failed?

I am an email administrator for my own organization. When a client does not receive one of our emails, I would not expect the recipient to troubleshoot it. Recipients have limited tools and almost no visibility into the sender’s mail flow.

The sender should begin by checking its own message-tracing tools to determine where the email failed. Microsoft 365 provides this feature to business administrators, and most business email platforms offer a similar mail-flow or delivery-tracing tool.

The sender is also the only party that knows which systems and third-party services are authorized to send email using its domain. For example, some messages may be sent through the company’s regular email server, while others may be sent through Salesforce, Mailchimp, an authentication provider, or another service.

Although all of these messages may appear to the recipient as coming from the same company domain, each sending service may use different servers and may require its own SPF and DKIM configuration. The recipient has no visibility into those settings and cannot determine whether every service has been configured correctly.

For example, the company may have configured SPF and DKIM correctly for Salesforce but incorrectly for Mailchimp. In that situation, Salesforce messages may be delivered successfully while Mailchimp messages fail DMARC and are rejected or placed in spam. From the recipient’s perspective, it may simply appear that some emails from the company arrive while others do not.

That is why the sender must identify which service sent the missing message and use its own tracing and authentication records to investigate the failure.

Troubleshooting should therefore begin with the sender. If its message trace confirms that the email reached Microsoft’s servers and was rejected, the sender should submit a request through this form for further backend review:

http://go.microsoft.com/fwlink/?LinkID=614866

The request must be submitted by the sender, not the recipient.

yeah, it is a challenge trying to troubleshoot.

My concern is that if it is a DMARC issue causing M365 to blacklist the traffic, why are the same exact same emails being received by another Outlook client?