Office 365 Outbound Emails going to Recipient's Spam

Forums › IT Pro and developers › Office 365 Outbound Emails going to Recipient's Spam

Earbanean

1110 posts

Uber Geek
+1 received by user: 377

#284387 18-Apr-2021 15:58

I've recently moved my custom domain name email to Office 365 Home account with domain moved to GoDaddy. The email is working OK, except too many outbound emails are going to recipient's Spam/Junk folders - including gmail users. From a curesory google on this, I think I need to add some sort of email authentication, but I'm not sure exactly the best way to do that. Do I need DKIM, or SPF, or both? Anyone have any experience setting these up in GoDaddy and/or Office 365?

freitasm

BDFL - Memuneh
80658 posts

Uber Geek
+1 received by user: 41071

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#2694493 18-Apr-2021 16:33

You should have SPF, DKIM and DMARC.

SPF specifies which server can send emails on your behalf. DKIM uses cryptography to sign the emails. DMARC tells receiving servers what to do if either SPF or DKIM validation fails.

It is easy to do it with Office 365. Instructions are available from their help.

Referral links: Quic Broadband (free setup code: R587125ERQ6VE) | Samsung | AliExpress | Wise | Sharesies

Support Geekzone by subscribing (browse ads-free), or making a one-off or recurring donation through PressPatron.

freitasm

BDFL - Memuneh
80658 posts

Uber Geek
+1 received by user: 41071

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#2694494 18-Apr-2021 16:35

You can also use a service like Valimail to help configure and manage reports generated from recipients.

Referral links: Quic Broadband (free setup code: R587125ERQ6VE) | Samsung | AliExpress | Wise | Sharesies

Support Geekzone by subscribing (browse ads-free), or making a one-off or recurring donation through PressPatron.

Earbanean

1110 posts

Uber Geek
+1 received by user: 377

#2694496 18-Apr-2021 16:41

freitasm: You should have SPF, DKIM and DMARC.

SPF specifies which server can send emails on your behalf. DKIM uses cryptography to sign the emails. DMARC tells receiving servers what to do if either SPF or DKIM validation fails.

It is easy to do it with Office 365. Instructions are available from their help.

OK, thanks @freitasm. Reading through their instructions now. It seems that SPF is already set up when I check in GoDaddy. So I guess I need to add DKIM and DMARC. It seems from what I'm reading, that I need to add new DNS records for my domain (as they describe), but it doesn't appear I need to configure anything on the Office 365 side. At a high level, does that sound right?

Edit: typo

Earbanean

1110 posts

Uber Geek
+1 received by user: 377

#2694497 18-Apr-2021 16:52

Earbanean: but it doesn't appear I need to configure anything on the Office 365 side.

OK, reading further that's not correct. They say I need to configure this at "To Enable DKIM signing for your custom domain through the Admin Center
protection.office.com" However, that doesn't seem to work for a Office 365 Home account. It looks like that's for Business accounts only. Hmmm.

Earbanean

1110 posts

Uber Geek
+1 received by user: 377

#2694502 18-Apr-2021 17:32

Looks like I'm snookered here. I thought the Office 365 Home Family pricing was unbelievably good - considering it includes custom domain email for up to 6 users. But there's a catch (isn't there always?) and it's a big problem. Custom domain email is not much use if a large chunk of your outbound emails end up in recipients Junk/Spam folders.

Note sure what I can do here, other than look for another email hosting provider.

BlakJak

1330 posts

Uber Geek
+1 received by user: 735

Trusted

#2694505 18-Apr-2021 17:45

Earbanean:
Looks like I'm snookered here. I thought the Office 365 Home Family pricing was unbelievably good - considering it includes custom domain email for up to 6 users. But there's a catch (isn't there always?) and it's a big problem. Custom domain email is not much use if a large chunk of your outbound emails end up in recipients Junk/Spam folders.

Note sure what I can do here, other than look for another email hosting provider.

Ask the recipients to start selecting 'not spam'.

Raise a support request with your new provider asking them for assistance.

No signature to see here, move along...

Quic Broadband

Move to New Zealand's best fibre broadband service (affiliate link). Free setup code: R587125ERQ6VE. Note that to use Quic Broadband you must be comfortable with configuring your own router.

michaelmurfy

meow
13581 posts

Uber Geek
+1 received by user: 10914

Moderator

ID Verified

Trusted

Lifetime subscriber

#2694620 18-Apr-2021 23:55

@Earbanean Also make sure the SPF record is actually correct for your domain.

Use https://www.mail-tester.com/ to verify.

Michael Murphy | https://murfy.nz
Referral Links: Quic Broadband (use R122101E7CV7Q for free setup)

Are you happy with what you get from Geekzone? Please consider supporting us by subscribing.
Opinions are my own and not the views of my employer.

freitasm

BDFL - Memuneh
80658 posts

Uber Geek
+1 received by user: 41071

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#2694690 19-Apr-2021 09:48

Ok, assumed "Office 365" was business - sorry but you can't have DKIM.

You can however still create a DMARC policy. Make sure SPF is correct and then create the DMARC policy - you can start with a relaxed posture because the idea is not to block spam pretending to be from your domain but to allow email from your domain providing it comes from the correct servers.

Referral links: Quic Broadband (free setup code: R587125ERQ6VE) | Samsung | AliExpress | Wise | Sharesies

Support Geekzone by subscribing (browse ads-free), or making a one-off or recurring donation through PressPatron.

nztim

4015 posts

Uber Geek
+1 received by user: 2713

ID Verified

Trusted

TEAMnetwork

Subscriber

#2694692 19-Apr-2021 09:52

We have found some of the 365 servers are not in the spf.protection.outlook.com TXT record and as such some mail is getting marked as SPAM

We have raised this with MS

Any views expressed on these forums are my own and don't necessarily reflect those of my employer.

Earbanean

1110 posts

Uber Geek
+1 received by user: 377

#2694694 19-Apr-2021 10:02

michaelmurfy:

@Earbanean Also make sure the SPF record is actually correct for your domain.

Use https://www.mail-tester.com/ to verify.

Thanks, I will try that tonight (can do from work). I did go into a gmail account and look at the header of an email sent from my Office 365 that went to Spam and it seemed to say SPF passed. But I'll check with mail-tester as well tonight.

Earbanean

1110 posts

Uber Geek
+1 received by user: 377

#2694950 19-Apr-2021 17:59

michaelmurfy:

@Earbanean Also make sure the SPF record is actually correct for your domain.

Use https://www.mail-tester.com/ to verify.

OK, say it gave me 9/10. It failed on not being signed with DKIM (as expected) and it stated that no DMARC record was set up. However, it did pass SPF, which is good at least. So I guess all I can really do is add the DMARC record and try to tell recipients to set me as not Spam. Easier said that done though, when some I can only contact by email

Samsung

Shop now on Samsung phones, tablets, TVs and more (affiliate link).

Earbanean

1110 posts

Uber Geek
+1 received by user: 377

#2694954 19-Apr-2021 18:21

Hmmm, so I added the DMARC record and it seemed to take affect immediately. The email test gave a pass on DMARC, as well as SPF, but still showed fail on DKIM (again as expected).

Then when I sent another test email to a gmail address that had put me in spam yesterday, this time it went to inbox. So it seems maybe the DMARC with just SPF, but not DKIM, does help. I'll now try to ask known recipients, where I can. It'd be nice if Microsoft would allow DKIM for Home plans, as well as Business, though.

MadEngineer

4591 posts

Uber Geek
+1 received by user: 2570

Trusted

#2694962 19-Apr-2021 18:44

Something of note is to make sure that if you’re including links in your signatures that the website is clean - don’t use .ms links for example or any URL shortener.

You're not on Atlantis anymore, Duncan Idaho.