Sophos Email customers using IP-based mailflow rule connectors must migrate to certificate-based configuration by March 31st. To see if you're affected Click Here.

Thread Info
  • State Suggested Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 8 replies
  • Answers 2 answers
  • Subscribers 19 subscribers
  • Views 7185 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Google Workspace Rejecting Sophos Setup Messages (and other important messages

Justin Hoeft

Messages are being rejected by GMail with DMARC failures. Most of the messages are from well known senders such as Google, Microsoft, and the USDA. The senders' DKIM is in order and we have correct DMARC, SPF and DKIM settings with respect to our DNS. Gateways are in place per the documentation. GMail extra spam checks are turned off. Here's a rejection of the Sophos Central welcome email:

Received from an SMTP server with IP address: 50.112.39.248 (TLS enabled)
550-5.7.26 Unauthenticated email from <a href="">http://microsoftonline.com" target="_blank">microsoftonline.com</a> is not accepted due to 550-5.7.26 domain&#39;s DMARC policy. Please contact the administrator of 550-5.7.26 <a href="">http://microsoftonline.com" target="_blank">microsoftonline.com</a> domain if this was a legitimate mail. Please 550-5.7.26 visit 550-5.7.26 <a href="">support.google.com/.../2451690" target="_blank">support.google.com/.../a> to learn about the 550 5.7.26 DMARC initiative.
Mar 24, 2022, 4:32:23 PM
Rejected
Has anyone else encountered this?
Google suppport said that it's an SPF issue, but I've triple-checked my settings and they're correct.


Edited tags
[edited by: Raphael Alganes at 6:02 AM (GMT -7) on 7 Jun 2023]
  • 0

    Initial Troubleshooting:

    1. Reset all Gmail settings to default
    2. Start over using the latest Sophos install references linked from Sophos Central

    During step 2 of step #9 of configuring the GMail Gateway IPs it says:

    9. Turn on:

    • Automatically detect external IP (recommended).
    • Reject all mail not from gateway IPs.
    • Require TLS connections from the email gateways listed above.

    The second step (Reject all mail not from gateway IPs) causes Sophos EMail to stop delivering messages and emails enter the Queuing... state. I have had to leave that setting off for any emails to get through.

    Additional Troubleshooting:

    1. Corrected DKIM to match Sophos-recommended setting
    2. Double-checked SPF records for the fifth time

    Headers show all PASS for everything

  • 0 in reply to Justin Hoeft

    Continued troubleshooting indicates that Smart Banners are breaking DKIM - the alteration of the message body causes a mismatch which Google decides must be spam. Creating a group with Smart Banners disabled and Quarantine for Impersonation Protection then adding my Google Workspace users to the new group seems to fix the issue.

  • 0 in reply to Justin Hoeft

    Overnight logs indicate that this isn't the problem in it's entirety - DKIM is still indicated as broken in some messages at the GMail user, and a bit of testing indicates that it's due to URL rewrites altering the body of the message. Incidentally, reading headers of successful messages I found that turning off URL rewrites and refraining from adding headers guarantees the integrity of the message.

  • 0

    Confirm you have configured the gateways correctly 

    https://docs.sophos.com/central/Customer/help/en-us/ManageYourProducts/EmailSecurity/SophosGateway/ExternalServices/ConfigureGSuite/index.html#add-your-domain-and-verify-ownership

    According to gmail article https://support.google.com/a/answer/60730?hl=en

    "Set up the inbound gateway setting to identify the gateway’s IP address or range of addresses. Gmail doesn't do SPF authentication for messages sent from IP addresses in the Gateway IPs list. The inbound gateway should do DMARC checks. DMARC authentication is bypassed for incoming messages from listed hosts."

    So confirm that the correct IP's are on the list and that the email comes from that IP 

    If these are correct then the question becomes why is gmail checking this?

  • 0 in reply to Draco

    I have double and triple-checked this and the only solution is to add each sender with a DKIM of "-all" who is rejected to the Gateways list. Google's support seems to not be able to see an issue with this, describing the behavior as normal. My solution, for now, is to disable Smart Banners for this tenant and rely on changing the Subject line.

  • 0 in reply to Justin Hoeft

    Please ask google support to check your Gateway IP list in google workspace The email that fails DMARC does if come from one of those IP's? If so according to their documentation referenced above they should not be doing DMARC. I cannot see how this can be normal behavior if their document says it should not be doing this. It say inbound gateway should do DMARC checks, which is Sophos Central Email.

  • 0 in reply to Justin Hoeft

    This is a confirmed issue and Sophos has reached out to Google for a resolution. See https://docs.sophos.com/central/Customer/help/en-us/ManageYourProducts/EmailSecurity/SophosGateway/ExternalServices/ConfigureGoogle/index.htm 

    DMARC failures from Google email servers

    If you have turned on Time of Click URL Protection or Smart banners in your email policies, you may see DMARC failures reported for inbound messages.

    This is because Google doesn't consistently process emails from IP addresses in its Gateway IPs list.

    Google's documentation says: "Gmail doesn't do SPF authentication for messages sent from IP addresses in the Gateway IPs list. The inbound gateway should do DMARC checks. DMARC authentication is bypassed for incoming messages from listed hosts." See Set up an inbound mail gateway.

    Our tests show that this doesn't always happen, and Google marks some emails as DMARC failures when it shouldn't be doing DMARC checks. We have raised this with Google.

  • 0 in reply to Justin Hoeft

    So what are our options? 
    Who is responsible? Google or Sophos?
    Who could manage a patch to solve this in his side?

Unfiltered HTML