Google Workspace Rejecting Sophos Setup Messages (and other important messages

Question

Messages are being rejected by GMail with DMARC failures. Most of the messages are from well known senders such as Google, Microsoft, and the USDA. The senders' DKIM is in order and we have correct DMARC, SPF and DKIM settings with respect to our DNS. Gateways are in place per the documentation. GMail extra spam checks are turned off. Here's a rejection of the Sophos Central welcome email:

Received from an SMTP server with IP address: 50.112.39.248 (TLS enabled)

550-5.7.26 Unauthenticated email from <a href="">http://microsoftonline.com" target="_blank">microsoftonline.com</a> is not accepted due to 550-5.7.26 domain's DMARC policy. Please contact the administrator of 550-5.7.26 <a href="">http://microsoftonline.com" target="_blank">microsoftonline.com</a> domain if this was a legitimate mail. Please 550-5.7.26 visit 550-5.7.26 <a href="">support.google.com/.../2451690" target="_blank">support.google.com/.../a> to learn about the 550 5.7.26 DMARC initiative.

Mar 24, 2022, 4:32:23 PM

Rejected

Has anyone else encountered this?

Google suppport said that it's an SPF issue, but I've triple-checked my settings and they're correct.

Edited tags
[edited by: Raphael Alganes at 6:02 AM (GMT -7) on 7 Jun 2023]

Draco · Answer

Please ask google support to check your Gateway IP list in google workspace The email that fails DMARC does if come from one of those IP's? If so according to their documentation referenced above they should not be doing DMARC. I cannot see how this can be normal behavior if their document says it should not be doing this. It say inbound gateway should do DMARC checks, which is Sophos Central Email.

Justin Hoeft · Answer

This is a confirmed issue and Sophos has reached out to Google for a resolution. See https://docs.sophos.com/central/Customer/help/en-us/ManageYourProducts/EmailSecurity/SophosGateway/ExternalServices/ConfigureGoogle/index.htm 
 DMARC failures from Google email servers 
 If you have turned on Time of Click URL Protection or Smart banners in your email policies, you may see DMARC failures reported for inbound messages. 
 This is because Google doesn't consistently process emails from IP addresses in its Gateway IPs list. 
 Google's documentation says: "Gmail doesn't do SPF authentication for messages sent from IP addresses in the Gateway IPs list. The inbound gateway should do DMARC checks. DMARC authentication is bypassed for incoming messages from listed hosts." See Set up an inbound mail gateway . 
 Our tests show that this doesn't always happen, and Google marks some emails as DMARC failures when it shouldn't be doing DMARC checks. We have raised this with Google.

Google Workspace Rejecting Sophos Setup Messages (and other important messages

Top Replies