M365, Email Security Mailflow, Outbound SPF failure

Hello there,

Good day and thanks for reaching out to Sophos Community, hope you are well

Might these Recommended Reads be able to give insight as it seems to be a similar use case: 

 Sophos Email: [Mailflow]: SPF check passes Sophos Email even though the original SPF status is a fail [Sender: M365 hosted domains] 

 Sophos Email: The proper host to do SPF sender checks 

Kindly let us know how it goes for you. Many thanks for your time and patience and thank you for choosing Sophos

Cheers,

Hi, thanks for your reply.  I did come across those articles, however they're not quite the same as what I'm experiencing.  The SPF failures are not within my own system when receiving email, they are happening on sending emails on my customers' systems due to an SPF fail between my M365 domain and Sophos (Mailfow scanning) before it leaves my domain for the recipient.  That fail doesn't impede the flow of email for me and is the default setup for Mailflow.
IE: email sent - M365 sends to Sophos for scanning - Sophos sends back to M365 if clean - M365 sends email to external recipient.  On the receiving side, some appliances are seeing that my email was sent FROM a Sophos mail server and fails SPF.  My SPF and MX records list Microsoft.

In my own SPF record, I added the Outbound Sophos IP block that matches my region (Canada), and that has stopped the SPF failures between M365 and Sophos for mail scanning (item 8 & 9 above).  This shouldn't be needed for this kind of set up, in my opinion.

Hello Andrew, 

Good day and many thanks for sharing an update to this and sharing your added steps, good to know it worked on your end.

Many thanks for your time and patience and thank you for choosing Sophos

Cheers,

No. That's not a response. He didn't fix the problem, he implemented a workaround.

Why are emails coming from Sophos and not from his O365 tenant? That's actually a massive security hole. It means any Sophos customer is authorised to send mail from his domain.

Stuart James  Am not sure why M365 is checking SPF records when it comes to emails that are considered still within the system (albeit M365->Sophos->M365) but usually SPF should be checking inbound emails. So normally SPF is meant to prevent spoofed inbound emails from getting to the internal users. From how the OP described the scenario, it looks like the M365 that was supposed to relay the email out to the internet should have been the one adjusted. IF the M365 is not checking outbound emails but only inbound emails for SPF record, then this would also have the same effect as the workaround that was put in place.

I think you've misunderstood his problem. It's nothing to do with internal emails. The problem is that mail routed to Sophos is being stamped with the IP address of the Sophos processing servers. 85.113.88.238 is a Sophos server and the email is saying that it's being sent from that server instead of the O365 server.

Sophos escalation team tells me that this is expected behaviour and has no interruption of mail delivery -- except for those customers whose email appliance (Barracuda is one) is scanning the whole email header looking for SPF failures and quarantining our sent email due to this.  You would think that M365 and Sophos would have some kind of integration or trust to avoid having these transactions look like external deliveries between them.
I haven't had this issue since adding the outgoing sophos IP block to my SPF record, so I'm leaving it like that for now.

Sophos escalation team tells me that this is expected behaviour and has no interruption of mail delivery -- except for those customers whose email appliance (Barracuda is one) is scanning the whole email header looking for SPF failures and quarantining our sent email due to this.  You would think that M365 and Sophos would have some kind of integration or trust to avoid having these transactions look like external deliveries between them.
I haven't had this issue since adding the outgoing sophos IP block to my SPF record, so I'm leaving it like that for now.

Thanks Andrew

If it's expected behaviour, then their documentation is wrong. The mailflow documentation has absolutely no mention anywhere about updating SPF records to include Sophos. That is only included in the Gateway documentation.