Quarantined Messages / Authentication failure / DMARC

Question

Hi, I'm struggling with the quarantine email, since we received a few emails that were sent to quarantined due to "Authentication failure / DMARC".

Im not undestanding at forst it shows: spf=softfail smtp.mailfrom=XXXXXXX@usanainc.com; dkim=none; dmarc=fail (recordpolicy=quarantine)

But then I got this too, everything seems to be fine here:

spf=pass smtp.mailfrom=usanainc.com; dmarc=pass action=none header.from=usanainc.com; dkim=pass header.d=usanainc.com;arc=none

This is what is see on the header:

Authentication-Results: mx-01-us-east-2.prod.hydra.sophos.com; spf=softfail smtp.mailfrom=XXXXXXXX@usanainc.com; dkim=none; dmarc=fail (recordpolicy=quarantine) header.from=usanainc.com

Received-SPF: softfail receiver=mx-01-us-east-2.prod.hydra.sophos.com; client-ip=148.163.158.73; envelope-from=<XXXXXX@usanainc.com>; helo=mx0a-001bdd01.pphosted.com;

X-Sophos-Processing-Start-Time: 1724685919552

X-Sophos-Product-Type: Gateway

X-Sophos-Email-ID: e9d2338133364fc4be87308a7562b23c

Received: from mx0a-001bdd01.pphosted.com (mx0b-001bdd01.pphosted.com [148.163.158.73]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx-01-us-east-2.prod.hydra.sophos.com (Postfix) with ESMTPS id 4Wsvcv36pYzdZMC for <lXXXXX@sanoviv.com>; Mon, 26 Aug 2024 15:25:18 +0000 (UTC)

Received: from pps.filterd (m0079641.ppops.net [127.0.0.1]) by mx0b-001bdd01.pphosted.com (8.18.1.2/8.18.1.2) with ESMTP id 47Q5V8j5012189 for <XXXXXX@sanoviv.com>; Mon, 26 Aug 2024 08:25:18 -0700

Received: from sj2pr03cu001.outbound.protection.outlook.com (mail-westusazlp17012037.outbound.protection.outlook.com [40.93.1.37]) by mx0b-001bdd01.pphosted.com (PPS) with ESMTPS id 417dc0jh2u-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for <XXXXX@sanoviv.com>; Mon, 26 Aug 2024 08:25:17 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=MtuGJCJzfbfRj+TLG9T0hU7fVQBHkS0ovCboZA92cwv0qvZaEY+RnzQ5eXrRpMu81bUpyT1MmHIeKldH9J6YHfwGsXGz0q7cUJGbBHx7sbzALLEx30SWE6FdPECbb0GQ4GKhN2WFtIjYDgP+z6xQ6JRp8Oi9VpIcUsL8luzVNtiCblFetwW15RraihM+g8s7GZ+w2kEnGfOdvubimBcDdtjTeCLurcyxiiN/W2n438EkyiUdW+IvTlBc8dCSLYW0jS1u8gaeFtY52sGJzPNGbVFl870VZfX30HOq/BvQbCd1VH8GC5SFEf5TsNzDwtJF860WSmDd+tSsz03DRUenCQ==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=SLNQ3D5rC2AXFaxWbGHcXV6q4MZJ4X+SN8A2mfuW714=; b=KxvZB4uBTc5nBFLRlwyMRcRPqQBMkOx+D7zdo03BLQTBpAJw+RwssQjpYERz5qssWgliWXviGV0UaK0osuBdc6Qb/kFvV4CRKsj+m3ZFDltx+ljRIiSBDo09cS31Ni9MGHXpSkoSkrD9RS2BAZQqUTOXrfBMJqbMRSyLe2of2b0IkYSRw4Vn7M0lHqczxhdRdOOj/moV3+Ir4B1pw9ijrQuJz8e9PBqGJfO4zPnRNGsqwIs6J8QQpnpUQkqdvA/7BtqCjbV+HsB8sRPcEH4KdQy7okQ2xDKZg0RSJCZuGw/rou5oI4l6kldwVUBI3RYJICx0MK8tiAEj7TidXLqFGA==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=usanainc.com; dmarc=pass action=none header.from=usanainc.com; dkim=pass header.d=usanainc.com;arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=USANAverse.onmicrosoft.com; s=selector1-USANAverse-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=SLNQ3D5rC2AXFaxWbGHcXV6q4MZJ4X+SN8A2mfuW714=; b=HNS/YH1mZ0M/vWsSr9qy37x6UKYHdyQZ6jK6r1ZS0rXxq3UmuMvaRgVHQkRBrakIAIVFQ+quFFv+hPMeOJOBd0bZLOf1XeuV4fgqGK5blRqr+gb9Ni4GlgYc4YJDRkXJXKBBzaA5rtZR7L5JVQmoTD06AruCigvpyN793Y0bQiY=

Received: from CO6PR04MB8313.namprd04.prod.outlook.com (2603:10b6:303:134::13) by SN7PR04MB8720.namprd04.prod.outlook.com (2603:10b6:806:2e0::13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7897.24; Mon, 26 Aug 2024 15:25:14 +0000

Received: from CO6PR04MB8313.namprd04.prod.outlook.com ([fe80::151:d8d9:df19:2f62]) by CO6PR04MB8313.namprd04.prod.outlook.com ([fe80::151:d8d9:df19:2f62%5]) with mapi id 15.20.7897.021; Mon, 26 Aug 2024 15:25:14 +0000

From: "Charlotte Falvo (Salt Lake City)" <XXXXX@usanainc.com>

To: Liliana Perez Guadarrama <XXXXX@sanoviv.com>

Subject: FW: Sonaviv - Pete Benedict

Thread-Topic: Sonaviv - Pete Benedict

Thread-Index: AdrUkSqx41Hl0oFQSReLYxrRDuY6ZgAArQV6BLHhPjAAMHGRIAAQDFQgAoXh24AABZf6EAAAHAM/ACU1YjcAABMvIAABIvO+AAAI8lAAByKuRwAAMuhgAAemyRAAH66JkAA/O7eqAAAiZjAAAnlcAAC5E2uQ

Date: Mon, 26 Aug 2024 15:25:14 +0000

Message-ID: <CO6PR04MB8313970273C25122B07298EC9B8B2@CO6PR04MB8313.namprd04.prod.outlook.com>

In-Reply-To: <IA3PR04MB940166A25B64A064208CEBA8858F2@IA3PR04MB9401.namprd04.prod.outlook.com>

Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: CO6PR04MB8313:EE_|SN7PR04MB8720:EE_

x-ms-office365-filtering-correlation-id: 3ea72fea-d6ca-4815-592f-08dcc5e3486d

x-ms-exchange-senderadcheck: 1

x-ms-exchange-antispam-relay: 0

x-microsoft-antispam: BCL:0;ARA:13230040|376014|1800799024|366016|38070700018;

x-microsoft-antispam-message-info: =?utf-8?B?QjBJRHVLOWxqVE5ZcGQyMkJqZVA0aVIyYStjaytuRi9FMFZqbGlEa0czVVBU?= =?utf-8?B?d1JUMFNBUUVQZ21JY2tkSElMK0h2UDR4LzlvVU9XaUdCZEc2TXZrTkt4WFZj?= =?utf-8?B?eWRkYVdXZlFJUjcrVHJTS1ZLSnJNSkpwZlJjbzJCQlF0WUNyd3d0VEp0WkRP?= =?utf-8?B?Z1Q1K2NhRDQ2VnNtTzByZmtnSjRyZW51VzBLeVNsSjlYWXkzbVd0akhwNExP?= =?utf-8?B?cGlnM2JKZTEzUHBBVXI1NzZqekNzS0VRVGswWXRaLzA4c3ZBdzRPZ1dEeitQ?= =?utf-8?B?NFRzRTE0dDlnb2dqcEZXd3p2cG9GTHpjdXRyYWJCTTVBQUVXTE1WWi92T3ZK?= =?utf-8?B?WWJSclAwcnBJZ2RHcnB1VzI1VzFHQUNGbWFEY0dYbHdoT3dtSklTZnBmQXQv?= =?utf-8?B?ZklZbkJiWUdGUVR5QmVtc2F3cXNLR09INXlUNVJVYzczZEZQVDVqRmxTbUVo?= =?utf-8?B?VXdHWGttY2Q2MjRhWnExZmR3MWRzU1RPc1UxL0l6NGp2SHNhcDNMNXlUKys1?= =?utf-8?B?ZmxvSXlqd29KdFMxekkvYm5QKzJYcGtpWENTbUZoUCtHbThtNDFaaFh6TnJS?= =?utf-8?B?MWtFTDlUSHZoeVlZZm5yOUZmbEZpWmFzOCtodnYybjc1MFRzQVBCMkhIc1hj?= =?utf-8?B?ZG1kaHJRSm1oMStjMjhTUXVPQ0NzY1EvNGdMZjJnSFdOSnExbVhUbXV1enNS?= =?utf-8?B?ZEVyKzM4bUMwaVhIekhOMWNURUtwbmdGTFdCTnE5ajFrSGY5WGZXTHpBdTN6?= =?utf-8?B?dFRqcFlUanVyTXRhZmNiOXJmWUxnZTl0Tmk4ek1Hdm9hRFkzUUNldk9ocnVX?= =?utf-8?B?YVlyK1NCd2gzL1ZwYkhsdUxmSXFsRjc2UnFZY2VVcXlndFNkNm4yaVFVaGZI?= =?utf-8?B?MU1VN3V3dFFrbzNSbXZYV1pyV1NGVU53K1U3eHFkVzU2UEtJRDRkdUlZZUR6?= =?utf-8?B?ei9xdkF0WldWci83WmZVWFFFZm9tUEJaendFUzRSVmpTQVJ5RHUyb245MWh6?= =?utf-8?B?dk56a0xZeVc0TlFleUlWNEYxKzF6R3RVSjlESVJCMmVnRXBBR1dyNXFaY3Yz?= =?utf-8?B?anNya2tReVBjUTBYVGluNDh4eXJzSTVBclFtM0llRVJZV0dMcGtWb3Fqb2Vs?= =?utf-8?B?L0RNYWJyWjNTcHY4cVRZb0JRWjF1T3FSUjdteSs1ZGVnZWphTDJwMVdXMHZV?= =?utf-8?B?ZFd5UTlYRzRzcG5mUFdNZ1Rob1Fxa1pna2p4K1Bjakc1bm43blNDeDBNZkRM?= =?utf-8?B?Q1loTUFIZkhZSngzamNVcElXbk1jemRpUThhWnVJVFFpWXRraklOVUhsWGx5?= =?utf-8?B?VFdaOUNNVzVuNGdoUFJlak5zU3N0MlYrcXNBWUNRSmF4bi8rWk9LUm4vekdY?= =?utf-8?B?Q0JvUHhjbmZJUDZ1OElTNWdYTlJtQzBnbWlkYWplcFg1dXQ3a1dYOE5JRlhZ?= =?utf-8?B?MkJ6cnBvek9mVFR3UTlXY0l5cHUzTHhKYnhNTDk0Y2F0clF1Nys1T1dMdXNp?= =?utf-8?B?UWM0ZlA4VHpzVEd4cGpsNzBsSy93cm9abERQQW5vUmxIaDBsc2MvdCtVMWZG?= =?utf-8?B?bkpYVXlpQ0lERWdyQU5CZTR1QjFhQ3hodkpWMVhZd2QvNnpGK2hXUHMzTldX?= =?utf-8?B?aUJIVjlCV285UE1vMlgxRzFQRktPUEM4WEJhaXhMOXRTejBPOGloVG9VdzhU?= =?utf-8?B?RDR5cHJXbndlL0JwUVNrS05GT1VlR3FUOFQzTzFDWlNTZTh6aFF6QjBOc1hT?= =?utf-8?B?Z1R6ZjkvMzBqaDJSMkNwU1padVRNOE96SG84dWFmZmxrdVp2OXJ6NXNnNVRV?= =?utf-8?Q?BCHwqAM3whqFd6fR3Z0ayWJ4o7gmWz1+bOXGk=3D?=

x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CO6PR04MB8313.namprd04.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(376014)(1800799024)(366016)(38070700018);DIR:OUT;SFP:1102;

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0: =?utf-8?B?Y1FQUDR4ZVcrNTUzRTVPd2k4OU1RUGpabUhnWXorNEhSTytIRVdNRWppZWx4?= =?utf-8?B?TncxNGkvUVdZb1lNK3A3WkppNXphd0ZyalJieHJ2eDRITUtOVFN5YUk1NWZD?= =?utf-8?B?bFYreGpNN0sxTjAySnRvM2c4aDJvai9FTHhDYThsOGs0dWx6aVJleEltL0NJ?= =?utf-8?B?TG5Pd09oVHZ4eVVTLzVkOTlYYXZjaWU2RUIzSmpHVzEyQTh5WG1XRWVPM3BM?= =?utf-8?B?SGJ1bzhVTjF0enYrbG10L2psYndZQmo2Zm9acGd6NEpPYUtIWXp5SXFPTGZ3?= =?utf-8?B?cWgrdXhlQXNYb2g5bmNYM1poMVNpQXdKc0JxQ1lLTkRDZ2JGL29NYzk0RGlL?= =?utf-8?B?Y0xiYk53dkd1Lzh4MW1QZmh1dXIxbVBhYlcxUTF5eldOMnZtd1dmQmJqUHRx?= =?utf-8?B?MWNZeDlMRktoSWhrM0Rubzd1NW9HQjcrL3M0ZzJBNU1HcFJNU3JXWjRQSU93?= =?utf-8?B?VGJ4MjJwZUlZNFBnRVk1bElKWWtwNmZRT3lhT2dhWExNZHc1c0E4OFREaURn?= =?utf-8?B?cTFQRWxHUzBDbGRDQjVPT0loZVUvOEdHRWhKaDhrRm51emhuQTd0aldRRmg0?= =?utf-8?B?UGF2NWNrbE9PR1JIc2o3cDNJZ1BPcXVuRDFwcmFkclNvNlByVHowUVJRYUQv?= =?utf-8?B?Ym4veUlSMEV1QWhoMWI0aGNpUStiVlpjQzdlQWIrWnI0WnBValRHYWJJZ1Jp?= =?utf-8?B?TlBMUEt0bVIzdkViRGVicEVjZXV1ZFF4c09BMWFYQzdwR0txSkh6NjBDZmhW?= =?utf-8?B?ekUybXNmK3BMVG5ud2N4V0Z1RHh3VENHS21zU2VGT2crUlFiSVlocFIzNGFO?= =?utf-8?B?ajFhbDVvSnp1Qk5RSEtQUzRVTEYxTFVpOEdPZmY0YzVhdmtCLzVDWjRKTTc0?= =?utf-8?B?dTUvYXh1MHFGUGtyTmFkZW95OVdCSHh0Y3B0dWphVityVTNKNHZhaFZwd0FF?= =?utf-8?B?Nk90dmQrWWhwNmxtdFBWOTFlM3ZIdUtZUm5yMkF1OVVUQ2ZpeFRxZytsTVJO?= =?utf-8?B?L3N1THg1QTltU1l2aHRFWkN2dnNGSjJtS2RPOGFjcktXV2NhTFdMTEw2aHVB?= =?utf-8?B?aTlzbk1LRHJOcFc0Yjhjb2VvTzBCMVdDWlE4RlMrVWpJdjFWc1VwNW5ha2Js?= =?utf-8?B?dTN0OTQzRE9GMzAvVDlKQXM1eW8wWmRORjMvOFAybGNvbkJyRkl5NTM0dVVi?= =?utf-8?B?S1ZrOTNTZ1ljVEhWWWNiK2FQam1zblhRMEo5ZlYxMFhlRjR1aFBneHFVamZx?= =?utf-8?B?K1YrL3BOQnQveUY5ZSt2MHUreS9pRkRTdjNjUGlkc1l6Uzd6TWp1OXlHZ2sw?= =?utf-8?B?a3JHQ3lVVHc1V2hnQWFLWW9hUlJmWGlBWFdCYmN3N2FtZmpBNHEwU01MV01i?= =?utf-8?B?WUlOQWJBdHk4V2QvRkRqdXFrejQ0aEZ2S3NzUjBoZnh4UUNnY3Z1MVMyMHhF?= =?utf-8?B?QWZxU2R3NWgrK1ZQSmpxK0dvdEpUclJPN2pnVHVWTnRiZkRtRG9BeGZiUk95?= =?utf-8?B?OWRLbytrdnpDazA3Vi8rVHdBWkpKVng4T2x3NTBNMklFQUtkQVpGZVNwakI1?= =?utf-8?B?RkltRzJUZlZCTzFxTFdrbEdGYkpqN0hwczYwRjI2a0lIVXIxdSt5ejNER28v?= =?utf-8?B?aExSbGtncm5KRTIrcjN2OVYvaGwvSnV3aVRmTmZTSzNhZWxidFhaR3R4MGZR?= =?utf-8?B?RFNQQThpbjFXL0FGOFEyaXdJem1SZlhWZ3o0aDg2RHRnWGtWSVhFcEZ1Y1Vm?= =?utf-8?B?dzYySmRpWDBYMmlZRUNyQXNYbEY2emE1R2IvQjhmWHZid0RkSW4xaCtkdmVQ?= =?utf-8?B?cWYyMjNBZ1o3VjRqb3ZDano5emVydUhtdDBuMFFqZVdyTHlYVmFEY3MxL0g2?= =?utf-8?B?UjlKaytURDIyMEVQbExaVDBMZFdIT2QzdHBOVFNrZjNwdzMrdFVqRWdWTVB5?= =?utf-8?B?R3RzZGsxMUNQcnA3TEZyZ04rS2Y1ZE5hNkZzRWVzTERJdytGTHpPdTcreGdo?= =?utf-8?B?VmRockVGT3E3ZTVod2xta3FTUjBmQ0JYTFlLS1VjWGh6MnZkSytoenRMcEZH?= =?utf-8?B?S3ZrUUJvMk5uQjk4dktjMXVXazdmMlJIN1JVQnhRcUxWL1ZpLzVPQVZiQW5X?= =?utf-8?B?ZUU5K1l1bTVKd21FSGltcytoU2VFVFlpOHdaVExKNWZjVXhMZXJoRGg5T0R4?= =?utf-8?B?UXc9PQ==?=

Content-Type: multipart/alternative; boundary="_000_CO6PR04MB8313970273C25122B07298EC9B8B2CO6PR04MB8313namp_"

MIME-Version: 1.0

X-OriginatorOrg: usanainc.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: CO6PR04MB8313.namprd04.prod.outlook.com

X-MS-Exchange-CrossTenant-Network-Message-Id: 3ea72fea-d6ca-4815-592f-08dcc5e3486d

X-MS-Exchange-CrossTenant-originalarrivaltime: 26 Aug 2024 15:25:14.2631 (UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 9f93c0a0-fb67-4dff-920f-ff22a7b61b1f

X-MS-Exchange-CrossTenant-mailboxtype: HOSTED

X-MS-Exchange-CrossTenant-userprincipalname: WhYHd8Ya/T0ij0UpslEiXjGnaa/sx7QOwo5MOQTXAWlkV+LbHUU4LVq5uBrRTWofkwCalA3TmPHRtT6kvu3EZPdLdqxG3dlW3WVv9k2vZJY=

X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN7PR04MB8720

X-Proofpoint-GUID: SgvjDGppmbRaqLVWck8KiHR3UHkWFKx4

X-Proofpoint-ORIG-GUID: SgvjDGppmbRaqLVWck8KiHR3UHkWFKx4

X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1039,Hydra:6.0.680,FMLib:17.12.28.16 definitions=2024-08-26_12,2024-08-26_01,2024-05-17_01

Also this are the rules i have set up.

Remove some links
[edited by: Alfonso Galvez at 2:57 PM (GMT -7) on 4 Sep 2024]

Tom Foucha · Accepted Answer

The DMARC policy set by the sending company tells you to Quarantine DMARC failures and your policy says 'Conform to Sender Policy' so Sophos is sending DMARC messages from this organization to quarantine if they fail and the headers say dmarc=fail (recordpolicy=quarantine). Sophos does not support ARC checks at this time. Also in order for DMARC to pass either SPF or DKIM must pass. Since SPF encountered a Softfail likely DNS issue and there was no DKIM retrieved because if it was DNS then we couldn't pull the dkim key. I recommend searching our help docs for DMARC and finding the flow charts that walk you through the order of operation. SPF is evaluated first, if it can't be evaluated (softfail) then DKIM, if we can't get dkim verification then neither SPF nor DKIM passed so DMARC is a fail.

Quarantined Messages / Authentication failure / DMARC

Top Replies