Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 2 replies
  • Subscribers 2 subscribers
  • Views 8087 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Problem with SPF (softfail) when using UTM to forward to Office365

apijnappels

We are testing to have our e-mail to go through the UTM to Office365, so we are certain that at least the UTM has scanned messages using sandstorm.

The setup basically involves this:

  • Have MX records of domain point to UTM
  • Route mail from UTM to previous MX-server (as supplied by Microsoft Office365)

Mail does arrive in the Office365 mailbox, but when testing from a Gmail account I noticed in the headers of the received mail that Microsoft softfails on SPF check for the IP-address of our UTM with a gmail.com domain. I do of course understand that our IP-address would normally not send mails using a gmail.com domainname, but if any senders domain has a -ALL in stead of ~ALL at the end of their SPF record, it will be a Reject and possibly mail will not ever get through.

Is it possible to prevent either the softfail for our UTM that forwards the message or should I look for a way to stop SPF-checks in the Office365 service for the specified domain(s)?



This thread was automatically locked due to age.
Parents
  • 0

    In the UTM, the 'Upstream Hosts List' on the 'Relaying' tab is where this is addressed. I don't know if Office 365 has a similar option or if you can otherwise eliminate the SPF check there.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Reply
  • 0

    In the UTM, the 'Upstream Hosts List' on the 'Relaying' tab is where this is addressed. I don't know if Office 365 has a similar option or if you can otherwise eliminate the SPF check there.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Children
  • 0 in reply to BAlfson

    I have found in Office365 the option to not act on SPF hard fail, so this should prevent such mails from getting lost.

    Managing several Sophos firewalls both at work and at some home locations, dedicated to continuously improve IT-security and feeling well helping others with their IT-security challenges.

Unfiltered HTML