SPF Check with Office365 mailbox

[Diabolicus23]

Hi all,

I'm encountering a strange problem with a FortiMail unit ad an environment with both on-premise and in-cloud mailbox.

The problem regards the incoming email flow.

When an email is sent to a mailbox on premise (hosted to the local Exchange Server), no problem.

When an email is sent to an in-cloud mailbox, I have 2 steps involved:

[ol]

in the first one I see a mail sent to xxxx@domain.com (the domain of the company); no problem here and the mail is sent to the internal Exchange Server.

in the second one I see a mail sent from the IP of the Exchange server to xxxx@domain.onmicrosoft.com and here I have a lot of SPF Check Fail[/ol]

This happens with the message:

SPF=FAIL: (envelope from first.last@sender.com) indicates that MTA (1.2.3.4) is not permitted to send email for sender.com

Where :

[ul]

first.last@sender.com is the original sender of the email

1.2.3.4 is the public IP of the FortiMail unit[/ul]

From what I understand, my public IP address is not form the ones allowed to send email as @sender.com (and this is correct).

The question is: how could I avoid to perform SPF Check only in this cases?

I'd like to disable SPF check from mail sent from my internal Exchange Server and the in-cloud domain but I don't think this could be done.

Any idea?

[emnoc]

Simple, If the  FML is handling the mail than write a policy allowing the   internal mailserver to send and "with a AS policy" that has no SPF check.

WebGUI

Policy > Policies

You should be able to order that policy to avoid  AS policy issues ( thresholds,sessions, AS rating ,etc......) Just be sure that you can send mail for that domain and have a correct TXT or SPF DNS RR.

[Diabolicus23]

Not so simple since I shoud create a policy with an IP as a Source (the internal Exchange Server) and a domain as destination.

But the policies are IP ---> IP or sender --> recipient