hi - we have an odd one we have been tracking. We are starting to find domains which reject our emails with DMARC failures.
Our outbound email is signed by the ESA with it's own DKIM key and you can see it for example with gmail.com. However, our email is also DKIM signed by our O365 tenant with the onmicrosoft.com domain. This is fine to have emails with two DKIM signatures in the headers.
However, some destination domains it appears the ESA does NOT put our DKIM signature into the headers (just leaving the O365 onmicrosoft.com DKIM header - which fails as we regard our O365 tenant as an internal email server). I'm not 100% on the theory it is not signing the DKIM key as the outgoing logs say it is signing it (and it's hard to determine via the bounce message as I think the bounce message is the incoming message prior to signing by the ESA?). The email is rejected for example:
Remote server returned '554 5.0.0 <[203.42.40.138] #5.0.0 smtp; 5.3.0 - Other mail system problem 550-'5.7.0 Mail is unauthenticated and has been blocked. The sender must\n5.7.0 authenticate with both SPF and DKIM. IB716\n5.7.0 i{7218dcc0-359f-451b-b459-0b409f85663f}' (delivery attempts: 0)>'
We'll log a case in the new year but has anyone seen similar and maybe just a configuration error?
My other theory is that "some" mail servers can't cope with two DKIM headers and just read the first one (the O365 one) and reject instantly.
