Microsoft exchange out of office reply doesn't arrive to gmail addresses

Question

Depending on my DMARC settings out of office replies are not arriving (if DMARC is setup to reject), or being sent into junk (DMARC is setup to quarantine) to gmail or yahoo emails, it works fine when its communication between exchange mails.

The reason for this, as it was explained to me by our support, is that when exchange generates an out of office reply it generates it with an empty RFC5321.MailFrom field, which according to RFC standards makes it invalid because there is a difference in the From and MailFrom fields. According to RFC 3798 - Message Disposition Notification it states that the MailFrom field must always be null to force the out of office message to be sent only once.

The envelope sender address (i.e., SMTP MAIL FROM) of the MDN MUST be null (<>), specifying that no Delivery Status Notification messages or other messages indicating successful or unsuccessful delivery are to be sent in response to an MDN.

The question being how do I work around this, when I setup out of office on a gmail address and send a message to it I get a returned out of office message. So this only doesn't work when the message is sent from a gmail or yahoo account to an exchange.

Answer 1

I'm gonna post the answer I got from reddit that seems to be correct by /u/omers:

The solution is DKIM. The null return-path only affects SPF alignment in DMARC which can be compensated for with DKIM alignment. As long as you're DKIM signing all of your domains and the signatures are applied to MDNs you'll have no issues.

If you're on-prem and only have one domain you can also make SPF alignment work with relaxed alignment. When the MailFrom/return-path is null, SPF alignment is performed between the EHLO/HELO hostname and the header from address. Ie, if your mail server identifies as mail-exch-01.example.com and the message has a header from of [email protected] it will align even without a return-path. Obviously doesn't work in the cloud with onmicrosoft.com being the EHLO domain unless you force MDNs to use the user's onmicrosoft.com address. DKIM is still easier.