Issue Overview

Organizations using a strict DMARC (Domain-based Message Authentication, Reporting, and Conformance) policy may experience issues where Auto Reply and Out of Office (OOO) messages are not received by external providers. This issue arises because DMARC enforces alignment between the "From" header and the Return-Path address, but Out of Office messages often use a blank Return-Path, leading to rejection by strict DMARC configurations.

Symptoms

When running a mail trace in Exchange Online for an auto-reply email, administrators may see errors such as:

Error: ‎550 5.7.520 Access denied, Your organization does not allow external forwarding. Please contact your administrator for further assistance. AS(7555)

Even when external providers like Gmail receive the initial SMTP transaction, they may still refuse to deliver the auto-reply due to DMARC failures.

Technical Explanation

DMARC enforces email authentication by ensuring that the domain in the "From" header aligns with the Return-Path address. When an email is sent via SMTP, the Return-Path (also known as the envelope sender) is typically used for bounce handling and DMARC verification.

However, according to RFC 3834 (Recommendations for Automatic Responses to Electronic Mail), Out of Office messages typically use a blank Return-Path to prevent email loops. Since strict DMARC policies require alignment between the "From" header and the Return-Path, an Out of Office message with a blank Return-Path will likely be rejected by recipient mail servers enforcing strict DMARC policies.

Difference Between Strict & Relaxed DMARC Policies

Strict DMARC Policy

• Requires an exact match between the domain in the "From" header and the Return-Path.

• This can block auto-replies and Out of Office messages.

Relaxed DMARC Policy

• Allows subdomains of the "From" domain to be considered valid.

• Increases the likelihood that auto-replies and Out of Office messages will be delivered successfully.

Solution: Adjusting the DMARC Policy

To resolve this issue, administrators can modify their DMARC record from strict to relaxed. The steps to do this are outlined in the following guide:

➡️ SPF and DMARC Records for Email Hosting

Risks of Using a Relaxed DMARC Policy

While changing the policy to relaxed can improve the deliverability of auto-replies and Out of Office messages, it does come with security risks:

• Increased Risk of Email Spoofing: Attackers may find it easier to send fraudulent emails that appear to originate from your domain.

• Potential DMARC Failures for Subdomains: Some security-sensitive domains may require strict DMARC enforcement to prevent phishing attempts.

Can We Add or Rewrite a Return-Path Header in Out of Office Replies on My Exchange Server?

No, transport rules in Exchange cannot rewrite anything that affects the SMTP transaction, including the Return-Path header. This limitation is crucial because the Return-Path is established at the SMTP envelope stage and is not subject to modification by transport rules.

Microsoft explicitly states that address rewriting does not change certain email properties, including the Return-Path. More details can be found in the following Microsoft article:

➡️ Address Rewriting in Exchange

Pay particular attention to the paragraph "What address rewriting doesn't change", which confirms that modifying the Return-Path is not supported.

Conclusion

For organizations that rely heavily on auto-replies and Out of Office messages, relaxing the DMARC policy can provide a practical solution. However, administrators should carefully weigh the security implications before making changes.