Out of Office notification failing DMARC authentication
search cancel

Out of Office notification failing DMARC authentication


Article ID: 172242


Updated On:


Email Security.cloud


Out of Office notification may fail DMARC authentication when you have sent it through the Symantec Email Security.cloud service; DKIM signature is not in the mail header. The mails may be delivered to the recipient's Junk folder when the action in DMARC record is set as q=none, or q=quarantine but recipients do not have quarantine environment.



Email Security.cloud


Out of Office notification is commonly sent from a null (blank) sender as the Env Sender (RFC5321.MailFrom) and the users mail address as a Body sender (RFC5322.From) and Notifications\Automatic Replies are sent from Mail2.bemtann.messagelabs.com, When Symantec delivers mails to recipients, HELO/EHLO identity is Symantec's host name, which is used as the Env Sender in SPF/DMARC authentication instead of a null sender.


Env Sender (RFC5321.MailFrom)


Body sender (RFC5322.From)

[email protected]

HELO/EHLO identity



The reason for DMARC failure is SPF alignment check; The Env Sender (null) and the Body Sender (yourdomain.com) do not match.  The DKIM signature, which is an alternative way to verify the authenticity of the message, is not in the mail header.



Enabling DKIM signing in Email Security.cloud service can solve this issue.

Services > Email Services > Outbound DKIM Signing Settings


For more details about how to enable the feature on your account, please kindly refer the following link.




If you are experiencing an error with 553-you are trying use me as a relay when sending Out of Office notification from Hosted Mail Services (e.g.  Office365, G-Suite), please kindly refer the following link.