When attempting to deliver mail to a downstream / external mail server, the messages are rejected and the Message Audit Log indicates that the message has failed DMARC authentication:
550-5.7.26 unauthenticated email from domain.com is not accepted due to\r\n550-5.7.26 domain's dmarc policy. please contact the administrator of\r\n550-5.7.26 domain.com domain if this was a legitimate mail. please visit\r\n550-5.7.26 https://support.google.com/mail/answer/2451690 to learn about the\r\n550 5.7.26 dmarc initiative. y129si4332442ybf.273 - gsmtp
The destination mail server is rejecting the message due to DMARC authentication failure.
Ensure that SMG is properly configured to support DMARC authentication for the sending domain / envelope sender.
If relaying mail for another domain by using the "Add bcc recipient" or "Route to" policy actions, the SMG internet facing IP addresses will likely need to be whitelisted by the destination mail service as SMG's IP addresses will not be listed by the SPF records as an allowed sender.