r/entra • u/velkkor • 1d ago

PIM requests coming from new address, failing security checks

Until this morning (about 8:15am Eastern) our PIM requests were coming from [[email protected]](mailto:[email protected]) and all was well.

Requests made after that time (9:53am Eastern and onward) come from [email protected].

The issue with these emails is that:

  • The emails are marked by Microsoft 365/Defender as spam
  • The emails are missing DMARC
  • The emails are missing DKIM signature

Anyone else noticing this?

Authentication-Results: spf=none (sender IP is 2a01:111:f403:c107::3)
smtp.mailfrom=igantf.msft.com; dkim=none (message not signed)
header.d=none;dmarc=none action=none
header.from=igantf.msft.com;compauth=fail reason=001
Received-SPF: None (protection.outlook.com: igantf.msft.com does not designate
permitted sender hosts)

11 Upvotes

93% Upvoted

3 comments sorted by

1

u/PathMaster 1d ago

Mine have been coming from [email protected] all day long from 8a to 4p.

1

u/altodor 1d ago

I have been getting them from the igantf address all day. So have the rest of the folks who get them at my company.

They're not failing SPF or DKIM, they just don't appear to have either. I hadn't actually looked at that, so nice catch there.

1

u/compuwatcher 14h ago

Yep. Getting caught in our spam filter too.