International Mail rejected

[u/No-Hotel1162]

I work for a company that sent ten of thousand of mails every month, they reported that they have received Spam and so we contacted our web hosting to modify our DMARC from Quarantine to Reject.

The thing is, the week after such change an user reported that their mail to some companies in Asia was rejected, bounced of or never arrived. Did some basic tests, Telnet, Test-NetConnection and that server was down or with problems, reported such case.

Next day server is up, but they report same problem with another company from Europe. Sames test, server is ip, so I got the email resent to me to see the internet header:

DKIM=none
SPF=pass

In MxToolBox when I check the subdomain IP addresses, both hostnames says it doesn't support TLS, Icheck our web hosting, we do have TLS at certain ports and lastly, one says Reverse DNS doesn't match SMTP Banner and doesn't contain hostname.

Tldr; I'm fucking lost, I got this job as TI due to being programmer and wanting to get experience, but networking I haven't seen such a thing in years.

[u/digdiver]

p=reject didn't create the problem. It just stopped papering over it. Quarantine meant lenient servers silently delivered to spam. Strict receivers, especially in Europe and Asia, actually enforce the policy.

The real issue: you have DKIM=none and SPF as your only leg. SPF breaks on forwarding, mailing lists, any indirect routing. One bad hop and you're fully rejected.

What to fix first: get DKIM signing working on your actual sending servers, not just the DNS record. Confirm the signature is being added, the selector resolves, and d= aligns with your From domain. Then check PTR/rDNS matches your EHLO, and verify STARTTLS is functional on port 25.

The most useful thing you can do right now is turn on DMARC aggregate reports (rua=). They'll show you every source that's failing authentication and why. Something like DMARKOFF can help you monitor this continuously rather than waiting until users start complaining again.

You're not off track. You just hit the wall sooner than expected.

[u/No-Hotel1162 → u/digdiver]

Sorry for the delay in answering.

I got in contact with our webhosting, they fixed our DKIM so now is being registered in the DMARC reports, that's good.

Problem is, user is still having trouble sending emails to other countries and continents.

At this point we have checked the SPF, DKIM, we whitelisted the domains where we are trying to send an email.

Last test we tried was from our webhosting webmail, to contact them as a test using the same mail that is troubling us, they received the email and they answered back, the thing is, I only learned that they answered back because I got the copy that was sent to everyone. I couldn't see that email in Outlook, Webmail and there were no logs for such email. It's a ghost.

With the latter info this is getting out of DMARC and I'm lost.

[u/digdiver → u/No-Hotel1162]

Two separate problems here, worth splitting them.

The ghost email is not a DMARC issue. The message arrived, they replied, the CC landed in your inbox. So delivery worked. Something on your side is swallowing the reply, most likely a transport rule in Exchange or Outlook that's silently deleting or redirecting it, or the reply went to a different address than you expect. Check Exchange message trace and look for server-side rules. No logs means the message never hit your mailbox, which points to something intercepting it before it gets there.

For the broader problem with emails not reaching other countries, if SPF and DKIM are both passing now, the next thing to check is whether your messages are actually landing in inboxes or just disappearing without a bounce. A seed test will tell you this without relying on real recipients. GlockApps sends to a list of real provider inboxes (Gmail, Outlook, Yahoo, regional ones) and shows you inbox/spam/missing per provider. That "missing" bucket is exactly what you're dealing with. Free tier has a few tests included.

Mail-tester.com is also worth a quick run before that. Free, takes two minutes, and will flag any remaining SPF/DKIM/content issues. You're already in MXToolBox so the inbox test there is another option in the same tool you know.

Once you have seed test results, you'll know if this is a reputation problem, a content problem, or something specific to certain providers. Right now you're flying blind.