Most common causes
- Forwarding changed the delivery IP so SPF no longer represents the original sender
- A gateway modified signed content and invalidated DKIM
- The intermediary path does not preserve enough authentication context
- A non-Microsoft gateway changed the message or routing identity
What to verify next
- Analyze the forwarded message with ARC Forwarding Analyzer
- Compare authentication before and after the intermediary hop
- Inspect whether DKIM broke because message content was modified
- Review the forwarding or gateway design instead of changing the original sender blindly
Best diagnostic path
Live analysis
Mail Failure Doctor
Classify the complete rejection and preserve provider-specific diagnostic context.
Open analysis → Live analysisARC Forwarding Analyzer
Reconstruct authentication continuity across forwarding and intermediary gateways.
Open analysis → Live analysisEmail Infrastructure Digital Twin
Map the domain’s public mail infrastructure and provider relationships before remediation.
Open analysis →Why the exact message matters
The same status family can be triggered by different conditions, and providers frequently add diagnostic text that narrows the issue. Use the complete rejection text rather than treating the numeric code as a complete diagnosis.
Provider reference
For the provider-defined meaning and current requirements, review Microsoft Exchange Online NDR reference.