Inbound emails from Gmail are marked as Junk/Spam/Received-Ignored - Support and Troubleshooting

Inbound emails from Gmail are marked as Junk/Spam/Received-Ignored Issue .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } You may have a configuration in your email system to forward emails sent to @ to @service-now.com so that your instance will process these emails.

Legitimate emails from your users are received with the following header:

X-ServiceNow-Spam-Flag:YES

This causes such emails to be set to type = received-ignored and the emails will be marked as mailbox = junk. Such emails will not be processed by the instance.

The issue is generally due to either Microsoft doing changes in their SRS, or Gmail changing their DKIM definition, so that recipient mail servers like ServiceNow are asked to mark non-DKIM compliant mails as spam.

Release .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Not applicable

Cause .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } This is due to a configuration issue in the email forwarding setup. ServiceNow email servers check if the server that handed the email is allowed to send on behalf of the domain in the From address.

Here are the headers for a sample email.

Return-Path: Received:from mda01.ytz0.service-now.com by mda01.ytz0.service-now.com (Dovecot) with LMTP id cOn7LuwjQWD0MQEA1M+ElA for ; Thu, 04 Mar 2021 10:16:53 -0800 Received:from mx01.service-now.com (unknown [10.248.6.218]) by mda01.ytz0.service-now.com (Postfix) with ESMTPS id 9245B54A66A for ; Thu, 4 Mar 2021 10:16:53 -0800 (PST) Received:from localhost (localhost [127.0.0.1]) by mx01.service-now.com (Postfix) with ESMTP id 0069460034E8 for ; Thu, 4 Mar 2021 10:16:53 -0800 (PST) X-ServiceNow-Spam-Flag:YES X-ServiceNow-Spam-Score:8.019 X-ServiceNow-Spam-Level:******** X-ServiceNow-Spam-Status:Yes, score=8.019 tagged_above=-999 required=6.2 tests=[DKIM_ADSP_CUSTOM_MED=0.001, DKIM_INVALID=0.1, DKIM_SIGNED=0.1, FORGED_SPF_HELO=1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, KHOP_HELO_FCRDNS=0.4, NML_ADSP_CUSTOM_MED=1.2, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_PASS=-0.001, SPF_SOFTFAIL=3.5, SPOOFED_FREEMAIL=1.718] autolearn=no autolearn_force=no Authentication-Results:mta23.iad100.service-now.com (amavisd-new); dkim=fail (2048-bit key) reason="fail (message has been altered)" header.d=gmail.com Received:from mx01.service-now.com ([10.242.65.97]) by localhost (mta23.iad100.service-now.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RfAKx2Pnd5NW for ; Thu, 4 Mar 2021 10:16:52 -0800 (PST) Received:from NAM10-DM6-obe.outbound.protection.outlook.com (mail-dm6nam10on2087.outbound.protection.outlook.com [40.107.93.87]) by mx01.service-now.com (Postfix) with ESMTPS id 80DAE60034E7 for ; Thu, 4 Mar 2021 10:16:52 -0800 (PST) Received:from DM5PR12CA0007.namprd12.prod.outlook.com (2603:10b6:4:1::17) by SJ0PR17MB4335.namprd17.prod.outlook.com (2603:10b6:a03:2a2::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3912.19; Thu, 4 Mar 2021 18:16:49 +0000 Received:from DM6NAM10FT007.eop-nam10.prod.protection.outlook.com (2603:10b6:4:1:cafe::fa) by DM5PR12CA0007.outlook.office365.com (2603:10b6:4:1::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3912.17 via Frontend Transport; Thu, 4 Mar 2021 18:16:49 +0000 Authentication-Results:spf=softfail (sender IP is 148.163.145.220) smtp.mailfrom=gmail.com; company.com; dkim=fail (signature did not verify) header.d=gmail.com;company.com; dmarc=fail action=none header.from=gmail.com; Received-SPF:SoftFail (protection.outlook.com: domain of transitioning gmail.com discourages use of 148.163.145.220 as permitted sender) Received:from mx0a-00003402.pphosted.com (148.163.145.220) by DM6NAM10FT007.mail.protection.outlook.com (10.13.153.118) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3890.19 via Frontend Transport; Thu, 4 Mar 2021 18:16:49 +0000 Received:from pps.filterd (m0159661.ppops.net [127.0.0.1]) by mx0a-00003402.pphosted.com (8.16.0.43/8.16.0.43) with SMTP id 124IFea3019028 for ; Thu, 4 Mar 2021 18:16:48 GMT Authentication-Results-Original:ppops.net; spf=pass smtp.mailfrom=user@gmail.com; dkim=pass header.d=gmail.com header.s=20161025; dmarc=pass header.from=gmail.com Received:from mail-io1-f42.google.com (mail-io1-f42.google.com [209.85.166.42]) by mx0a-00003402.pphosted.com with ESMTP id 3731ts8vuv-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NOT) for ; Thu, 04 Mar 2021 18:16:48 +0000 Received:by mail-io1-f42.google.com with SMTP id o9so15862837iow.6 for ; Thu, 04 Mar 2021 10:16:48 -0800 (PST) Thu, 04 Mar 2021 10:16:47 -0800 (PST) From:User Date:Thu, 4 Mar 2021 12:16:36 -0600 Message-ID: To: Subject: Test

According to these headers, NAM10-DM6-obe.outbound.protection.outlook.com (mail-dm6nam10on2087.outbound.protection.outlook.com [40.107.93.87]) delivered this message to ServiceNow at mx01.service-now.com.

However, NAM10-DM6-obe.outbound.protection.outlook.com is not authorised to send on behalf of Gmail (the server in the example belongs to Microsoft O365 mail infrastructure).

Resolution .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } This is a configuration issue in the email forwarding setup.

You need to check with your email administrators to fix this setup so that the headers are updated in each forwarded email in a way that correctly shows that your servers are forwarding the email on behalf of user@gmail.com instead of sending on behalf of user@gmail.com. Please check the following documentation if you are using a Microsoft email server: https://docs.microsoft.com/en-us/office365/troubleshoot/antispam/sender-rewriting-scheme If you are unable to correct your forwarding setup, you may check KB0549426 on how to install and configure your email filters in your instance in a way that makes an exception for emails with X-ServiceNow-Spam-Flag:YES that are forwarded by your email servers. Please note that this is only a workaround and may cause other spam email to be processed by your instance if not configured correctly.

You may add @ to your instance as an additional POP3/IMAP mailbox so that the instance can read emails from that mailbox. This allows you to cancel the email forwarding configuration. Email headers analyzers:

https://mxtoolbox.com/EmailHeaders.aspx

https://mha.azurewebsites.net/

https://toolbox.googleapps.com/apps/messageheader/