Need help in figuring out if there is anything wrong with the DNS settings for mail delivery

emailexchange-2016microsoft-office-365

Having issues with email delivery into outlook.com and hotmail. emails are going into junk mail.

Email flow is "Application > Exchange 2016 > Firewall > Office 365 > Mimecast"

MX records points to Mimecast and goes from there to Office 365.

We do not have our own SPF record, DKIM or DMARC set up for upp-ltd.com and I am not sure if Msft has anything set up for uppgroup.onmicrosoft.com.

besides for SPF, DKIM and DMARC does everything looks ok on the email headers below??

Received: from BY2NAM01HT037.eop-nam01.prod.protection.outlook.com
 (2603:10a6:600:8a::34) by LNXP123MB2217.GBRP123.PROD.OUTLOOK.COM with HTTPS
 via LO2P265CA0262.GBRP265.PROD.OUTLOOK.COM; Wed, 14 Aug 2019 14:11:45 +0000
ARC-Seal: i=2; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=fail;
 b=iGqdpGh8dZ1PolKaSc7GLSNQplFD5cfaiXeJje42bc4KrStG0/xG4UxKF2vzKFB5G33wbHWrQvrLRTxS59mIB0GLIya9mup5e3K53TtqhFAc3fVp9rKJ78bW9D3ij73OwNLumFQwDVQ5+FoHfZ+KMS+4D/QD61cpeOdytVznk5+btciClTDIFoldl0Ts8/un1A/VRP7TA4E96gU5/gwRFEpSgUl/y2xe6yOacbLrTfJ/TljPQUDtiPC8VKgU7TGCqjjtsXQlyT25vp9XysFMN9iuJk0PT74Dsoj1ntBgdLQcgk4HkQQv3h3c847z+u6VR1rKy57hgUoBHZgYmFQvZg==
ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
 s=arcselector9901;
 h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
 bh=hjdRKAv3JPPxdyjOqp/ls+4OhOfFLeNhY2vYne4sP6U=;
 b=NSkzWEcG5PnPFqnZJKgxeyN18naWRr8wVJxPtB3pf+0gNh8BIgXUgOscvufeD3Nq45SDmMr4phoX8uTYWTTEDsCHIeGBBkJG8E7Ay6Vf+nuaWyQ79stAlD3HTshiWjpHDNscd5TKAUbltGvKqST1bSajua2PQ8B/oyaA3hGZzwCC7+GUH3hpjUz+fwjRZ5N+DOW6jk3AXUcno12lRSMwi9unlFamIJ65hEjZXH0xsy9CtOcoyHzEU6dAwyGGGSeHhQKB5bE27xl4nHkYrr0LLL07SPju+mNctjwpaRIyUlf4mz7IODggloBX7zk4NStPaHuP3EQsii/Kwg0trFrH4g==
ARC-Authentication-Results: i=2; mx.microsoft.com 1; spf=pass (sender ip is
 146.101.78.161) smtp.rcpttodomain=outlook.com smtp.mailfrom=upp-ltd.com;
 dmarc=bestguesspass action=none header.from=upp-ltd.com; dkim=fail (signature
 did not verify) header.d=uppgroup.onmicrosoft.com; arc=fail (48)
Received: from BY2NAM01FT047.eop-nam01.prod.protection.outlook.com
 (10.152.68.54) by BY2NAM01HT037.eop-nam01.prod.protection.outlook.com
 (10.152.69.61) with Microsoft SMTP Server (version=TLS1_2,
 cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.2157.15; Wed, 14 Aug
 2019 14:11:44 +0000
Authentication-Results: spf=pass (sender IP is 146.101.78.161)
 smtp.mailfrom=upp-ltd.com; outlook.com; dkim=fail (signature did not verify)
 header.d=uppgroup.onmicrosoft.com;outlook.com; dmarc=bestguesspass
 action=none header.from=upp-ltd.com;
Received-SPF: Pass (protection.outlook.com: domain of upp-ltd.com designates
 146.101.78.161 as permitted sender) receiver=protection.outlook.com;
 client-ip=146.101.78.161; helo=eu-smtp-delivery-161.mimecast.com;
Received: from eu-smtp-delivery-161.mimecast.com (146.101.78.161) by
 BY2NAM01FT047.mail.protection.outlook.com (10.152.68.243) with Microsoft SMTP
 Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id
 15.20.2178.16 via Frontend Transport; Wed, 14 Aug 2019 14:11:43 +0000
X-IncomingTopHeaderMarker:
 OriginalChecksum:ED2B93F1534F4D404DE43B0CE17F126879A62BAE875517B8EBFF2FDBB80BE594;UpperCasedChecksum:027F228F42324C7D6FC2C3D5A2A5A5C3E2D968B77459DFC8E3285B786E3F001E;SizeAsReceived:5993;Count:39
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;
 b=mOc6qu7csDpxsV0YJ98ohhcx24XWg7PxVUPf/dDkNjE31p5SPUMOLM1hkg9jX48zBy/JnLgGF8/R1QhF+6296ApDePTVkgDaSCnRK34IELjDLIcbfzlzuzk4qS/qXsObjNzCYkuiw2ghY/mFF/UnkTPdV5cejBHAsFlHohJKUWOEt/uC+0r9eBuzqg69Z9vWr7Y2U2WgBzQK7qHWbDGdqghHqkg9NP8i6gpryAXUqH0vFEsZ1zRUB5KhBdITbjGWSuhBrJcTtCfdQt7SeES13r3lS1U0nuboY8Q17thme1PQ2kqqC9CgreKfDWDHoCn6ySDbUW9BRr3IKlUrpAiVmQ==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
 s=arcselector9901;
 h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
 bh=hjdRKAv3JPPxdyjOqp/ls+4OhOfFLeNhY2vYne4sP6U=;
 b=KIaHZKQ+gOT89QlIxDCKLs9f2XdA99smKbPu07bsNyj4t20rkG8BVOAUOgulHkgLevIG90+b7xniMtIpbirl0QdBkr9iyCVOrsSBMUp6Rs+VbQetGy5awVqoNctgrPUeWuxIyBu0KLqmk9z1GqZz8aO8JKl0Nux1KR2gLPzvcbTIYYPD7favjaZXBkXEEcWrxhZVFke46dsgRgcSkzQ88z+d4OWe7PotYdyZHc5pYsKHy2G36Jq/QT/NguxJumlx0rBMATIljL1x4umdSLHKHBllG6huo8CraZbB5QTFHGZ2CDnfmvuyFR5GpPb66gyu+eKl9VrgtD0mreAnHCtMPw==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is
 5.148.79.5) smtp.rcpttodomain=outlook.com smtp.mailfrom=upp-ltd.com;
 dmarc=bestguesspass action=none header.from=upp-ltd.com; dkim=none (message
 not signed); arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=uppgroup.onmicrosoft.com; s=selector2-uppgroup-onmicrosoft-com;
 h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
 bh=hjdRKAv3JPPxdyjOqp/ls+4OhOfFLeNhY2vYne4sP6U=;
 b=UxuaZ27XmxXEM2vHiEP9PBCuzmPjQlThNDzFKQkp4A7U+4V8g0nP0Ka4Z/FSa12K+fo6thELvkzNZlr6/gEK+Gnd9qBYVN+X6lilUIH/5dzKZ/OXkT/UPSzpSU+GIf0AQ6oqUWVAioIw7qGuWLXu93jHVTUdXjDe+6cw8h0NiKA=
Received: from EUR04-DB3-obe.outbound.protection.outlook.com
 (mail-db3eur04lp2050.outbound.protection.outlook.com [104.47.12.50]) (Using
 TLS) by relay.mimecast.com with ESMTP id
 uk-mta-71-CV2Xd2PUM32uxn-g3cNB5A-1; Wed, 14 Aug 2019 15:11:40 +0100
Received: from HE1PR0902CA0033.eurprd09.prod.outlook.com (2603:10a6:7:15::22)
 by VI1PR09MB4256.eurprd09.prod.outlook.com (2603:10a6:803:13a::12) with
 Microsoft SMTP Server (version=TLS1_2,
 cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2157.14; Wed, 14 Aug
 2019 14:11:39 +0000
Received: from AM5EUR03FT053.eop-EUR03.prod.protection.outlook.com
 (2a01:111:f400:7e08::205) by HE1PR0902CA0033.outlook.office365.com
 (2603:10a6:7:15::22) with Microsoft SMTP Server (version=TLS1_2,
 cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2157.18 via Frontend
 Transport; Wed, 14 Aug 2019 14:11:38 +0000
Received: from mail.upp-ltd.com (5.148.79.5) by
 AM5EUR03FT053.mail.protection.outlook.com (10.152.16.210) with Microsoft SMTP
 Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id
 15.20.2115.18 via Frontend Transport; Wed, 14 Aug 2019 14:11:38 +0000
Received: from UPPSRVEX4.upp-ltd.local (10.90.2.59) by UPPSRVEX4.upp-ltd.local
 (10.90.2.59) with Microsoft SMTP Server (version=TLS1_2,
 cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.1.1531.3; Wed, 14 Aug
 2019 15:11:32 +0100
Received: from UPPSRVADMIN (10.90.2.65) by UPPSRVEX4.upp-ltd.local
 (10.90.2.59) with Microsoft SMTP Server id 15.1.1531.3 via Frontend
 Transport; Wed, 14 Aug 2019 15:11:32 +0100
From: Joe Blogs <Joe.Blogs@upp-ltd.com>
To: Jane Doe <janedoe@outlook.com>
Date: Wed, 14 Aug 2019 15:11:32 +0100
Subject: This is a sample mail
Message-ID: <e9d02a65-89fe-488f-a752-3e13e5eebce2@UPPSRVEX4.upp-ltd.local>
Return-Path: Joe.Blogs@upp-ltd.com
X-EOPAttributedMessage: 1
X-Forefront-Antispam-Report-Untrusted:
 CIP:5.148.79.5;IPV:NLI;CTRY:GB;EFV:NLI;SFV:NSPM;SFS:(10019020)(346002)(136003)(376002)(39850400004)(396003)(2980300002)(199004)(40134004)(189003)(31696002)(5660300002)(70206006)(66574012)(14444005)(9686003)(5024004)(106002)(70586007)(8676002)(47776003)(126002)(23726003)(486006)(2906002)(44832011)(476003)(31686004)(478600001)(46406003)(7596002)(86362001)(305945005)(26005)(246002)(316002)(336012)(8746002)(6916009)(356004)(8936002)(7636002)(186003)(50466002)(97756001)(212503006);DIR:OUT;SFP:1102;SCL:1;SRVR:VI1PR09MB4256;H:mail.upp-ltd.com;FPR:;SPF:Pass;LANG:en;PTR:mail.upp-ltd.com;A:1;MX:1;
X-MS-PublicTrafficType: Email
X-MS-Office365-Filtering-Correlation-Id: 820361c8-f467-4627-a082-08d720c155d9
X-Microsoft-Antispam-Untrusted:
 BCL:0;PCL:0;RULEID:(2390118)(7020095)(4652040)(8989299)(5600148)(711020)(4605104)(4709080)(1401327)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(2017052603328);SRVR:VI1PR09MB4256;
X-MS-TrafficTypeDiagnostic: VI1PR09MB4256:|BY2NAM01HT037:
X-Microsoft-Antispam-PRVS:
 <VI1PR09MB42564EA5364694A3882F9341CDAD0@VI1PR09MB4256.eurprd09.prod.outlook.com>
X-MS-Oob-TLC-OOBClassifiers: OLM:10000;
X-Forefront-PRVS: 01294F875B
X-MS-Exchange-SenderADCheck: 1
X-Microsoft-Antispam-Message-Info-Original:
 zu5x4sRB0arC3TIrYjETVmA1xX1pScVvvUohKO5MsvTYhyjx5U6QFkUwvEZXdR31CtmKPh6UWQhuqpKmpt/79a8Ignuo1fBJGuU18AOlzG7NSgD+kPhDWHZTxegdwnmAxbWiEMq1Q+4ASkp6vWoGV4Eok1WeQ0iVC1imzHv7NZSs95GoWuY2K+Plh23EtQ+gRME0tYbDggYNFFnZmPAIJKRR8O0nwRZg5Q/3KGjh6pnx4CepC8iLzyanKxnLr444h6AqmbgyvinfHYQZ71bn2EDxesRiic/sdPVCRYQcG4RphbOm0C0ZYMuXCU9z82r9Ob8yHgExurV5vaf8UmZOqi7QgPCIYyj4Lobm4N0cBYQW3gTI4zcnPNKOguGsbaaOsOVwJ8RW+eqp87LwwY6UJ4tVnX9M7CMge1QCWBAPR4o=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1PR09MB4256
X-MC-Unique: CV2Xd2PUM32uxn-g3cNB5A-1
X-Mimecast-Spam-Score: 0
Content-Type: text/plain; charset=WINDOWS-1252
Content-Transfer-Encoding: quoted-printable
X-IncomingHeaderCount: 39
X-MS-Exchange-Organization-ExpirationStartTime: 14 Aug 2019 14:11:43.7317
 (UTC)
X-MS-Exchange-Organization-ExpirationStartTimeReason: OriginalSubmit
X-MS-Exchange-Organization-ExpirationInterval: 1:00:00:00.0000000
X-MS-Exchange-Organization-ExpirationIntervalReason: OriginalSubmit
X-MS-Exchange-Organization-Network-Message-Id:
 820361c8-f467-4627-a082-08d720c155d9
X-EOPTenantAttributedMessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0
X-MS-Exchange-Organization-MessageDirectionality: Incoming
X-MS-Exchange-Transport-CrossTenantHeadersStripped:
 BY2NAM01FT047.eop-nam01.prod.protection.outlook.com
X-Forefront-Antispam-Report: EFV:NLI;
X-MS-Exchange-Organization-AuthSource:
 BY2NAM01FT047.eop-nam01.prod.protection.outlook.com
X-MS-Exchange-Organization-AuthAs: Anonymous
X-MS-UserLastLogonTime: 8/14/2019 2:11:36 PM
X-MS-Office365-Filtering-Correlation-Id-Prvs:
 17915081-b157-41f0-b5d7-08d720c152f1
X-Microsoft-Antispam:
 BCL:0;PCL:0;RULEID:(2390118)(5000188)(710020)(711020)(4605104)(610169)(650170)(1124261)(8291501072);SRVR:BY2NAM01HT037;
X-MS-Exchange-EOPDirect: true
X-Sender-IP: 146.101.78.161
X-SID-PRA: JOE.BLOGS@UPP-LTD.COM
X-SID-Result: PASS
X-MS-Exchange-Organization-PCL: 2
X-MS-Exchange-AtpMessageProperties: SA|SL
X-MS-Exchange-ATPSafeLinks-Stat: 0
X-OriginatorOrg: outlook.com
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 14 Aug 2019 14:11:43.2513
 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 820361c8-f467-4627-a082-08d720c155d9
X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa
X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg:
 00000000-0000-0000-0000-000000000000
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY2NAM01HT037
X-MS-Exchange-Transport-EndToEndLatency: 00:00:01.9405696
X-MS-Exchange-Processed-By-BccFoldering: 15.20.2157.000
X-Microsoft-Antispam-Mailbox-Delivery:
    abwl:0;wl:0;pcwl:0;kl:0;iwl:0;ijl:0;dwl:0;dkl:0;rwl:0;ucf:0;jmr:0;ex:1;auth:1;dest:J;OFR:ExclusiveSettings;ENG:(5062000261)(5061607266)(5061608174)(4900115)(4920090)(6515079)(4950130)(4990090)(9190016);RF:JunkEmail;
X-Message-Info:
    qoGN4b5S4yrfUGew4atb642biW7lq1euRV2F1Jm2Nf1IMtpXXZRh/uqF0jI6rdHDGGErJKU6AhymbPO1WiG5DBzj6+RoCsLnA1cgjMGdVGjFT2jiqMA2/BXhzlzUysgBjqHGl3zyZRb6MGJToFClDREzFMFdB2c5TtSGh9vuT1l5OPCjSwDyJ26j1o9xReO8ErUY6v//W7odgr4hklq72g==
X-Message-Delivery: Vj0xLjE7dXM9MDtsPTE7YT0xO0Q9MjtHRD0xO1NDTD02
X-Microsoft-Antispam-Message-Info:
    m1M/l0ZTwz2t1OqHPIlV0JDrcl6op/H566d98MVo1VTj7sk9i25yDgIlIUaZyUUp8+DbBpVoVhhW/2CfGCXLSR5oZKXeRZ9X3SozarYruhVPHzsZHvTWFMSxAstovjmo0cdJ/qIc/HzeqmaRaS6UQuAIMnYO8SzUrITo5w7QpzSh9sD4MtiKZDR7IzkWjFqNJqWhjTJPoqPC7LsML5dkVVBytj5qxuVW/PQ8f7uPvhKd+y6wdDxoE+mYzn2sQrCaO3ZCRWkAZNV5+y12Tyu/OW+3yRpbpjdR1iBTvHBQjiMYGaFeBiOr+3eXegwv3V8dxGdF0SbCsJIHf8yKvTETwQJDdP9SzIhTWqfgEamqWCsDK7xThuarJKe+27yMfaiy2UlVjmCM4oNzBLNiAaqHv5QZAixaq53WiEs3aGU+9/u8D5kknGBypppaGQ7c5dMfBpph6AhojG9XiwlhrJKRd+n3xVqUFJLFYDX7zULWXsfABW4nLqXioZuDr00diNh8u4qKk/Z0z/iQ95tz1kNVJ+NW+MYWsIxF3Mbm3vGK8dWQYe7admPjcRXZeafYUoUV0zsSIQ8VNHS4iBaSND11IvZow1shDA+z58o14M3SBWe5pyjnItlokHwocE/al33cj8o7BASH/i5H3urRsqr4vda6A93JgBzShcy/g9tgOHEndDoS5obWs4g+7mPwrgSIUrfLgCpOvJXkghCeWZ/QGMpnyZhpsGRZcULRDKOz3g1lLrrQuRX8VtZNSOkZQH99J1P1eeL6a8HTR8MDVXJd1C8RSoQArDNm7GlKeEHzofw3VJeoWiP8C2QoCBO2moBfT+wIiejpSrasyAf0NBEIMLMteoHt+lvAAH2UvbGBmL02AmWax9nprA5ZOxFwOViyNsdFbBLtRdfXfXIkEjZilA==
MIME-Version: 1.0

Best Answer

Here's a useful tool for you to check your DNS settings. https://mxtoolbox.com/NetworkTools.aspx

It can also be used to check if there is any SPF/DKIM/DMARC set up for the domain. Maybe you should confirm with your ISP, check the reputation of your IP address at related places, verify that you've published accurate SPF data in your external DNS, that your IP address has a valid PTR record in DNS, and so on.

Similar issue for your reference, Emails are being delivered to Junk Folder of Gmail/Hotmail/Yahoo Mail