How can I best help customers with DMARC failures caused by Check Point Harmony Email & Collaboration?
Michael Ko
Co-founder & CEO, Suped
Published 15 Nov 2025
Updated 15 Nov 2025
6 min read
Dealing with DMARC failures can be a significant challenge, especially when a security gateway like Check Point Harmony Email & Collaboration (formerly Avanan) is involved. Many clients report widespread issues, with DMARC failing for a substantial portion of emails, often leading to them being quarantined or rejected. This creates a dilemma, as the immediate workaround, such as adding the Avanan IP to the SPF record, doesn't feel like a sustainable or correct solution.
The core problem lies in how these 'middleware' filtering services process emails. They often modify messages, which inadvertently breaks the cryptographic signatures established by DKIM and can cause SPF alignment issues. Even when email is successfully delivered to the inbox, DMARC aggregate reports (RUA) from recipients like Microsoft will still show these messages as failing DMARC authentication. This 'noise' in the reports makes it difficult to distinguish legitimate DMARC failures from those caused by your own security infrastructure.
This article explores the complexities of DMARC failures with Check Point Harmony Email & Collaboration, offering practical strategies to help your customers ensure deliverability while maintaining strong email security. We will delve into the technical reasons behind these failures and outline steps to interpret DMARC reports accurately, without compromising security or resorting to insecure workarounds.
Understanding the root cause of DMARC failures with Harmony Email & Collaboration
The primary reason for DMARC failures when using Check Point Harmony Email & Collaboration (formerly Avanan) stems from its operational model as a secure email gateway (SEG). Unlike traditional SEGs that sit in front of the MX records, Avanan often integrates directly into the email environment, such as with Microsoft 365 using connectors. While this provides advanced threat protection, it also places Avanan in a position to modify email messages after they've been sent by the original server but before they reach the recipient's mailbox.
Any modification to an email's headers or body after it has been signed by DKIM will invalidate that signature. Since DKIM relies on a cryptographic hash of the email's content, even minor changes, like adding disclaimers, tracking pixels, or reformatting, will cause DKIM authentication to fail. While SPF might initially pass, the email relay through Avanan can sometimes also break the SPF alignment depending on how the mail flow is configured, leading to DMARC failure.
Check Point acknowledges these challenges and offers DMARC management features to help administrators understand the reasons for failures. Their documentation details how Harmony Email & Collaboration simplifies troubleshooting by displaying clear, concise summaries of failure reasons for each sending source. You can find more information on their DMARC management capabilities for actionable recommendations.
The impact on DMARC reporting and enforcement
The most confusing aspect of DMARC failures caused by security gateways is that the emails might still be delivered successfully to the recipient's inbox. This happens because the recipient's email system, like Microsoft 365, might have internal rules or connectors that prioritize delivery based on trusted internal routes, even if external DMARC checks fail at the last hop.
However, the DMARC aggregate reports (RUA records) will reflect these authentication failures, creating significant noise for administrators. This makes it challenging to identify actual malicious emails failing DMARC versus legitimate emails that are merely being modified by the security solution. If your DMARC policy is set to p=reject, this could lead to legitimate emails being unnecessarily blocked, impacting critical communications.
Interpreting these DMARC reports accurately is crucial. You need a way to filter out the expected failures caused by your security gateway from actual threats. Tools that provide AI-powered recommendations can help in this regard. Understanding why some emails are failing DMARC checks even with correct SPF and DKIM is a common troubleshooting step.
Strategies to mitigate DMARC issues
One common, but not ideal, workaround mentioned is adding the Avanan IP to the SPF record. While this might address SPF failures for emails relayed through Avanan, it doesn't solve the DKIM breakage. Furthermore, directly adding IPs to SPF records can quickly lead to the SPF 10-lookup limit, causing other legitimate senders to fail SPF. A better approach involves proper configuration within your email environment.
The recommended approach from Check Point and other experts is to configure the connector between Harmony Email & Collaboration and your mail server (e.g., Microsoft 365) to bypass additional spam filtering for emails that have already passed through Avanan. This ensures that once Avanan has processed an email, it's trusted by your mail server and delivered without further authentication checks that Avanan's modifications might break.
The SPF IP whitelist workaround for Check Point Harmony Email & Collaboration.
Adds Avanan IP addresses to the SPF record.
Risks exceeding the 10-DNS lookup limit for SPF, causing other legitimate emails to fail.
Does not resolve DKIM authentication failures caused by message modification.
Not a long-term, scalable, or secure solution for DMARC compliance.
Ideal configuration within your email environment.
Configure connectors to bypass spam filtering for emails from Avanan.
Ensures reliable internal delivery even if DMARC reports show external failures.
Preserves DKIM authentication where possible, or mitigates impact.
Another crucial strategy is to advocate for security vendors to re-sign messages after they have been modified. This process involves the security gateway generating a new DKIM signature for the altered email, which would allow the email to pass DMARC checks downstream. While this is a more complex technical implementation, it represents the ideal solution for eliminating DMARC failures caused by legitimate security modifications.
The role of advanced DMARC monitoring
Given the complexities of DMARC failures with security gateways, a specialized DMARC monitoring solution becomes indispensable. It allows you to gain clarity amidst the 'RUA noise' and identify true threats versus expected authentication breaks from your own infrastructure. Effective DMARC monitoring can help troubleshoot and fix common DMARC issues in various environments.
Suped offers comprehensive DMARC monitoring with a generous free plan, making it an excellent choice for managing these complex scenarios. Our platform is designed to provide clear, actionable recommendations based on your DMARC reports, helping you understand the real state of your email authentication.
Suped provides powerful features to navigate DMARC challenges:
AI-Powered Recommendations: Get precise, actionable advice to resolve DMARC issues and optimize your policy.
Real-Time Alerts: Be instantly notified of any DMARC authentication failures or potential threats.
Unified Platform: Monitor DMARC, SPF, and DKIM alongside blocklist and deliverability insights in one place.
SPF Flattening: Avoid the 10-lookup limit with our automated SPF flattening feature.
Suped provides clarity and control, helping you strengthen your email security and ensure optimal deliverability, even with complex setups like Check Point Harmony Email & Collaboration. Start with Suped today for robust DMARC monitoring.
Views from the trenches
Best practices
Ensure connectors between the security gateway and your mail server bypass additional spam filtering, preventing authentication breaks for already-scanned emails.
Regularly review DMARC reports to differentiate between legitimate DMARC failures caused by external threats and false positives due to internal security tools like Avanan.
Advocate for email security vendors to implement re-signing capabilities for DKIM after modifying email content, which would preserve DMARC alignment.
Common pitfalls
Adding security gateway IP addresses directly to SPF records, which can lead to exceeding the 10-DNS lookup limit and cause broader SPF failures.
Interpreting all DMARC failures in RUA reports as critical threats, overlooking the expected authentication breaks caused by internal email filtering modifications.
Setting a DMARC policy to 'p=reject' without fully understanding the impact of internal security gateway modifications, potentially blocking legitimate emails.
Expert tips
Monitor DMARC reports closely. Look for trends and patterns. Use a good DMARC monitoring tool to simplify this process.
Engage directly with your security gateway provider's support or product teams to understand their recommended best practices for DMARC integration and to lobby for improved authentication handling.
Utilize DMARC policies like 'p=quarantine' initially to observe the impact of your security gateway without immediately rejecting legitimate emails, gradually moving to 'p=reject' once confidence is established.
Expert view
Expert from Email Geeks says: This is normal for the 'middleware' filtering companies, as they modify messages and pass them through the connection, inevitably breaking authentication.
2025-10-03 - Email Geeks
Marketer view
Marketer from Email Geeks says: The problem is that the RUA report is generated by Microsoft, and it includes the results of DMARC, SPF, and DKIM checks done at the very last hop, so even if the email landed in the inbox, Microsoft will still report DMARC as failing.
2025-10-03 - Email Geeks
Ensuring DMARC compliance with security gateways
Helping customers navigate DMARC failures caused by Check Point Harmony Email & Collaboration requires a clear understanding of how these middleware services interact with email authentication protocols. While some DMARC failures may appear to be false positives due to message modification, they still represent a lack of DMARC alignment that needs to be managed strategically.
By focusing on proper connector configuration, advocating for re-signing capabilities from security vendors, and leveraging advanced DMARC monitoring tools like Suped, customers can ensure their emails are delivered securely and reliably. This approach helps maintain DMARC compliance and protect against real email threats, without being misled by authentication failures inherent to their security infrastructure.
Microsoft will still show these messages as failing DMARC authentication. This 'noise' in the reports makes it difficult to distinguish legitimate DMARC failures from those caused by your own security infrastructure.
