Password Reset Emails Failing DMARC

The password reset email messages for this forum are currently failing DMARC and being rejected according to the published policy:

Server:  dns.google
Address:  8.8.8.8

Non-authoritative answer:
_dmarc.pritunl.com      text =

        "v=DMARC1;p=reject;pct=100;ruf=mailto:contact@pritunl.com"

The report from M365:

Status: Office 365 received the message that you specified, but couldn't deliver it to the recipient due to the following error:

Error: 550 5.7.509 Access denied, sending domain pritunl.com does not pass DMARC verification and has a DMARC policy of reject

A non-delivery report (NDR) message was sent to noreply@pritunl.com. The NDR might provide more details about why the email message wasn't delivered and how to fix the issue.

More information: Ask the sender (noreply@pritunl.com) to follow the instructions in the NDR to fix this issue. The NDR might also include specific information for email admins. If the sender is unable to fix the issue, ask them to forward you the NDR and then follow the guidance for email admins.

Date (UTC-08:00) | Event | Detail |
------------------------------------
5/29/2024, 9:39 AM | Receive | Message received by: DS7PR01MB7640.prod.exchangelabs.com

5/29/2024, 9:39 AM | Defer | Reason: 400 4.7.721 Advanced Threat Protection scanning in progress.

5/29/2024, 9:42 AM | Fail | Reason: [{LED=550 5.7.509 Access denied, sending domain pritunl.com does not pass DMARC verification and has a DMARC policy of reject.};{MSG=};{FQDN=};{IP=};{LRT=}]

5/29/2024, 9:42 AM | Fail | Reason: [{LED=550 5.7.509 Access denied, sending domain pritunl.com does not pass DMARC verification and has a DMARC policy of reject.};{MSG=};{FQDN=};{IP=};{LRT=}]

More information
Message ID:<8cb277dd-219c-457c-9d96-79fc137d379f@forum.pritunl.com>
Message size | From IP | To IP
31.51 KB | 147.154.32.3 | null

I’m not aware of any issues with the DMARC or SPF configuration. That sending IP will pass SPF. The forum email uses the same Oracle Cloud email service as the Pritunl subscription accounts.

spfquery --ip=147.154.32.3 --identity=pritunl.com
pass
pritunl.com: Sender is authorized to use 'pritunl.com' in 'mfrom' identity (mechanism 'include:spf.oracleemaildelivery.com' matched)
pritunl.com: Sender is authorized to use 'pritunl.com' in 'mfrom' identity (mechanism 'include:spf.oracleemaildelivery.com' matched)
Received-SPF: pass (pritunl.com: Sender is authorized to use 'pritunl.com' in 'mfrom' identity (mechanism 'include:spf.oracleemaildelivery.com' matched)) receiver=secondary; identity=mailfrom; envelope-from=pritunl.com; client-ip=147.154.32.3