Skip to main content

Find and fix missing or quarantined Omni emails

If an email from Omni is missing or in a Junk folder, a service between Omni and the recipient might have changed the email and caused it to fail DMARC. Use this guide to find the email, fix the cause, and confirm that new email arrives.

Requirements

You can look for a missing email in your own mailbox and quarantine. To apply a fix, you need admin access to your mail provider. If you don’t have this access, share this guide with your email admin.

Check whether this affects you

DMARC is an email standard that tells mail providers what to do with email that fails authentication. Starting November 9, 2026, the DMARC policy for omni.co is p=quarantine, so mail providers can junk or quarantine email that fails. This helps stop third parties from sending email that pretends to be from Omni. Omni signs each email it sends. If a service changes the email on the way to the recipient, the signature no longer matches and the email can fail. If emails stopped arriving before November 9, 2026, this policy isn’t the cause. Contact support.

Steps

1

Find the email

If the email is a delivery, ask an Omni Organization Admin to check it in Settings > Deliveries. If it shows as Failed, follow Troubleshooting failed deliveries instead.A delivery doesn’t show as Failed when a mail provider junks or quarantines the email, so you should also check the following:
2

Find what changed the email

If you aren’t an email admin, send this guide to your admin. The remaining steps are for them.
Open the full headers of the email:
  • Outlook: Follow Microsoft’s instructions.
  • Gmail: Open the email and click More > Show original.
  • Microsoft 365 quarantine: Select the email and click More options > View message headers.
Then check these two values:
  1. In the most recent Authentication-Results header, look for dmarc=fail. If you see dmarc=pass, DMARC didn’t cause the problem. Contact Omni support.
  2. In each ARC-Seal header, note the d= value, for example d=checkpointcloudsec.com. You need the domain of the service that changed the email, not the domain of your own mail provider. If no header shows that domain, the service doesn’t add ARC seals.
3

Fix the cause

Use the fix that matches your setup.

If a forward or list changes the email

  • Add the recipients directly. Add the final recipients to the delivery. Email that comes directly from Omni passes DMARC.
  • Stop the change. If a list or service edits the message, for example to add a disclaimer, turn off the edit.
  • Send from your own domain. If your own system resends the email, send it from an address at your own domain.

If a service changes email before it gets to Microsoft 365

Add the service as a trusted ARC sealer. Microsoft prefers this fix. ARC lets a service record the authentication result from before it changed the email, and Microsoft 365 uses that earlier result if it trusts the service. See the Microsoft documentation for a list of roles that can do this.
  1. Open the Email authentication settings in the Microsoft Defender portal and select the ARC tab.
  2. Click Add, or Edit if the list already has entries.
  3. Enter the d= domain from step 2 and click Save. The change can take up to 30 minutes to apply.
If you use Check Point Harmony Email, Check Point’s guide names the domain checkpointcloudsec.com. Add this domain if it isn’t on the list.If the service is on the list and email still fails, see Microsoft’s ARC troubleshooting.If the service doesn’t add ARC seals, ask the vendor to turn them on. If the vendor can’t, create an allow entry for a spoofed sender that pairs omni.co with the service.

If a gateway is in front of Gmail

Set up the gateway as an inbound gateway. Gmail doesn’t enforce the sender’s DMARC policy on email from an inbound gateway.

If you need a short-term fix in Microsoft 365

Add these addresses to Safe Senders on the affected user mailboxes:
  • scheduled-delivery@omni.co
  • no-reply@omni.co
  • support@omni.co
Add the full addresses, because Microsoft 365 ignores domain entries when its policy quarantines the email. Microsoft doesn’t sync Safe Senders for shared mailboxes, so use a spoofed sender allow entry for those.Replace this with a permanent fix as soon as you can. Microsoft warns that Safe Senders increases the risk of spoofed email reaching the mailbox.
4

Confirm the fix

Send a new email:
  • Delivery: Open the delivery and click Test Now. This sends the delivery to all its recipients.
  • Sign-in link: On your Omni login page, enter your email address and click Email Link.
The fix worked if the new email arrives in the recipient’s inbox. If you added a trusted ARC sealer, the most recent Authentication-Results header of the new email also shows compauth=pass reason=130.

Escalating to Omni support

If you can’t find or fix the cause, contact Omni support with the following:
  • The full headers from one affected email
  • The recipient’s email address
  • Your mail provider, and any forwarding rule, list, or gateway that the email goes through
  • The delivery ID and timestamp, if the email is a delivery

Next steps