Symptom
Emails sent by external senders to a shared mailbox (e.g., Exchange/Microsoft 365) that is configured to auto-forward to C4C are intermittently not received in C4C.
Environment
SAP Cloud for Customer
Reproducing the Issue
- An external sender (e.g., sender@externaldomain.com) sends an email to a shared mailbox (e.g., shared.mailbox@company.com) which has an Exchange auto-forwarding rule to the C4C inbound email address.
- Go to the Email work center in C4C and search for the email by sender, subject, or date.
- The email is not found. However, when an internal user manually forwards the same email to the C4C inbound address, it appears in C4C successfully.
Cause
- Exchange auto-forwarding (redirect) preserves the original external sender's From address but changes the sending IP to the company's mail server. This causes SPF to fail at the SAP inbound gateway because the company's IP is not authorized by the external sender's SPF record.
- DKIM signatures may also break during forwarding if Exchange modifies the email headers or body (e.g., adding disclaimers, rewriting URLs). If both SPF and DKIM fail, DMARC authentication fails and the email is silently rejected depending on the sender domain's DMARC policy (quarantine/reject).
- The behavior is intermittent because the outcome depends on each external sender domain's DMARC policy, DKIM configuration, and whether the DKIM signature survives forwarding. Domains with a strict DMARC policy will be blocked; domains with a lenient policy (none) may still be accepted.
Resolution
- Recommended: Adopt server-side integration (EWS or Microsoft Graph API) so that C4C fetches emails directly from the shared mailbox. This eliminates the forwarding hop entirely and preserves all email authentication (SPF/DKIM/DMARC) intact.
- Alternative: Work with the Microsoft 365 / Exchange administration team to review the forwarding configuration and explore ARC (Authenticated Received Chain) support, which is designed to preserve authentication results across forwarding hops.
- Alternative: Configure an Exchange transport rule that rewrites the sender address before forwarding to C4C, so that SPF/DKIM/DMARC align with the company's own domain.
Keywords
C4C; SAP Cloud for Customer; missing email; email not received; inbound email; Exchange forwarding; auto-forward; redirect; SPF; DKIM; DMARC; authentication failure; silently rejected; email security; SAP inbound gateway; AWS SES; server-side integration; EWS; Microsoft Graph API; ARC; Authenticated Received Chain; Exchange transport rule; shared mailbox; email channel , KBA , LOD-CRM-SRP , Service Request Processing , Known Error
SAP Knowledge Base Article - Public