When Fin is deployed on email, the setting "Prevent Fin from processing emails that fail authentication (DMARC)" only checks the authentication result when the message reaches Intercom. It ignores the ARC seal that a forwarder adds.
Many teams don't receive email at Intercom directly. Their support address is a Google Workspace or Microsoft 365 mailbox that forwards to Intercom. The forward changes the server that delivers the email, so SPF fails for every sender who doesn't sign with a DKIM key for their own domain. Most Microsoft 365 customers on default settings are in that group. Their DMARC result then fails, and Fin skips the email, even though it was genuine and passed authentication when it reached our mailbox.
For us, 26 genuine customer emails were skipped in 10 days. Turning the setting off isn't a good option, because it's the only thing stopping Fin from answering forged emails.
Request:
1. Let a workspace mark its forwarders as trusted (for example Google Workspace or Microsoft 365, or specific domains). For mail from those forwarders, Fin should use the authentication result recorded in the forwarder's ARC seal. This is how Gmail and Microsoft 365 themselves handle forwarded mail.
2. As an alternative or addition: when an email fails the check, let Fin ask the sender for the one-time code before it runs any data connector, instead of skipping the email.
Related: "Add more ways to fix: Fin did not try to answer because the sender could not be authenticated".