Random mail delivery from GMail

There should be more information in the NDR as to why. Also, check their IP against a Blackhole list like network-tools.com.

Meanwhile, you should be able to whitelist them in your email filter so their mail gets through to you.

Problem is there is no ip info in the "header". I have analyzed some of the gmail servers in the past and they were on an internet blacklist, I am not going to whitelist. i don't have an ip address to white list anyway

Any mail from mail.gmail.com is bogus, as a DNS lookup on this host returns NXDOMAIN (no IP).

Said another way, mail.gmail.com - there is no mail host name related to the gmail.com domain name.

Yeah, I saw the same thing but the sender is a legit sender so there is something else going on here. Even the message 'header" that was sent to me appears to be bogus.

The sender is no legit, because they're forging an email to appear to be from a gmail.com host which is nonexistent.

Forged Mail == Bogus/Nonlegit Mail.

Super easy to block this type of Forgery. Just run SPF analysis at your MTA + immediately bounce or blackhole (drop with no response) Forgeries.

Tip: The way I handled Forgeries + SPAM is simple.

In my incoming filtering, I sense both conditions, then return a 550: User not found response.

After a 550 is returned a few times, mail from this sender (whoever the sender might be) will stop, because they're wasting resources sending to what appears to be a non-existent user.

To be honest, there may not be a lot you can do. If they aren't using properly formed header that comply with RFC1822, then your company probably isn't the only one who is rejecting their email. To be blunt, you shouldn't be expected to compromise your email security to accommodate someone who doesn't follow the rules.

Agreed

I am also having a mail delivery issue from smtp.gmail.com, an nslookup returns an ipv6 as well as an ipv4 address. This is the first time I have encountered this. My SPAM filter is rejecting the connection but I don't see anything in the logs. When I check the txt records for the hosted domain i get the following;
Microsoft Windows [Version 10.0.17763.864]
(c) 2018 Microsoft Corporation. All rights reserved.

C:\Users\bfields>nslookup
Default Server:  UnKnown
Address:  192.168.101.217

> server 4.2.2.2
Default Server:  b.resolvers.level3.net
Address:  4.2.2.2

> set type=txt
> compass.com
Server:  b.resolvers.level3.net
Address:  4.2.2.2

Non-authoritative answer:
compass.com     text =

        "MS=ms64829634"
compass.com     text =

        "adobe-idp-site-verification=54008c3c-af25-4f80-9730-49ae3e1cd6d2"
compass.com     text =

        "docusign=2c9c554e-4930-4ba3-a878-682a34c8eda9"
compass.com     text =

        "docusign=5fe9d34d-a96e-4ad1-8edc-d67ce4e4543b"
compass.com     text =

        "facebook-domain-verification=smzi54npour6196nzgjhnmsap8l0y7"
compass.com     text =

        "google-site-verification=3C-S081T9gRRdoRFltMBhUaOJX722peEUrLKlqq05OM"
compass.com     text =

        "google-site-verification=HrOiZEDlh12IeA-17RI4XgSorGnzWEtvC7pRS2TjTEI"
compass.com     text =

        "google-site-verification=pJwvcYwAL54K1ta6dA0tCUA8ZpR68XlwvQlAB7l-LmM"
compass.com     text =

        "northpass-domain-verification=e94680713396c2445f35c491059c7444"
compass.com     text =

        "segment-site-verification=UoY8Sw0ubYDFEtxrEqvM3wba9jG51JRB"
compass.com     text =

        "v=spf1 include:compass.com._nspf.vali.email include:%{i}._ip.%{h}._ehlo.%{d}._spf.vali.email include:servers.mcsv.net include:sendgrid.net include:zcsend.net ~all"

Does anyone know how decipher this?

Since this an old question and that's not related to the original question, you might be better off asking it as a separate question.