Forum Discussion
Office365 support incompetant - All emails marked as spam due to hyperlinks in email siganture
Hello all,
This thread has come to my attention. Let me fix some misconceptions:
Office 365 absolutely does scan messages "on the way out". This is done to protect our IP reputation. If a message is deemed spammy, then it will be marked as spam and sent out via a special pool of IPs. This pool of IPs has questionable reputation and we do not attempt to maintain their reputation. We do absolutely monitor the reputation of our good IP addresses - so much so that I'm fairly certain that is not an issue here.
Most often, I do see false positives happening when someone creates an automated email signature with links in them. A false positive requires a spam rule to be adjusted on our side. This is simple -
1) First report the problem in Submissions Explorer
2) If not getting headway, open a ticket - we just need the samples with the full headers showing what happened so that our engineering team can correct the rule. It is an easy fix - if you're not getting the help you need from the support, point them to this post as guidance.
I apologize for any inconvenience.
Regards,
Scott
Do you have the required SPF record in your DNS zone? And if you send an email to a customer without the signature (or at least the hyperlink) does it get through?
- This does happen. We are experiencing the same issue. Emailing has worked for 12 months with no problems then 2 weeks ago emails started to be quarantined due to phishing. We removed the company website hyperlink and staff member email hyperlink and re-sent emails, and it worked. Microsoft are struggling to find out why. In the meantime, I log into admin and release quarantined emails every hour (some emails have hyperlinks still).
Loryan Strant This is happening to our organization as well. The outbound emails are all quarantined with a spam/phishing score of 9 even if the email only has the work "test" in the subject and body, however there is a company set up signature which has 3x hyperlinks to company websites and emails. When the hyperlinks are removed, the emails are not quarantined, and the recipients receive the emails. The issue only occurs when emails are sent to an email address that is associated with the Microsoft Exchange, if we send to a Gmail account there is no quarantining.
- Scott Landry
Microsoft
MatRegan In addition to opening a support ticket, you should also be able to identify the specific URL and override it. But first and foremost, you should perform several submissions:
Manage submissions - Microsoft Defender for Office 365 | Microsoft Learn
Thanks Scott Landry . We have raised a ticket with Microsoft and am working through the fault with them... but it is a slow process. We have had some success by removing incorrect hyperlinks from email signatures. It was as minor as changing our website address from www.mywebsite.com.au to http://mywebsite.com.au . Then the emails would pass through the server. I had tried to permit emails from our domain in the Outlook Admin but that didn't help (there's plenty of reports out there to show this doesn't work). I have also flagged the quarantined emails with Microsoft for review... that should keep them busy for an hour or two if they review them all individually. We'll see what tomorrow brings.
Loryan
The Outbound spam option is enabled on all our emails in office 365 and the header details captured states that the message was flagged as SPAM SCL5 by the Forefront server.
We have everything in place, SPF, DKIM etc etc.
Moreover this problem all of sudden started 2 weeks ago and got resolved by itself yesterday.
Even the support team has no clue as to what triggered this issue.
Regards,
Terence
The problem you had with your mails being rejected as spam, might be due to the fact that multiple Office365 outbound SMTP servers are listed in email blacklists;
eg:
https://mxtoolbox.com/SuperTool.aspx?action=blacklist%3a104.47.5.207&run=toolpage
https://mxtoolbox.com/SuperTool.aspx?action=blacklist%3a104.47.116.242&run=toolpage
They have started changing the IPs that they send emails from, however large volumes of spam are still being relayed so its only a matter of time the new IPs get blacklisted again.
I believe the IP must have got blacklisted as you mentioned, anyways its all good for now...Than for your help...
- https://technet.microsoft.com/en-us/library/jj200737(v=exchg.150).aspx
