Forum Discussion
Outgoing emails marked as SPAM and Phishing emails by O365 servers
You might want to read the following article on the "health" tab in the office portal...
ALV_Work We got exactly the same problem yesterday, I opened a ticket but Microsoft seems to have no clue about what happened.
We worked on it a while and this is what we could figure out about our case :
- It started around 7am CET and ended around 8pm CET
- It has nothing to do with SPF or whatever
- EOP was giving a SFV:SPM SCL:5 to outbound emails ONLY IF they were replies or forwards to external email addresses, so they were using the High Risk Delivery Pool and we were getting a BCC in our IT mailbox as our Outbound spam Policy specifies it. I can see in your header that it was the same for you : DIR:OUT;SFP:1501;SCL:5
- When an external person was answering one on these emails they were coming back with SFV:SPM and CAT:PHSH, so we got PLENTY of emails yesterday ending up in junk folder
- Every Outbound Spam BCC in our IT mailbox arrived twice, the second time with a huge delay (6+ hours), and message stayed in "Getting Status" for very long time in traces, maybe because they were going through the High Risk Pool.
We didn't make any changes in our SPF or policies, it just randomly happened and ended.
I'm still waiting for an explanation from Microsoft.
You might want to read the following article on the "health" tab in the office portal...
Rafmoerkens Their article is weird though, I don't understand what this has to do with "URL filtering"! Happened with every single message.
ALV_Work Nope we tried with blank messages was the same, I think we will never know what really happened :)
Rafmoerkens Thanks for this, It doesn't appear in my portal, I only have the "EX176985 - Can't see message traces" ...
Philippe_RAYNAUD: you might have been "out of scope"? ;-)
ALV_Work: please see above as you were the one that had the issue :-)
HiRafmoerkens Philippe_RAYNAUD ,
Negative. Had a call from O365 support guy(not direct MS staff) and he has confirmed that my domain is having a service incident but I still donot see anything on my office portal. But looks like the issue is not happening now.
