All @microsoft.com emails get quarantined daily - Why?

Question

Can anybody shed any light on why all&nbsp;Pernille-Eskebo.com emails get quarantined daily? Doesn't matter how many times we select to release/review messages, they are always quarantined. We have not selected to block the domain, nor have we added it to a whitelist since Microsoft dissuades this practice. Just find it hard to believe that Microsoft can't auto-approve their own (notification) emails they send to tenants. Seems a bit bass-ackwards! Image is example of daily quarantine email we receive daily and have to manually release each message. In this example, there are 11 emails all from microsoft-noreply@microsoft.com.

exmsw4319 · Answer

Trace the sending IP address of one of the messages. I think you will find it is a third party.

Just this week I have had a case where the email2.microsoft.com was sending from Salesfarce and ended up in our Junk folders. Salesforce were including what I would regard as junk indicators and it is annoying when a bureau includes these in transactional traffic, though in fairness to them this was bulk [Microsoft news] rather than what appears to be transactional items in your case.

exmsw4319 · Answer

And only this morning a part of the old Marketo infrastructure now under the Adobe banner tried to mail me as microsoft@email.microsoft.com. That picked up one of my bulk tags, and even EXO gave the message SCL 8 and BCL 1.

cnx-michaelrlawrence · Answer

I had one from bp-norep@microsoft.com for Bing Places wanting us to update our Holiday hours get quarantined. I get other emails from Pernille-Eskebo.com addresses like the one you referenced above. ALL of them always get quarantined. Perplexing.

exmsw4319 · Answer

Not really. In the Marketo example I mentioned, the sending host was generic and not dedicated to Microsoft workloads. Many of the bureaux I have mentioned are significant senders of grey mail; bulk based on a previous commercial relationship rather than the traditional dubious pharma spam or the latterly more commonplace criminal phishing, but still nonetheless unsolicited and capable of overwhelming a mailbox if unmanaged. The EXO scores I mentioned therefore came as no surprise.Take a look at the headers of samples of your quarantined Microsoft traffic. See what the Forefront scores are. Take the sending IP address and put it through any online reputation service that will tell you who owns it. I predict that it won't be Microsoft.It is also worth noting that typically Junk Mail would go to Junk folders rather than the hosted quarantine. Your organisation may have a rather stiff threat policy on Junk, there may be a somewhat excessive mail flow rule or if your colleagues do not have the same problem, you may want to double-check your own Outlook settings.

Forum Discussion

All @microsoft.com emails get quarantined daily - Why?

4 Replies