Forum Discussion
cnx-michaelrlawrence
Nov 20, 2021Copper Contributor
All @microsoft.com emails get quarantined daily - Why?
Can anybody shed any light on why all Pernille-Eskebo.com emails get quarantined daily? Doesn't matter how many times we select to release/review messages, they are always quarantined. We have not se...
ExMSW4319
Nov 21, 2021Steel Contributor
Trace the sending IP address of one of the messages. I think you will find it is a third party.
Just this week I have had a case where the email2.microsoft.com was sending from Salesfarce and ended up in our Junk folders. Salesforce were including what I would regard as junk indicators and it is annoying when a bureau includes these in transactional traffic, though in fairness to them this was bulk [Microsoft news] rather than what appears to be transactional items in your case.
Just this week I have had a case where the email2.microsoft.com was sending from Salesfarce and ended up in our Junk folders. Salesforce were including what I would regard as junk indicators and it is annoying when a bureau includes these in transactional traffic, though in fairness to them this was bulk [Microsoft news] rather than what appears to be transactional items in your case.
- ExMSW4319Nov 22, 2021Steel Contributor
And only this morning a part of the old Marketo infrastructure now under the Adobe banner tried to mail me as microsoft@email.microsoft.com. That picked up one of my bulk tags, and even EXO gave the message SCL 8 and BCL 1.
- cnx-michaelrlawrenceNov 22, 2021Copper ContributorI had one from bp-norep@microsoft.com for Bing Places wanting us to update our Holiday hours get quarantined. I get other emails from Pernille-Eskebo.com addresses like the one you referenced above. ALL of them always get quarantined. Perplexing.
- ExMSW4319Nov 23, 2021Steel ContributorNot really. In the Marketo example I mentioned, the sending host was generic and not dedicated to Microsoft workloads. Many of the bureaux I have mentioned are significant senders of grey mail; bulk based on a previous commercial relationship rather than the traditional dubious pharma spam or the latterly more commonplace criminal phishing, but still nonetheless unsolicited and capable of overwhelming a mailbox if unmanaged. The EXO scores I mentioned therefore came as no surprise.
Take a look at the headers of samples of your quarantined Microsoft traffic. See what the Forefront scores are. Take the sending IP address and put it through any online reputation service that will tell you who owns it. I predict that it won't be Microsoft.
It is also worth noting that typically Junk Mail would go to Junk folders rather than the hosted quarantine. Your organisation may have a rather stiff threat policy on Junk, there may be a somewhat excessive mail flow rule or if your colleagues do not have the same problem, you may want to double-check your own Outlook settings.