<Solved>Emails being marked as phishing by office

[josephmiller1256]

Hi all,

I am having a big problem with office quarantining my user's emails before they are sent.

Here is some back story:

I run the IT for three businesses. two of them are on the same tenant in 365 but the other is on a separate tenant. The one that is on its own is the one having problems.

When an email on that tenant sends a message to a yahoo account there are no problems, but when it sends to another Microsoft based email account it is blocked by quarantine as a phishing email. 

I understand that we can add a rule to allow emails from this tenant to come through but that is only a band-aid fix to the problem as if we need to send an email to someone who has these types of filters or another company using 365, we have no way to ask them to white list us or accept our emails.

I have tested this from multiple emails on this tenant and they all have the same result. 

[#2]

@josephmiller1256 
Have you run the message headers through a message header analyser? It may be that this tenant/sending domain has a misaligned SPF, DKIM or DMARC record

Microsoft Remote Connectivity Analyzer > Message Analyzer

https://mha.azurewebsites.net/ 

Or MX toolbox 

https://mxtoolbox.com/EmailHeaders.aspx

Thanks

[#3 · Accepted solution]

@stonefr33 I was able to fix the problem. It was related to DMARK and all of that jazz, but it was something the head office had to do, and was out of my control. No one told me this was the case.