We are encountering issues with recipients having links in our sent emails as being marked as malicious by Outlook Advanced Threat Protection on Outlook.com addresses and on certain recipients through Office365 Exchange server, and we cannot understand why.
We are an ESP with a common infrastructure, and for a tiny handful of clients, emails processed by ATP get into inbox (Outlook.com/Live/hotmail and O365 managed mailboxes), but when clicking on a link, it's redirected by ATP to a warning page saying "this link is malicious".
The links are redirect links that go to our systems before redirecting on to the client's original link. We have found no security issues on the client's target link, and we have not found any issues on our own redirect infrastructure - which is mostly used successfully for most of our clients, but for some reasons, Microsoft just does not like the domain name - and we have no idea why, and we are incapable of getting any explanation from Microsoft on this issue!
The only response we can get - when we can get one - is "just deactivate advanced threat protection". That's not going to fly!
This issue has been going on for months, and we have reached out to multiple MS contact to attempt to obtain help and an explanation but with no avail: some background into our frustration:
- We have contacted the Microsoft Postmaster => Response: this is not a deliverability issue but ATP, and the Postmaster cannot assist as your mails are getting into inbox ok.
- We have contacted Outlook support with a live use case => After a 2 hour discussion, the end result was "Someone may have marked your mail as malicious, we don't know any more and cannot help you further other than deactivating ATP outright for your organisation".
- We have contacted our dedicated corporate support at microsoft who tell us they cannot help.
- We have escalated this through our sales contacts at Microsoft who cannot help.
- We have contacted dedicated malware contacts at Microsoft through the M3AAWG organisation. No response.
- Our recipients have contacted MS. No answer other than "don't use Advanced Threat Protection".
- We have tried complaining on Twitter several times. No response.
- We have written a couple of requests for further details on MS support forums, and other than "deactivate ATP on affected accounts", all other pointers have taken us through to the dead ends above.
Is there any support channel open for this at Microsoft? We would love to address any issues, legitimate or false-positives on ATP processed emails going to Microsoft hosted recipients, but for the moment, we have tried climbing through every support hurdle available to us and fell into a black hole every time over the last couple of months and don't know where else to turn !
