Microsoft Outlook outgoing emails diverted to recipients spam or junk for hotmail outlook recipients

[Paul_Hamilton_67]

Hello

We use Outlook as part of Office 365 in our business and recently we have seen that our outgoing emails to our staff and clients with hotmail or outlook email accounts are being diverted to their spam / junk folder.  The recipients have tried moving these emails to inbox, adding us as a contact in their email account and also as a VIP but nothing changes.  All other emails to gmail, yahoo, Mac etc are received into the inbox without any issues so this is an issue related to Outlook client to hotmail and outlook.com addresses only. The email server is a GMAIL server and if we logon to the account via the browser, the emails are received without issues.

We have had no issues for 3 years and then suddenly we see this issue which is annoying and time consuming to get around.

There are requests for help on this platform and elsewhere about this behaviour but seemingly no solution although there is an article which mentions changing DNS entries at the domain provider level.

I tried to seek help via MS support for Outlook but they suggested I ask all our clients and staff with these type of email accounts to review their setting in hotmail or Outlook.  Clearly this is impossible as most of our clients are elderly and not tech savvy in any way.

Does anyone have any ideas on how this can be resolved please?  Surely this is a Microsoft issue?

[#2]

Hi @Paul_Hamilton_67 

first you need to check SPF,DKIM and DMARC is configured probably.

then check https://mxtoolbox.com/blacklists.aspx if your domain is blacklisted.

and try to get Message header and analyze it.

If I have answered your question, please mark your post as Solved

If you like my response, please give it a Like 

Appreciate your Kudos! Proud to contribute! :)

[#3]

Thank you for taking the time to respond. I have checked the blacklist and our domain is not present. We do not have access to the GMAIL server which is used for several private offices all under the same domain name. This is managed by a 3rd party IT provider. I have no idea what SPF, DKIM or DMARC is or their relevance. Are these entries on the DNS?

[#4]

Yes DNS Record,

ask one of your client to send you message header of copy of one mail from junk folder and try to analyze or paste it here

[#5]

Thank you. I have obfuscated the domain name to 'domainxxxxxxxx.co.uk' and my outlook test address

Received: from SJ0PR18MB3883.namprd18.prod.outlook.com (::1) by
MN2PR18MB3375.namprd18.prod.outlook.com with HTTPS; Thu, 13 Jul 2023 13:14:31
+0000
Received: from SN4PR0501CA0020.namprd05.prod.outlook.com
(2603:10b6:803:40::33) by SJ0PR18MB3883.namprd18.prod.outlook.com
(2603:10b6:a03:2e5::11) with Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6565.31; Thu, 13 Jul
2023 13:14:29 +0000
Received: from SN1PEPF0002529D.namprd05.prod.outlook.com
(2603:10b6:803:40:cafe::6) by SN4PR0501CA0020.outlook.office365.com
(2603:10b6:803:40::33) with Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6588.22 via Frontend
Transport; Thu, 13 Jul 2023 13:14:29 +0000
Authentication-Results: spf=none (sender IP is 209.85.128.42)
smtp.mailfrom=domainxxxxxxxx.co.uk; dkim=pass (signature was verified)
header.d=domainxxxxxxxx.20221208.gappssmtp.com;dmarc=none action=none
header.from=domainxxxxxxxx;
Received-SPF: None (protection.outlook.com: domainxxxxxxxx does not
designate permitted sender hosts)
Received: from mail-wm1-f42.google.com (209.85.128.42) by
SN1PEPF0002529D.mail.protection.outlook.com (10.167.242.4) with Microsoft
SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id
15.20.6588.20 via Frontend Transport; Thu, 13 Jul 2023 13:14:29 +0000
X-IncomingTopHeaderMarker:
OriginalChecksum:94F3C4972DD6A30C21A70F0B915117AA7311569465965738A0C4913866A5A78B;UpperCasedChecksum:908C8295DAE55A66866145B278BD9DE20305CEBE3F3A63B8456D8C4890863F00;SizeAsReceived:3066;Count:18
Received: by mail-wm1-f42.google.com with SMTP id 5b1f17b1804b1-3fa86011753so1339095e9.0
for <email address removed for privacy reasons>; Thu, 13 Jul 2023 06:14:29 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=domainxxxxxxxx.20221208.gappssmtp.com; s=20221208; t=1689254069; x=1691846069;
h=content-language:thread-index:mime-version:message-id:date:subject
:to:from:from:to:cc:subject:date:message-id:reply-to;
bh=p4t8SL/a2WhNa6KthDN5o5kozLYG44TOhprUCReQcPQ=;
b=qYlQmeRFiVzRlT8qC8P5Z8nTN3nLFzOZpqKGoxCZEKrOYHdpkQ3fzKXvM2V0w8G3rk
5vbwNTzZoMlk7fmpii8h40+RAaxL4YaB1j5YpXapJcR2Jz2205T9FyJBVbRmgW3267xo
UPrB+PW7rBbplFAohzaq+xoVIxDG9LqZlBaJvR2QjiTTqv7CcysJet8f1j9a4fEEtJ+T
rLUgN6O92KjYmvlKtFi8NcbH1Yhk5ZPlK62Qdw10GrvjirBuI99oVEQqVyEanmYNF6Ir
wdV29FzZhxKbDHclrdQMsJmgV/+vVzFmQyKVo4HnidMQ/ej16ZVvYgREOSUbVsfKakej
tzQg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20221208; t=1689254069; x=1691846069;
h=content-language:thread-index:mime-version:message-id:date:subject
:to:from:x-gm-message-state:from:to:cc:subject:date:message-id
:reply-to;
bh=p4t8SL/a2WhNa6KthDN5o5kozLYG44TOhprUCReQcPQ=;
b=fxVJrgj9Y/c9e0LV2WwirsMriXUIjouDMI1Of3vL3srDNVMMDwDcQoqDYC/Gek9633
x/I6PtTEySD4E3HUYqBlDUw0N7bM8BOt6YuaD3A+LvCTwIxMRwuio//0xbkti7t/u2FF
E6fn3jE2huAvmFWIcBy4/wIXZmnsYuPPGjXo10HpGEoihyUm+Vu/EXDWqnIEP+IDygU3
lhBvcUHlExf2Tt73wJxy4nBqopJF+t+dGeaH1Ctxo4MBWxnAqOiJqK17d9nIfBdqFmTL
VtDPilAm76mkU9+uzsCiAQt3RGYy8P9ABmL8Z9jOf2Q82dpyuidqrvH4PKFD0dEpaLFP
RqlQ==
X-Gm-Message-State: ABy/qLYOnfJv2yw4HhIcpxDCjwhjHLT7rKPi5cooXX5zweUu3F6XaSaO
p6tLHdP8WKdT1V8BLtBLjnGDIGlFGind5FYxR+WZrtZR5Zk1wi+lLQjOgYMmbWFqV8Qm/58H4gd
auS9SKq63j2v9jmPJK3x75D1FoYEUpNs=
X-Google-Smtp-Source: APBJJlEcpGXZzZsECe3Ws7l7Mceu9PdAefRikRtD+PTPMI+9CzJEgZYWPyCWK2IiEOK50Ai/YZzS2g==
X-Received: by 2002:adf:e255:0:b0:313:e8fb:b00f with SMTP id bl21-20020adfe255000000b00313e8fbb00fmr1624145wrb.6.1689254068695;
Thu, 13 Jul 2023 06:14:28 -0700 (PDT)
Return-Path: domainxxxxxxxx
Received: from LAPTOPH54IRPTR (host31-49-66-112.range31-49.btcentralplus.com. [31.49.66.112])
by smtp.gmail.com with ESMTPSA id s14-20020adfea8e000000b00301a351a8d6sm8010157wrm.84.2023.07.13.06.14.28
for <email address removed for privacy reasons>
(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);
Thu, 13 Jul 2023 06:14:28 -0700 (PDT)
From: <domainxxxxxxxx>
To: <email address removed for privacy reasons>
Subject: Test after removing the email signature images
Date: Thu, 13 Jul 2023 14:14:29 +0100
Message-ID: <014401d9b58b$f4ddd2c0$de997840$@domainxxxxxxxx>
X-Mailer: Microsoft Outlook 16.0
Thread-Index: Adm1i/GQBZJyRUenT8GjKDorQsQ8vQ==
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0145_01D9B594.56A23AC0"
Content-Language: en-gb
X-IncomingHeaderCount: 18
X-MS-Exchange-Organization-ExpirationStartTime: 13 Jul 2023 13:14:29.2592
(UTC)
X-MS-Exchange-Organization-ExpirationStartTimeReason: OriginalSubmit
X-MS-Exchange-Organization-ExpirationInterval: 1:00:00:00.0000000
X-MS-Exchange-Organization-ExpirationIntervalReason: OriginalSubmit
X-MS-Exchange-Organization-Network-Message-Id:
6379803b-1203-4ce8-75ae-08db83a3170b
X-EOPAttributedMessage: 0
X-EOPTenantAttributedMessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0
X-MS-Exchange-Organization-MessageDirectionality: Incoming
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic:
SN1PEPF0002529D:EE_|SJ0PR18MB3883:EE_|MN2PR18MB3375:EE_
X-MS-Exchange-Organization-AuthSource:
SN1PEPF0002529D.namprd05.prod.outlook.com
X-MS-Exchange-Organization-AuthAs: Anonymous
X-MS-UserLastLogonTime: 7/13/2023 1:13:22 PM
X-MS-Office365-Filtering-Correlation-Id: 6379803b-1203-4ce8-75ae-08db83a3170b
X-MS-Exchange-EOPDirect: true
X-Sender-IP: 209.85.128.42
X-SID-PRA: domainxxxxxxxx
X-SID-Result: NONE
X-MS-Exchange-Organization-PCL: 2
X-MS-Exchange-Organization-SCL: 5
X-Microsoft-Antispam: BCL:0;
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 13 Jul 2023 13:14:29.2123
(UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 6379803b-1203-4ce8-75ae-08db83a3170b
X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa
X-MS-Exchange-CrossTenant-AuthSource:
SN1PEPF0002529D.namprd05.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg:
00000000-0000-0000-0000-000000000000
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SJ0PR18MB3883
X-MS-Exchange-Transport-EndToEndLatency: 00:00:01.9687922
X-MS-Exchange-Processed-By-BccFoldering: 15.20.6588.015
X-Microsoft-Antispam-Mailbox-Delivery:
abwl:0;wl:0;pcwl:0;kl:0;dwl:0;dkl:0;rwl:0;ucf:0;jmr:0;ex:0;psp:0;auth:0;dest:J;OFR:SpamFilterAuthJ;ENG:(5062000305)(90000117)(90005022)(91005020)(90014020)(91030020)(91040095)(9050020)(9100338)(944500132)(2008001134)(4810010)(4910033)(8820095)(10005027)(9610025)(9540006)(10160021)(9320005)(9245025);RF:JunkEmail;
X-Message-Delivery: Vj0xLjE7dXM9MDtsPTA7YT0xO0Q9MjtHRD0xO1NDTD02
X-Microsoft-Antispam-Message-Info:
=?iso-8859-1?Q?IMklF3kRzWO3EWjTchB8GilA+vT83GXT1SaoCkmHVNdoz91WNDaT12wKBp?=
=?iso-8859-1?Q?7WT8tfFOzuQpoTD+Uch3zB91zjGeXnNFtu85RI7TVhCv5K8HhmGBsmYuaO?=
=?iso-8859-1?Q?549uzmahzpHrJvNQMpa+1mV/eHDI0JrPe1w1i0CEEMPs54H2fSbG5Avrr7?=
=?iso-8859-1?Q?OzH7tIrckKDDnR01zCiGLs/2ow20ruUnopGvH2/6l1K1rSMtJzulFza5eY?=
=?iso-8859-1?Q?dy12rGOVjMWASnmYcE/1L+/lfwQWk9oReVUzOiKmQHYq6awcu+1ndGIN0h?=
=?iso-8859-1?Q?Mw8S4PKpfPAdzLGGXQ7Z0cFpJjusNTijTt1ZKkDB6y1cOJLByCzGrlRZyw?=
=?iso-8859-1?Q?qge9Rkkf519rb8wtE9Urx+53gxhoOxab8sLG7kWlMn8Yyluv2zn+BJF8HS?=
=?iso-8859-1?Q?J9bCdPjNdEF15nT4onN06He18fCwAmsBJvfj4l2nA4sapX4+o6xQMEG8Oo?=
=?iso-8859-1?Q?DSDMfZ08/YvjH3RdehxrxwYz6Soqg8/XamkXKXNvre+lSjsKgUjuuvDGsv?=
=?iso-8859-1?Q?s6YEVMUnwGI6LFACcZIZqoe6DzaEjYpxRw27B3jS6IgmoBXI1X/XOYR/e/?=
=?iso-8859-1?Q?1uzQd1+dkMJflJIFzIkS28ALm4KIY0O4KO0rjXmY9EdwRaZPUoV3IXxOo5?=
=?iso-8859-1?Q?OD59lN5HZDmVJ9lZFIvysb4uzEkMDdO4XDoMKsRqophJUVLW6HqjwmPv/a?=
=?iso-8859-1?Q?vOVvhZxIyxdmJW4b7sy0VS8z46mWHWjdmhrzMXqUvNNN5Ocja2Gj0ikr+6?=
=?iso-8859-1?Q?SXniBFsj5iyD+Ywrm8nyqlnxDWtcnb4zE4uGgJXxVjFX80gsP2PBIf1BUH?=
=?iso-8859-1?Q?iw6jasDwWjvLNPQYVQ3aNIiRk+uulXbcpzVr/KWYaUI+YUpKo9gQZ5C2xu?=
=?iso-8859-1?Q?pSfzH3YnZtESIB9xlwAD4epFzuZ3vdENVatzZO7dl3NPD0S+ic30IYG7PP?=
=?iso-8859-1?Q?QLBzwbYn3RZIii+mlckWc3eLsB3SZ6TqBoDgV62tSOjDQSK1Ic+h/QpuvS?=
=?iso-8859-1?Q?zjN2YQQAzvAZK6UYd6MZIaWMSbPeSCwb3h55WIUITsScSZHz4aHFdiQF9n?=
=?iso-8859-1?Q?AAQl5ApGe+pbP9z3k4FPCGSmK3+uNFg4JUfcopkjwpqOkhDIzzDen+jWoW?=
=?iso-8859-1?Q?cYE+7lELi+X9SSKLu3E1KGaMaJU8GzxRltfIxroV4yXoxBQZ8+AWf+qRir?=
=?iso-8859-1?Q?f+0mSo3pPkra8r9bcJH1m2zVIkN4QqfUQxSjWJW8czCmsT6xkiEwjnsx9R?=
=?iso-8859-1?Q?rnmRjYxg9a2HVjc7ZSFIR/ZsvK/omh57kKDX4GvTGMT8mEmDrMA3Z8hjBE?=
=?iso-8859-1?Q?qy/ZccYFiVWJDp2/kilbso7YJE2DW0VNJJxLUg15c09lQoBTqnFqBMcprM?=
=?iso-8859-1?Q?xwlfLKLmpzdnbJX5EzcS/gZsagy3cujBWAZBByzegFNVB5FbNPGsrLoP/9?=
=?iso-8859-1?Q?smmjC5onyyBb8maEFkphRUhOlsCD0cLgk57Px++HnQbdTRzXUVH+++QIhO?=
=?iso-8859-1?Q?yt2W1T0AjJqCRKdnOf+7i0I7GFuSGy/vozT8+iUp5GLHr79HcHZxK4P6PB?=
=?iso-8859-1?Q?DCiwzSKP+ycEQJHJvChUXDWJM31ZBNx6bJxCN5rZ6ffrhs8TVU5IHM41OH?=
=?iso-8859-1?Q?JRhwywgaLmPkgCCYI70NQlkHIYxR5RsRhW3cMKb2ZAQvg6HsC8nCfA7nKS?=
=?iso-8859-1?Q?lE4LcMjlGgkguhwA5Wbn9oxPBJYB/T66qhF2PN/KP+3oicNtTdXjSAM7s9?=
=?iso-8859-1?Q?/ywFoiZ3O7P1pe8v05CdMWDEng1csU0hZonAX917ljfVnnl7HG02cRZvbk?=
=?iso-8859-1?Q?37K9yY/OQ82KCxNDF9y+r0ihH1s36Zc=3D?=
MIME-Version: 1.0

[#6]

@Paul_Hamilton_67 X-Microsoft-Antispam-Mailbox-Delivery:
abwl:0;wl:0;pcwl:0;kl:0;dwl:0;dkl:0;rwl:0;ucf:0;jmr:0;ex:0;psp:0;auth:0;dest:J;OFR:SpamFilterAuthJ;ENG:(5062000305)(9610025)(9540006)(10160021)(9320005)(9245025);RF:JunkEmail;

If you look for this header and related fields you can find that it may come down to MS antispam engines that trigger your getting flagged, at least for us that seems to be the case. We have a case open and are hoping to get to discuss with them in a day or two. 

We searched for X-Forefront-Antispam-Report-Untrusted and the first article seems to help us understand the header a little better, if not perfectly. You'll also find many similar articles.