Office 365 Email

[KungFooBob]

Any other Tenant admins seeing a lot of kosher emails going into the O365 Security and Compliance Quarantine?

I'm not talking the Junk folder, the proper Quarantine, that you hardly ever look at because it's only usually spam that goes in there?

It's go so bad that I've had to make stuff flagged as High Confidence Phish go to Outlook junk folders so the users can review them, which isn't ideal.

I'm also getting lots of reports of people not getting our outgoing emails when the message tracking shows them being delivered, which suggest to me they're getting Quarantined at the other end.

Have M$ fucked it up?

[Rockburner]

Any other Tenant admins seeing a lot of kosher emails going into the O365 Security and Compliance Quarantine?

I'm not talking the Junk folder, the proper Quarantine, that you hardly ever look at because it's only usually spam that goes in there?

It's go so bad that I've had to make stuff flagged as High Confidence Phish go to Outlook junk folders so the users can review them, which isn't ideal.

I'm also getting lots of reports of people not getting our outgoing emails when the message tracking shows them being delivered, which suggest to me they're getting Quarantined at the other end.

Have M$ fucked it up?

I've no idea if it's relevant or not, but MS have always been very very restrictive with their spam filters - I'm not sure if they reference organisations like Spamhaus (or similar) any more, but it used to be easier to get your domain/IP whitelisted at Spamhaus (or rather, removed from their blacklists), than doing the same with MS.

It's possible that whomever is sending the emails that are getting caught in the nets is using an IP address that's within a net used by someone else who have been reported for spamming, and MS are casting their filters over the whole sub-net (it's happened before).

[KungFooBob]

Thing is that the ones getting blocked are coming from other 365 tenants!

...and the ones that we're getting blocked by are other 365 tenants.

[Rockburner]

Thing is that the ones getting blocked are coming from other 365 tenants!

...and the ones that we're getting blocked by are other 365 tenants.

Sounds about right.

[KungFooBob]

I've been on the phone to M$.

It appears DKIM isn't configured on my domain, I was sure it was.. but they proved it wasn't I only had SPF & DMARC.

I'm guessing they've recently decided to update the 365 filters to be extra picky about DKIM signing.

Just waiting for my new DNS CNAME records to propagate now

[KungFooBob]

Oh what fun this is.

DNS record didn't work.

MS built it for me. You'd think they'd have noticed my domain name has a hyphen in it and therefore the record needs formatting differently.

All fixed now... well the DKIM is, dunno if it's actually going to sort my issue.

[Rockburner]

Oh what fun this is.

DNS record didn't work.

MS built it for me. You'd think they'd have noticed my domain name has a hyphen in it and therefore the record needs formatting differently.

All fixed now... well the DKIM is, dunno if it's actually going to sort my issue.

Anything done by anyone else needs to be checked, especially if done by a 3rd party who aren't being paid*!



* you know what I mean - you're paying MS for the service, you're not paying Fred-First-Line-Support on a personal level - so what does he care?

[the_priest]

I so don't miss my Sys Admin days!!! Now I just go "God can you hear me?", oh right, back in Sys Admin role again....

Email filters are a right pain, I remember when we used Watchguard products and they caused me a lot of pain for a while.

[KungFooBob]

For completeness...

It was a url in the email signature.

A link to a hosted product catalogue on book.designrr.co

Found it through a process of elimination, none of the online mail checkers (spam assassin, mail-checker, etc... ) picked it up.

Replaced the link with one to a pdf copy on our own website and our mails are being received again!

[the_priest]

For completeness...

It was a url in the email signature.

A link to a hosted product catalogue on book.designrr.co

Found it through a process of elimination, none of the online mail checkers (spam assassin, mail-checker, etc... ) picked it up.

Replaced the link with one to a pdf copy on our own website and our mails are being received again!

Now that you say it, we had something very similar happy in our charity. Took a while to suss out what it was and we had to get people to standardise their signatures.