7 ms·

Ask HN: Is there hope for Microsoft 365 support?

63 points by joaopbnogueira 1y ago

The company I work for (25friday.com) has been hit with what seems to be a keyword blacklist on Microsoft 365 email. In short, if we send out any email to clients using Microsoft 365 as their email provider containing the textual content "25friday.com" anywhere on the email subject, body or readable attachment (e.g. pdf) the emails fall on a "blackhole" and are neither bounced nor reaching the recipient (they are not in spam or quarantine either). As you might imagine this is a huge problem for us as email is our primary means of communication with our clients and we need to be careful to never include any mention of our domain in any email we send to them. For recipients using personal Outlook emails, the emails are received and sent to spam with a spam score of 9 (maximum score). We've reached Microsoft support and they seem as clueless as we are. They have no idea why this is happening and they are unable to provide any information or progress on the ongoing issue. This has been going on for about a month now. A few things we have tried: - We have checked our SPF, DKIM, and DMARC records and they are all set up correctly and passing. - We have checked our email sending reputation and it is good as far as we can tell. - We have tried sending emails from different email addresses and domains, but the issue persists. - We have setup our own Microsoft 365 account to be able to submit false-positive reports on the security portal, but the submissions disappear into the void and we never receive any feedback. - We have tried some deliverability testing tools and they all report that our emails are being blocked by Microsoft 365, but not by any other email providers. - We are not on any known/public blacklists Note that we are using Google Workspaces, but that does not seem to be the issue. The domain itself has been live since 2018 (since the company was founded) and we have never had any issues with email deliverability before. We don't send spam or unsolicited emails. The closest I could think of is a mailing list we have with about 300 subscribers containing mostly client emails but also some emails of people we invite to our events. We send out an approximately monthly newsletter to this list, but we have never had any complaints or issues with it before (we're using Pipedrive for that). Tangential but I believe that it might be related: if I set my website address as 25friday.com on my LinkedIn profile, the link gets overwritten to a LinkedIn error page. My guess is that since LinkedIn is owned by Microsoft, they are sharing the same blacklist. Any tips would be greatly appreciated. We're really affected by this and without any recourse to escalate this issue.

deleted 1y ago
[deleted]
tatersolid 1y ago
We had this happen to one of our apps which redirected to a third-party identity provider which used a different domain name. Basically the app looked like a phishing site to those who clicked on the email links and ended up on a login page on a domain they didn’t recognize. So these users reported the email as phishing in outlook. Microsoft confirmed these user reports were the source of the blocking. The fix was our own MSFT support case opened via our own E5 subscription which took two weeks to get the app unblocked. To prevent future reports we put a custom hostname on the IdP. So app.example.com now redirects to login.app.example.com
- joaopbnogueira 1y ago
  We don't even have any sort of login on our main page, the redirects we have are mostly around apex domain to www.25friday.com, http to https and the likes.... This is a pure company landing page with the typical business description, career application page, articles etc. We do have subdomains for internal tools of course, but those should not even be publicly accessible (behind an auth proxy).
  - tatersolid 1y ago
    Outlook also recently changed the default “report message” action in the UI to be “report phishing/malware” instead of “report spam”. This was a terrible design choice; phishing reports from my org’s own user base has increased 4x since the change which is a lot of false positives. So maybe folks mean to “report spam” on your emails but “report phishing” instead…
    - joaopbnogueira 1y ago
      Could be the reason, but even so, we have really low volume campaigns and mostly to people we actually interact / have a history with. I would assume it would take more than a few accidental hits to trigger this issue.

amanzi 1y ago

Have you looked at the Exchange Online and Defender portals for clues? Especially in the Message Trace section of Exchange Online? I recently helped troubleshoot a similar issue - we were suddenly getting emails disappearing when sending to M365 customers. No spam or quarantine, just disappearing down a black hole like you described. We sent a test message to a M365 customer who could help run the message trace, and we discovered that the SVG logo in our email signature was being flagged as a phishing attack. We had been using this logo for about a year without any issues, but suddenly Microsoft just decided to block it without warning.

joaopbnogueira 1y ago
Yes, I have. Message Trace is an interesting one. If we send an email without the 25friday.com keywords everything works fine, the message is shown on Message trace as delivered and the recipient gets the email with SCL 1 (all good here). As soon as the very same email is appended with a www.25friday.com, Message Trace still shows the outbound email, also as delivered, but the recipient (if a Microsoft account) never gets the email. We used one of these emails (EML) to create a submission on the defender portal of a false positive, but they always simply disappear with 0 feedback (and the problem still occurring). We also had a signature with the www.25friday.com link on it and took it out after realising it was causing emails to go to this black hole, so that at least we can still send emails, but we keep having to be careful to never sending any content (or attachment) that somehow mentions the 25friday.com domain.
- 4ggr0 1y ago
  Are you sure that it's MS who's blocking? Just think it's weird that they show it as delivered to recipient, sounds like they send the mail and something weird happens after.
  - joaopbnogueira 1y ago
    Well, it works fine for every single recipient unless it's a Microsoft one. If the recipient is using a personal microsoft / outlook / hotmail account the email gets delivered with a spam score of 9. If the recipient is a MS 365 account, blackhole it is. We even set up our own MS 365 to prove this.
  - jeroenhd 1y ago
    With excessive spam scores, Microsoft silently ignores your email. Just swallows it up, reports it as delivered, but never actually does, not even in your spam folder. It's possible that this is a technical issue or a submission server issue, but it's not uncommon for Outlook to make email disappear.
    - joaopbnogueira 1y ago
      This sounds like what's happening to us, but only if the dreaded 25friday.com keyword is included on the email content
- amanzi 1y ago
  Sorry, I meant have you looked at the message trace on the recipient's end?