M365 email all going to spam - MSFT generated problem.

[curseyoumoriarty]

We have encountered a fun problem. Messages forward from one of our Tenants to another just get dumped as spam.

 

What have we done wrong you may ask? Blocked? Blacklisted, Known spammer.......Well.....

 

The specific error in the headers shows that forwarding from one O365 to another O365 breaks the SPF check.

 

Received-SPF: Fail (protection.outlook.com: domain of xxxxx.org does not designate 40.95.78.85 as permitted sender) receiver=protection.outlook.com;

client-ip=40.95.78.85; helo=GBR01-LO2-obe.outbound.protection.outlook.com;

 

...so it appears that the M365 sending service is using 40.95.78.85 as its address.

 

So what? Well the spf.protection.outlook.com record that we all include in SPF records to white list the MSFT service addresses, currently unrolls (on mxtoolbox.com) to:-

 

40.92.0.0/15 - (40.92.0.0 - 40.93.255.255)

40.107.0.0/16 - (40.107.0.0 - 40.107.255.255)

52.100.0.0/14 - ( 52.100.0.0 - 52.103.255.255)

104.47.0.0/17 - ( 104.47.0.0 - 104.47.127.255)

 

Bottom line, MSFTs own range of valid addresses for SFP does not include the 40.95.78.85 they allocated for our Tenant. Oops.

 

Likely a typo as 40.92.0.0/14 would fix it, but its worth checking your mileage.

 

 

 

Of course mxtoolbox.com may be lying.... and we may be imagining getting everything treated as spam.

[psydii]

There was a lot of spam coming from the 40.92.xxx.xxx servers, probably due to multiple tenant compromises.

 

Possibly related: email from met.police.uk has be dropped into spam for us over the last 24hrs, even emails that were replies to messages originating in our domain... so given other threads here, I would say the email transport team over at Microsoft are having a bad month.

[curseyoumoriarty]

We have passed the specifics of this to MSFT, but the SPF addresses for spf.protection.outlook.com have not changed over night. If you're feeling brave you could add 'ip4:40.92.0.0/14' directly to your SPF record and check for improvements, while we all wait for MSFT to sort themselves out.

 

Interesting idea about tenants getting compromised. That is one of the reasons stated for cloud based exchange being so much better isn't it.

Edited June 16, 2022 by curseyoumoriarty