550 5.7.350 Remote server returned message detected as spam ->

[kennysarmy]

This is trying my patience this morning!

 

I run two Microsoft tenancies and I'm trying to forward an email from my address in one (call it domain send  - DS) to address in the other (call it domain receive - DR) 

The email has a weblink in it which is causing spam filter to block the message.

If I remove the weblink the email is delivered.

We use Barracuda Email Protection so all emails flow through their infrastructure.

 

On the DR tenancy I have:

 

Created a mail flow rule, anything from Barracuda IP's, set spam confidence level to "-1"

Created a mail flow rule, anything from DS, set spam confidence level to "-1"

In the Anti-spam inbound default policy I've added the DS domain as an allowed domain

In MS Defender, Tenant Allow/Block Lists,  I've added in the DS domain to the Allow list

 

 

Is there anything else I can do to ensure emails from DS to DR are not blocked by spam checking?

 

Cheers

 

 

[robintech]

does it give any more info for marking it as spam in the headers, defender ignores the SCL I think but your anti-spam default policy should cover that now are you definitely in the default policy group?

[kennysarmy]

20 hours ago, robintech said:

does it give any more info for marking it as spam in the headers, defender ignores the SCL I think but your anti-spam default policy should cover that now are you definitely in the default policy group?

 

Your message to [email protected] couldn't be delivered.
OURDOMAIN.uk suspects your message is spam and rejected it.
ja    Office 365    OURDOMAIN. . .
Sender        Action Required
Messages suspected as spam

How to Fix It
Try to modify your message, or change how you're sending the message, using the guidance in this article: Bulk E-mailing Best Practices for Senders Using Forefront Online Protection for Exchange. Then resend your message.
If you continue to experience the problem, contact the recipient by some other means (by phone, for example) and ask them to ask their email admin to add your email address, or your domain name, to their allowed senders list.

Was this helpful? Send feedback to Microsoft.

More Info for Email Admins
Status code: 550 5.7.350

When Office 365 tried to send the message to the recipient (outside Office 365), the recipient's email server (or email filtering service) suspected the sender's message is spam.

If the sender can't fix the problem by modifying their message, contact the recipient's email admin and ask them to add your domain name, or the sender's email address, to their list of allowed senders.

Although the sender may be able to alter the message contents to fix this issue, it's likely that only the recipient's email admin can fix this problem. Unfortunately, Office 365 Support is unlikely to be able to help fix these kinds of externally reported errors.

Original Message Details
Created Date:    24/09/2025 08:28:13
Sender Address:    ja@SENDDOMAIN
Recipient Address:    [email protected]
Subject:    Fw: Purchasing an Examscreen Access annual licence

Error Details
Error:    550 5.7.350 Remote server returned message detected as spam -> 550 permanent failure for one or more recipients ([email protected]:blocked)
Message rejected by:    mx-inbound13-99.eu-west-2a.ess.aws.cudaops.com

Notification Details
Sent by:    AM7PR10MB3746.EURPRD10.PROD.OUTLOOK.COM

Message Hops
HOP    TIME (UTC)    FROM    TO    WITH    RELAY TIME
1    24/09/2025
08:28:13    PAXPR10MB4964.EURPRD10.PROD.OUTLOOK.COM    PAXPR10MB4964.EURPRD10.PROD.OUTLOOK.COM    mapi    *
2    24/09/2025
08:28:13    PAXPR10MB4964.EURPRD10.PROD.OUTLOOK.COM    AM7PR10MB3746.EURPRD10.PROD.OUTLOOK.COM    Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384)    *
Original Message Headers

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;
 b=jaXC1dgnjW1wxiXOfrZr105MwlvlInAzqALNnEX08VdLd3MkRDzw4V8CgnUzGLDHDjo9l3dEtlETakw1sdqCXzFkzxTDL6ayJaUQbzg/ZxTyka5j+xHbk112yhfJvcbDfAxqn8MTQqGdqteJ5WphutQhVTS4k9Mw/PsqNmdSiPAm/cH/g/gh8KY4KARR9+XUL4MgimAsXZqsmZFnnmNuRpEsBxyJovu212GijQqfi/0eDiUzv+bOYQqrv+GE/r88AdlP6hSdhXOml3t0pKzk1kXmj651u9bpBuz7Z4p+cZwKEHo3CJsQ4WogbG7i0iG1iL+jfzMsmH6Uf6RqInIusA==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
 s=arcselector10001;
 h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
 bh=TMYyHCvzHJu15GlP8IagoNXT7ukx9UmePVOcWNGnwn0=;
 b=ol17pYU9VmDkVtlM47tMwcn3WenSDa70b9xtDUGDlkEQ+l56la/fYwN7w9rIGZOSEhpFb3aKuGt9J7w+utFQokjA3OJwnKlqESqn9XyzVvS2EwhwpWM/DwVQhwlVZ7CDKuzw810DYhNSgITmW5jUVVovOodjOi/FozyzsGSZmqs7E6+/J0/Z09uP7YtwUVvpx1QR70DAOb/7hdF2LVMRaan7fHhBaOMDyMyIhn5NOsjMu5Nd13Rhq8lKTbjdOwJsq5UYp2ZyTezaIc3mXnefa/HUvWEcmPP6VGsPP1x/DmENhXozrfT7o1i6UW48ABV2RW/4Yvd36n0GXcQQo3MwRg==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass
 smtp.mailfrom=SENDDOMAIN; dmarc=pass action=none
 header.from=SENDDOMAIN; dkim=pass header.d=SENDDOMAIN; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=SENDDOMAIN;
 s=selector1;
 h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
 bh=TMYyHCvzHJu15GlP8IagoNXT7ukx9UmePVOcWNGnwn0=;
 b=TQt7+HXKVon+i3yRXNoEYdEcOlv8NIsKKx03+7fSNOpCxqpCNJFkpFHWh+yRYmJLt7U63j+CXC7xkiGEswucRnW9oX4SasJE54BzaFp0IWa9Xb/A0SWGLKEoxpYtnSjSPRTXQ1okNeIYma8fPhw8JjxMfsC5k+lFEiz5ZptJgqpFsxfHd1S3I6QuZXvq1zWx9q1CrJu/Xf8tzV1USbo70+uDaRcwHFfJmIw/pef6ZyXLeKkB5YFhZuAxZ5mzZf0xhb+ZFbYDT9xelhTHh6QR3AUhUAbSmQFJpt3PjReiE8p4HmAGQVpLWj885WF6OMwotr95lXlEslowan5f2N4Meg==
Received: from PAXPR10MB4964.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:102:206::16)
 by AM7PR10MB3746.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:20b:172::23) with
 Microsoft SMTP Server (version=TLS1_2,
 cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9160.9; Wed, 24 Sep
 2025 08:28:13 +0000
Received: from PAXPR10MB4964.EURPRD10.PROD.OUTLOOK.COM
 ([fe80::cc7:3dd1:2b39:2d7e]) by PAXPR10MB4964.EURPRD10.PROD.OUTLOOK.COM
 ([fe80::cc7:3dd1:2b39:2d7e%4]) with mapi id 15.20.9160.008; Wed, 24 Sep 2025
 08:28:13 +0000
From: Jeff Arris <ja@SENDDOMAIN>
To: Finance Bursar <[email protected]>
Subject: Fw: Purchasing an Examscreen Access annual licence
Thread-Topic: Purchasing an Examscreen Access annual licence
Thread-Index: AdwskvezUo2ZWvKEQPa3o+ESI7FPKgAkXolnAAIncBo=
Date: Wed, 24 Sep 2025 08:28:13 +0000
Message-ID: <PAXPR10MB4964AE912ABF281FCE7735F9CF1CA@PAXPR10MB4964.EURPRD10.PROD.OUTLOOK.COM>
References: <DB8PR10MB338739F06177D8716BECF82BBA1DA@DB8PR10MB3387.EURPRD10.PROD.OUTLOOK.COM>
 <PAXPR10MB496462543A66FD6758C51126CF1CA@PAXPR10MB4964.EURPRD10.PROD.OUTLOOK.COM>
In-Reply-To: <PAXPR10MB496462543A66FD6758C51126CF1CA@PAXPR10MB4964.EURPRD10.PROD.OUTLOOK.COM>
Accept-Language: en-GB, en-US
Content-Language: en-GB
X-MS-Has-Attach: yes
X-MS-TNEF-Correlator:
msip_labels:
authentication-results: dkim=none (message not signed)
 header.d=none;dmarc=none action=none header.from=SENDDOMAIN;
x-ms-publictraffictype: Email
x-ms-traffictypediagnostic: PAXPR10MB4964:EE_|AM7PR10MB3746:EE_
x-ms-office365-filtering-correlation-id: edc40ec0-6277-4de6-bcd8-08ddfb444dab
x-ms-exchange-senderadcheck: 1
x-ms-exchange-antispam-relay: 0
x-microsoft-antispam: BCL:0;ARA:13230040|376014|41320700013|366016|1800799024|4053099003|4013099003|13003099007|38070700021|8096899003|7053199007;
x-microsoft-antispam-message-info: =?utf-8?B?N1JyeDJDOHMyTjJxT3pTOU5vNUZUTFE3Ulh4QnlQaHBKVHVTUlRDUE9GZ3BY?=
 =?utf-8?B?bERQT0xqUnd2THJSREplSlhLQnU2VmdDVW5xNitNekNLdHNDUTJjNW1FVkY3?=
 =?utf-8?B?ZGRUclN1VHRCOFc3MjEvYTVKUkdYNEYrU05HbmYrZDhIUmJ3ejgzUUkxSmFB?=
 =?utf-8?B?RXpCZW00cUVSaWJxMitXSlVLeXlIRURienQxN0lrN2w2NW1DMkVYRVJ1ampB?=
 =?utf-8?B?dDQrTEp3cGdVRHo0L3dpK3ErWG9jSUVnV00rY3U5c3FMZlF5RTdwVzUvWlp1?=
 =?utf-8?B?YURWRXJGZlV0VFB3MVE1aDlVNjlwaWNZaU5vTmtXaVc1azVVRGFETVkycjhE?=
 =?utf-8?B?YlFXNGh4anNMUDZ5UTRJUjg5QWt2VEV6RHVlZU1QS0xheVV1OXRZUnNyT0dK?=
 =?utf-8?B?cUorUndRWEZ2cEY1eTdSS0VnRVI0MFpvcW1xeEkxZEVzcEtzRnBDUFlWOTFF?=
 =?utf-8?B?aVJBbFJuUTdycTMwb3hYRDFFVFZDMURXZXg1dzErbUpNckxULzlYejhNZjUx?=
 =?utf-8?B?UTN2S3daQWl5WStnZFpUSjYzcFpMeFJ5R013VkhMNGZ2WEdDYlplbFlaWDdn?=
 =?utf-8?B?ZTVoVzAveGtIbmcvN3l3Qm1talBvSXJFenpybTB0Nzh6a1MvM1ZVZHVwNEJ5?=
 =?utf-8?B?bHEvZmJBRldHRlJTRjFUVDNyNW9BT1U3MW9JcXN6WHljR2dJL3NDS05RYnp2?=
 =?utf-8?B?UGFBYURweW9kSmZkS2JWbURsUUVPUjNHOXo1cWpoYitVMDdOWUF1SHJHeE9m?=
 =?utf-8?B?K1g1enEzQWRnNzFEZjVuaVYxcGdlVU9VMGpPemtiTC9HbW5hR3U3b2syc2Jl?=
 =?utf-8?B?SFFtV21ZWnJxUlZlYXRIbmx2NU12bS9UZW4xczdBOENGWE1sVXNpOVJHM3lU?=
 =?utf-8?B?YUtwWURpajVxcWVOcGdiUU54TlMvMkgxYjVOR0lHa3BkSC9hR2xjaWdaL3Rx?=
 =?utf-8?B?TS82bGtOZU1mckhXVGMzZ0xLcER0R3VhcUg3WElzc1dRWVhGSC9pT2FuL051?=
 =?utf-8?B?MGZHWHRSODl2NEVjQUNJb0d6UmNBNHZoUUVQUy9jeXQ0WU96d1M5bUpZZTJz?=
 =?utf-8?B?M0poTjhxd25NTml3WWJQZVR1ZngvYzA1UE9nalNIeG1wbFhWS0x2eTZqNlRm?=
 =?utf-8?B?N2hVM2xUc1JHbTUreWQ0RzZNWTllei9EMUVMcXVjREc1a0d2R1JreGJQWGRv?=
 =?utf-8?B?NVZHemVvMFpaK0NiM3Y2cGVqUnhneitHWXVDQXVvMFVpclZ6Yzc0VUh2WDE3?=
 =?utf-8?B?SisvYXM4RE9Fd2JOdnkzSmwrMmVXWTdMb1VUTkIxdVlua25EaXRBcVQxUUQz?=
 =?utf-8?B?Z0QrWjRLL1FiWnZMUDVIaHlhL054Q3lOUUxGbXpObU1tZ3VDOTYzRU9ZemVn?=
 =?utf-8?B?WmZMOHJ4RkJFT3Q5OWtBYlRNMXpOeU4wamxHam5wa2ZoRGswUk1VVXlZV2pp?=
 =?utf-8?B?aDBIUEl0dUQ4Y3pESTBNc2EwYkx2ckZkQlZEcmpqSTZNTGR1L3BldTJ0UHlM?=
 =?utf-8?B?MmJBVFdrcTJLMy9IcmVnVzRsYTV5WVd6T3F6OWpjZkRteXRVNk42cDlndUdW?=
 =?utf-8?B?Y1ZkYTBNNUJVUWcyZENmdmJ0SWNQcGt4anlRdE1GQm1DU0gveUNHVWhVeGpS?=
 =?utf-8?B?QUd3VTR4U0U3RXpBWFNxbHhpc0JHd0JFeC9meUhWOEZYZkZ5VEJrZnZ6L3VC?=
 =?utf-8?B?RW9lbWhza3FheGlyNmxVSnM2VVV1NWdqbHlCcHIyamhXSXBsME5yWWlaTXRX?=
 =?utf-8?B?VVA1SmxTdUZoZ0E2K3JUZFpmUnZ2WDJERjNsdEFXZ1k3cGxHcWh4SWc1ek1L?=
 =?utf-8?B?YW5UYmZHT2NnNTRod0VjZTlWd3N4RDJJaHJCNVg5aVR1UzZzdFJCZ1JxQmtu?=
 =?utf-8?B?UXR1N0NGNy93TE5wSEVoSkRQY0FEV0RLb2FkVHVYa3IzUEwxR0orWFBZbWRK?=
 =?utf-8?Q?ZImgwRFipkQ=3D?=
x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:PAXPR10MB4964.EURPRD10.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(376014)(41320700013)(366016)(1800799024)(4053099003)(4013099003)(13003099007)(38070700021)(8096899003)(7053199007);DIR:OUT;SFP:1102;
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: =?utf-8?B?R05tWWIzdWIxUEtwdm5DMnBJWk5TYlVZK25PbzRsT2JiTkhXR3RHdWdpckw1?=
 =?utf-8?B?dFRqa0lBOWZ6MlN4eS9ESkMyZjcwcEJvOWlpU0ZkbEpKSmhJbGtiU1VkVVNv?=
 =?utf-8?B?eTIxUysxL3lVVmJVUzFWNDZCYTlTczRwejZaNnlNZVQwdXB0L3pwWnIxQ09t?=
 =?utf-8?B?YUcvU3IySjNGU2drZlpZMkdHaDE4Y01Rd2svUG9GenhCdFdFc3BPVjZWOVE4?=
 =?utf-8?B?enZHMzZsWTZPNUxZZithZ0F3Z1lSMndrcTlxN2RYYmV5TkNjM0hlN3hwMmFG?=
 =?utf-8?B?SWphNmVaeEF2QUFrN3krSFoxQXdueUV2bWw1NkFMSzVHQW9mUzlvY0lTTkxV?=
 =?utf-8?B?VXhaWWE4bWlxdFdMVW1KS0pUR0JUZHhnajlNc202V2hyUWIwdUVYMWtsZXRP?=
 =?utf-8?B?NEhaM2gxRERwSlpqbWliRlo1NWdmdGhPTXRWNXFyWnowQjU4MHFZaE05WUNS?=
 =?utf-8?B?azd2SWYxZXd6T1d6OUQvNVFQbEFuZmN0d2JwQWpOanAxeGMyR1hNMFhBMEFT?=
 =?utf-8?B?eHUwY01vbzVwRDRpNC9jV2xDb05qejlFdFIvQUpVbTBTK1VDUzdLaTRINWM1?=
 =?utf-8?B?YzA3M2FLMVdJeFcyWkdscWxnOVVRTXVFdE5aNTdOMWM5NjFFZUVNYjVyY0FH?=
 =?utf-8?B?YXM1YWRLV3d4bHRRUWN4SlVXVXdxSmpFSlJXQzh5cVBUYXRIS2IwalIvZzc3?=
 =?utf-8?B?dmdtUkl3M2p3andVbmhKUGhROEFEckh3aDJ4QXErRXljSHI4RDFiOFNCT0dw?=
 =?utf-8?B?c29FNFhUck5IQUN2KzZWYjh3U3FWdno5OW56YTZoY29nd0dnQU9uZVZJVHUy?=
 =?utf-8?B?T28wOW0zRFREaXErS0dDanhtVHpvNmlaN0tGdUVQRUtwdjRKbDZrZnNibENR?=
 =?utf-8?B?ZnJQNWYyU25BOTY0dHlOV2t2Zk5jcWo4WFNMeS9wcGNsQ055WTVqQlRmbjVV?=
 =?utf-8?B?ZEI0V1V2T3BRQkptRjR4RUhTY2tQOG9CemxTRGtMTllzTTZvd0FrTzQ3Zkow?=
 =?utf-8?B?UjN1Wnp5SXRUd3BHaVdnNGVYbnQ0a0VFaVA0bkdlVHFZcUsrTkNJMzdMZDRT?=
 =?utf-8?B?L2xZWWtBdlh3QWMvUEMxVENqUVVLZTh1WWlKdC8xSGFVdVYxN0NLWGJpZVVu?=
 =?utf-8?B?bUh2WjdlOXZmeXZON3hBUjdzNHM0akxEay9ZOUtmRFA0OWdNU2k3UlZsMWJv?=
 =?utf-8?B?WUY0OTN5VFFEek9CV1ZrOE9PdXdkTUpPNlF1cEZCTitHa3hPa2dTdi9iUG9o?=
 =?utf-8?B?YjhwUzVHQkZXRUhvQWJzMGMrL1htTjRZN1hPVTV1dm9JN0ZSWEpLWFV4NUhL?=
 =?utf-8?B?VStENDdVb1VZUXdFaUtZVGhaNDhWV0QyU2laZXl5c2czcjkyeDZuWmlRc0Rz?=
 =?utf-8?B?V2hUcjVHUkkzemR2dmp2UGdIM3RLckxiTHFnUjJvK2lXN0dHdXVoQTJhUWM1?=
 =?utf-8?B?eGtJemVCZkorR0ptVFN1MVlUMWNQd0xENXNCK0g5dk5xQXBIM3JyNTZXblNr?=
 =?utf-8?B?aWczU2o1ZWlGQU1BOEx6aGYwQXVGdVhhUHRrVEVORWh3d0FJTmxoT3B1RlMr?=
 =?utf-8?B?eVNBYkR2elcrNDBOc2JvRHBJZnpZc3AybFZmWTAxL1FDNHI5UGFkUDlHNmp4?=
 =?utf-8?B?L3FkdFdacU83L3pwbWJSazJwTnZ1RW0zeUIvdzk4MTZOMkRpQTFGYzQ0MDBW?=
 =?utf-8?B?YzV4cGRwU0NwZG90SExnU1BBb0lMcnZTajJtNXFqdlhpRXdNQk82WGpuYkhy?=
 =?utf-8?B?QzRGNGNxeEhqUmdPWWIzTkpXZ0kvWWk0aU1tb1NWNytlSjFhSXRVVXRjN1pr?=
 =?utf-8?B?dzZnaVoxU242My9EMEtZbUZycjUvZS9ITkRFUFBnckl5WUZrMWJlcGQ3bXRU?=
 =?utf-8?B?NUZGS01OckhQd1A0enhnV3Z1L2xnUmRzR3VsNDhmNktRcVdTV0dQc3JnUmJn?=
 =?utf-8?B?MUVTdi80dHhEUDFQWHlXTFRROGpwaURWMjhHLzZhZFZzRmRGTHpSYkxCY0Nr?=
 =?utf-8?B?dzVINHNHNjBUK01DOVMzT3RoK3FzN1BwSndMdEVhYjdKVEdFWktGNE1TbXFU?=
 =?utf-8?B?MTY4TnNuKzk5bjNRN3JnczVOcTRJNHgxdWpFeTFSUE0xdndYQlV5V0lvQTRm?=
 =?utf-8?Q?eDpNUfHRp8WXiMT+yvKpRAeB9?=
Content-Type: multipart/related;
    boundary="_004_PAXPR10MB4964AE912ABF281FCE7735F9CF1CAPAXPR10MB4964EURP_";
    type="multipart/alternative"
MIME-Version: 1.0
X-OriginatorOrg: SENDDOMAIN
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: PAXPR10MB4964.EURPRD10.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-Network-Message-Id: edc40ec0-6277-4de6-bcd8-08ddfb444dab
X-MS-Exchange-CrossTenant-originalarrivaltime: 24 Sep 2025 08:28:13.5699
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: b9799414-9c3f-4471-ae22-951e48f5791a
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: q9kJTFM5eFO9rG0wlH7Sow+ch2/BVlZVJZ7T15RwLOydSPe4OH7O2IzkWS+uZ8K/GCuTLRzVHDtpnBr1Mia5BA==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM7PR10MB3746

[kennysarmy]

Digging deeper in our Baraccuda Email protection I find this 😕

 

Message was blocked due to Barracuda Real-Time System (BRTS) (examscreenextra.co.uk)

[robintech]

Error:    550 5.7.350 Remote server returned message detected as spam -> 550 permanent failure for one or more recipients ([email protected]:blocked)
Message rejected by:    mx-inbound13-99.eu-west-2a.ess.aws.cudaops.com

 

if you put the full headers in here https://mha.azurewebsites.net/  it should break it down but looks like Barracuda are rejecting it?

Might be related to the act of forwarding and that breaking the DKIM signature in the original message, does it work sending direct from one domain to another.

 

 

 

[robintech]

3 minutes ago, kennysarmy said:

Digging deeper in our Baraccuda Email protection I find this 😕

 

Message was blocked due to Barracuda Real-Time System (BRTS) (examscreenextra.co.uk)

 oh yeah that would make sense