Domain incorrectly flagged as phishing domain causing no emails to be received

For anyone finding this thread through Google: We were able to resolve this issue yesterday, 12 days after the incident started.

Our service provider was able to get a hold of somebody senior in Microsoft support that pulled some strings. After this, the issue was accepted by Microsoft support within 30 minutes, and the issue was confirmed solved after 4 hours.

I have no insight into how they managed to get in touch with Microsoft support though the back channels, but I suspect personal relationships was used. I don't know how we would solve this issue without.

The issue turned out a lot worse than first thought. As our domain was on a global list of phishing domains, this was the impact:

• Every email we sent was quarantined at the receiving end of the receiver had Office365. Not because of the from address, but because we had our domain written in our email signature. We were in no way notified of this, and it took some time to realize this was happening, and that every user was affected. Removing any mention of our domain name from the signature was a temporary workaround.
• But this issue was not only for us. Any email sent, from anybody in the world, that contained our domain name, was quarantined without the sender or receiver being notified, if the receiver had Office365.
• We realized this also impacted a lot of automatic emails that randomly contained our domain name in the email body or subject, including our invoicing system, payslips, travel expenses, metabase reports, github integrations and so much more. Truly a business critical issue.

For anyone stuck in the same situation, I would:

1. File a support ticket, and start using your Microsoft network to get attention on the issue. If you are unlucky like us, we had 4 tickets, over 10 days, just being closed with no reason given.
2. Figure out what triggers the quarantine. Is it the domain name, like for us?
3. Start mapping our what systems you have that might be affected and see if you can remove the trigger-word. I guess email signature is an obvious one, but remember every other auto-email you may have.
4. Whitelist the trigger word for incoming emails. This should resolve people emailing you. (and replying to your with your signature in the original email under the reply)
5. Create lists of emails that have been sent that may have been blocked at the receiving end and work with the users to resend these emails without the trigger word. Our service provider did this for us, so I can't tell you the exact steps taken to produce these lists.
6. Hope that your ticket gets acknowledged by Microsoft and resolved.

Tagging this post with Phishing, MDO, blacklist.

Thank you. Email was sent, but wanted to confirm receipt since our issue revolves around emails being quarantined.

Were you able to resolve your issue? It's been 2 weeks for me trying to figure out how to get my domain off a phish list that is causing all mail sent from my domain (or mail with my domain in it) to be sent to Quarantine for "High Confidence Phish". Extremely frustrating, as it's affecting a lot of my customers.

Thanks for posting this.

We are day 6 of the same issue now. We are hitting up any and all Microsoft contacts.

As far as I have understood, phishing and spam is treated differently in O365.

Spam looks at dmarc and the usual stuff and will block your domain.

Phishing on the other hand, will not care about the domain you are sending to or from. I believe it is part of the safelinks framework (at least that's my theory). So it only cares if there is a link in the body of your email to a malicious domain.

Meaning; we could send and receive emails if our domain was not mentioned in the email. (even when sending from the domain in question)

But it also means that anybody in the world using O365 would get their email stopped if they mentioned our domain in the email.

🤷‍♂️ Go figure. Glad we're out of the woods. For now.

You can try the Delist portal as mentioned here. https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/use-the-delist-portal-to-remove-yourself-from-the-office-365-blocked-senders-lis?view=o365-worldwide

Be aware, these are automated systems and there's no one to call and no email address to send to.

Couple things that you can try outside the Delist portal:

1. Change the IP for your email server
2. Change your domain

Either of those sometimes solves the issue.