3B7kLDTy

1Issue Definition: Issues when emails tried to be sent from zanariah@rhizophoraventures.com
2As per analysis found that user “Zanariah” was marked as bad outbound sender. So, we have released him from action center.
3
4
5How Office 365 works when email sent by our user is detected as spam:
6When a customer's email system has been compromised by malware or a malicious spam attack, and it is sending outbound spam through Office 365, this can result in the IP addresses of the Office 365 data center servers being listed on third party block lists. In addition the receiving servers (e.g. external domains like yahoo.com, gmail.com, etc.) that use these third party block lists, end up rejecting all email sent from any of the Office 365 IP addresses that have been added to third party block lists. 
7Therefore, all outbound emails sent by Office 365 users which is detected as a spam are delivered through a higher risk delivery IP pool. The higher risk delivery IP pool is a secondary outbound email pool that is used to send messages that may be of low quality, thus helping to protect the rest of the network from sending messages that are more likely to result in the sending IP address being blocked. 
8The use of a dedicated higher risk delivery pool helps ensure that the normal outbound pool is only sending messages that are known to be of a high-quality. The possibility of the higher risk delivery pool being placed on a blocked list remains a risk. This is by design. This secondary IP pool helps to reduce the probability of the normal outbound-IP pool being added to a blocked list.)
9Higher Risk Delivery Pool for Outbound Messages: http://technet.microsoft.com/en-us/library/jj200746(v=exchg.150).aspx
10Possible reasons for this: 
11- It could be content of email, links, signature or any abusive word/phrase listed on third parties spam filter. 
12- Some malware or virus on the system which is adding unwanted links to the email in background that is visible only if email is viewed as html/text. Issue may be specific to system/browser or network specific if it is due to any malware/virus.
13
14What to do next?
15Send those emails to not_junk@office365.microsoft.comso that they are sent as a feedback to Spam analyst team.
16Isolate which part of email got detected as Spam.
17A) Ask sender to send a blank email (nothing in email body but a simple subject) using Outlook Web App and see if email gets rejected. 
18- If blank email goes through then it is the content of email like signature, URL, attachment, images, etc that found to be as spam.
19A.	B) If email sent in above steps is rejected ask the user to send blank email from a different browser/ different machine (preferably from a machine from where other users are able to send emails fine).
20- If sending email from other machine/browser works, it would confirm that the issue is with infected system/browser, etc. and it needs to be scanned for virus/malware affecting emails.
21
22For validating if any URL/link in the emails is blocked, you may proceed as follows:
23•	Check for URLs (hover over them to see if other URL is present)
24For checking URL is blacklisted or not? 
25o	https://admin.uribl.com/?sec-tion=lookup
26o	http://www.surbl.org/surbl-analysis 
27o	http://www.spamhaus.org/lookup/ 
28o	http://dnsbl.invaluement.com/lookup/ 
29https://technet.microsoft.com/en-us/library/dn458545(v=exchg.150).aspx
30•	Images in the emails? Hover over it. Remove it? Check if source is blacklisted, by checking on above websites.
31•	Attachments? Check for links, etc. in it similarly.
32•	Please ensure that we check the source file of the URL
33•	Ensure your domains SPF record is updated in DNS – I found it is updated in your case.
34- To view actual HTML content of email which may contain URLS, etc that are not visible in normal view of email, you may open original sent email in Outlook client (Outlook 2010 or 2013). Right click on it and select > view source.
35
36
37How to get notified about any such outgoing emails that Office 365 detects as Outbound spam?
38You may also configure outbound spam policy to be notified about the Outbound spam email detected by the service: http://technet.microsoft.com/en-us/library/jj200737(v=exchg.150).aspx
39I will now proceed to archive this case as resolved with your permission. However, in case of any queries or concerns or if the issue reoccurs, you can reopen this service request within 14 days through the Microsoft Online Administration Center or by replying to my email.
40Thank you for choosing Microsoft.