<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Century Gothic";
panose-1:2 11 5 2 2 2 2 2 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
@font-face
{font-family:"ITC Avant Garde";}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0cm;
font-size:10.0pt;
font-family:"Courier New";}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;}
span.EmailStyle22
{mso-style-type:personal-reply;
font-family:"Arial",sans-serif;
color:blue;
font-weight:normal;
font-style:normal;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-NZ" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:blue;mso-fareast-language:EN-US">Hi Luke/Dave,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:blue;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:blue;mso-fareast-language:EN-US">Happening to 3 (out of 5) tenants I manage too, along with my personal mail that uses outlook.com<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:blue;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:blue;mso-fareast-language:EN-US">Thanks,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:blue;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:blue;mso-fareast-language:EN-US">Bill<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:blue;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:10.0pt;font-family:"Century Gothic",sans-serif;color:#ED7000">Bill Walker</span></b><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial",sans-serif;color:black"> | Manager, Regional Networks
| Stantec | Mobile: +64 21 241 7206<o:p></o:p></span></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:blue;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US">From:</span></b><span lang="EN-US"> AusNOG <ausnog-bounces@lists.ausnog.net>
<b>On Behalf Of </b>David Rawling<br>
<b>Sent:</b> Friday, 31 March 2023 8:10 pm<br>
<b>To:</b> ausnog@lists.ausnog.net<br>
<b>Subject:</b> Re: [AusNOG] Microsoft 365 - Junk Policy (last 2 weeks)<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">Hi Luke<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I can confirm that we've been seeing quite a lot of this across a number of Office 365 tenants; both our own and several we manage (I'll note that I am subscribed to AusNOG from my personal account not the affected tenant).<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">As we're one of the affected tenants, we've been able to dig quite deeply into the behaviour - in our case, it seems to be that almost all "new" messages in a thread are successfully delivered to us, but once it becomes a reply-fest it
gets junked. There's some thought that it could be related to one or more links in our signature - not that it's a particularly large or "spammy" signature, though. No SPF, DMARC or DKIM failures here. No obvious reasons it would be marked junk - the SCL is
below our threshold, etc.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">What's frustrating is that so far, it's only affecting some people in our tenant. I've not had the problem with messages I send and receive, but there are others where it's 90% failure. I do have a different signature file - very different
formatting though it looks the same to the recipient. I was thinking that might be related, but no dice so far.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">So you're not alone but we have absolutely no idea what's breaking.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Dave.<o:p></o:p></p>
</div>
<div>
<pre>-- <o:p></o:p></pre>
<div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D">David Rawling - Principal Consultant<br>
PD Consulting and Security</span><span style="color:#1F497D"><br>
</span><span style="font-size:7.5pt;color:#1F497D"><br>
t: +61 41 213 5513 | e: <a href="mailto:djr@pdconsec.net" title="Click to mail djr@pdconsec.net"><span style="color:#1F497D">djr@pdconsec.net</span></a><br>
<br>
Please note that whilst we take all care, neither PD Consulting and Security nor the sender accepts any responsibility for viruses and it is your responsibility to scan for viruses. The contents are intended only for use by the addressee and may contain confidential
and/or privileged material. If you received this in error, we request that you please inform the sender and/or addressee immediately and delete the material.</span><o:p></o:p></p>
</div>
</div>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">On Fri, 2023-03-31 at 16:55 +1100, Luke Thompson wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #729FCF 1.5pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm">
<div>
<p class="MsoNormal">Hi all,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Strange question though curious if anyone's seen the same.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">We've had a range of clients reporting very intense junking behaviour
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">with M365, whether sending or receiving, if there's a M365 tenant
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">involved it seems to be hitting Junk for reasons that aren't clear. This
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">is with SPF/DKIM/DMARC/etc all passing.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I'm wondering if potentially a new policy has shipped which is
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">over-reaching somewhat, as no bounce-backs are being received so it's a
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">case of delivered-but-not. This is across a range of clients and
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">clients' clients.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">If we'd only heard of this from a single client we'd not think much of
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">it, though this is both ways and across a range of tenants. Would be
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">good to know if there's any substance to it.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">As we don't run M365 nor have responsibility for impacted tenants, the
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">request here is to check with the IT community. Thank you.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Cheers,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Luke<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">_______________________________________________<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">AusNOG mailing list<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><a href="mailto:AusNOG@lists.ausnog.net">AusNOG@lists.ausnog.net</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><a href="https://can01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.ausnog.net%2Fmailman%2Flistinfo%2Fausnog&data=05%7C01%7Cbill.walker2%40stantec.com%7Cfdef8e31187c4e59995108db31b7097a%7C413c6f2c219a469297d3f2b4d80281e7%7C0%7C0%7C638158434434627152%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=94mZYsIgZkwTGu485JjxfKB1qNaQLTHmaQlXCNgXOks%3D&reserved=0">https://lists.ausnog.net/mailman/listinfo/ausnog</a><o:p></o:p></p>
</div>
</blockquote>
<div style="border:solid #635C75 4.5pt;padding:3.0pt 3.0pt 3.0pt 3.0pt" id="”footer”">
<p style="line-height:11.0pt;background:black"><strong><span style="font-family:"ITC Avant Garde";color:white"> Caution:</span></strong><span style="font-family:"ITC Avant Garde";color:white"> This email originated from outside of Stantec. Please take extra
precaution.</span><span style="font-family:"ITC Avant Garde""><o:p></o:p></span></p>
<p style="line-height:11.0pt;background:black"><strong><span style="font-family:"ITC Avant Garde";color:white"> Attention:</span></strong><span style="font-family:"ITC Avant Garde";color:white"> Ce courriel provient de l'extérieur de Stantec. Veuillez prendre
des précautions supplémentaires.</span><span style="font-family:"ITC Avant Garde""><o:p></o:p></span></p>
<p style="line-height:11.0pt;background:black"><strong><span style="font-family:"ITC Avant Garde";color:white"> Atención:
</span></strong><span style="font-family:"ITC Avant Garde";color:white">Este correo electrónico proviene de fuera de Stantec. Por favor, tome precauciones adicionales.</span><span style="font-family:"ITC Avant Garde""><o:p></o:p></span></p>
</div>
</div>
</body>
</html>