<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Hi all,</p>
<p>Thanks for the consensus here, it's good to know we're not alone.
It seems the impact is being realised by more people into this
week. </p>
<p>We've now had clients in the health space flag this - they want
links to official alerts acknowledging the issue at Microsoft's
end.</p>
<p>It doesn't seem Microsoft have done so as yet. I've BCC'd a
contact from Microsoft (from mailop) to see if they write back.</p>
<p>Hopefully the rulesets(?) are rolled back or modified so the
impact abates. It's becoming quite a noisy issue now.</p>
<p>Cheers,<br>
Luke<br>
</p>
<div class="moz-cite-prefix">On 3/4/2023 9:44 am, Walker, Bill
(Christchurch) wrote:<br>
</div>
<blockquote type="cite"
cite="mid:BY3PR06MB81470ADDF108A24BCFAAC2A6DE8D9@BY3PR06MB8147.namprd06.prod.outlook.com">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<meta name="Generator" content="Microsoft Word 15 (filtered
medium)">
<style>@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}@font-face
{font-family:"Century Gothic";
panose-1:2 11 5 2 2 2 2 2 2 4;}@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}@font-face
{font-family:"ITC Avant Garde";}p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0cm;
font-size:10.0pt;
font-family:"Courier New";}span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;}span.EmailStyle22
{mso-style-type:personal-reply;
font-family:"Arial",sans-serif;
color:blue;
font-weight:normal;
font-style:normal;}.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}div.WordSection1
{page:WordSection1;}</style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div class="WordSection1">
<p class="MsoNormal"><span
style="font-size:10.0pt;font-family:"Arial",sans-serif;color:blue;mso-fareast-language:EN-US">Hi
Luke/Dave,<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:10.0pt;font-family:"Arial",sans-serif;color:blue;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span
style="font-size:10.0pt;font-family:"Arial",sans-serif;color:blue;mso-fareast-language:EN-US">Happening
to 3 (out of 5) tenants I manage too, along with my personal
mail that uses outlook.com<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:10.0pt;font-family:"Arial",sans-serif;color:blue;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span
style="font-size:10.0pt;font-family:"Arial",sans-serif;color:blue;mso-fareast-language:EN-US">Thanks,<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:10.0pt;font-family:"Arial",sans-serif;color:blue;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span
style="font-size:10.0pt;font-family:"Arial",sans-serif;color:blue;mso-fareast-language:EN-US">Bill<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:10.0pt;font-family:"Arial",sans-serif;color:blue;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal"><b><span
style="font-size:10.0pt;font-family:"Century
Gothic",sans-serif;color:#ED7000"
lang="EN-US">Bill Walker</span></b><span
style="font-size:10.0pt;font-family:"Arial",sans-serif;color:black"
lang="EN-US"> | Manager, Regional Networks
| Stantec | Mobile: +64 21 241 7206<o:p></o:p></span></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<p class="MsoNormal"><span
style="font-size:10.0pt;font-family:"Arial",sans-serif;color:blue;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1
1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US">From:</span></b><span
lang="EN-US"> AusNOG
<a class="moz-txt-link-rfc2396E" href="mailto:ausnog-bounces@lists.ausnog.net"><ausnog-bounces@lists.ausnog.net></a>
<b>On Behalf Of </b>David Rawling<br>
<b>Sent:</b> Friday, 31 March 2023 8:10 pm<br>
<b>To:</b> <a class="moz-txt-link-abbreviated" href="mailto:ausnog@lists.ausnog.net">ausnog@lists.ausnog.net</a><br>
<b>Subject:</b> Re: [AusNOG] Microsoft 365 - Junk Policy
(last 2 weeks)<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">Hi Luke<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I can confirm that we've been seeing
quite a lot of this across a number of Office 365 tenants;
both our own and several we manage (I'll note that I am
subscribed to AusNOG from my personal account not the
affected tenant).<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">As we're one of the affected tenants,
we've been able to dig quite deeply into the behaviour - in
our case, it seems to be that almost all "new" messages in a
thread are successfully delivered to us, but once it becomes
a reply-fest it gets junked. There's some thought that it
could be related to one or more links in our signature - not
that it's a particularly large or "spammy" signature,
though. No SPF, DMARC or DKIM failures here. No obvious
reasons it would be marked junk - the SCL is below our
threshold, etc.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">What's frustrating is that so far, it's
only affecting some people in our tenant. I've not had the
problem with messages I send and receive, but there are
others where it's 90% failure. I do have a different
signature file - very different formatting though it looks
the same to the recipient. I was thinking that might be
related, but no dice so far.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">So you're not alone but we have
absolutely no idea what's breaking.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Dave.<o:p></o:p></p>
</div>
<div>
<pre>-- <o:p></o:p></pre>
<div>
<div>
<p class="MsoNormal"><span
style="font-size:10.0pt;color:#1F497D">David Rawling -
Principal Consultant<br>
PD Consulting and Security</span><span
style="color:#1F497D"><br>
</span><span style="font-size:7.5pt;color:#1F497D"><br>
t: +61 41 213 5513 | e: <a
href="mailto:djr@pdconsec.net" title="Click to mail
djr@pdconsec.net" moz-do-not-send="true"><span
style="color:#1F497D">djr@pdconsec.net</span></a><br>
<br>
Please note that whilst we take all care, neither PD
Consulting and Security nor the sender accepts any
responsibility for viruses and it is your
responsibility to scan for viruses. The contents are
intended only for use by the addressee and may contain
confidential and/or privileged material. If you
received this in error, we request that you please
inform the sender and/or addressee immediately and
delete the material.</span><o:p></o:p></p>
</div>
</div>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">On Fri, 2023-03-31 at 16:55 +1100, Luke
Thompson wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #729FCF
1.5pt;padding:0cm 0cm 0cm
6.0pt;margin-left:4.8pt;margin-right:0cm">
<div>
<p class="MsoNormal">Hi all,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Strange question though curious if
anyone's seen the same.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">We've had a range of clients reporting
very intense junking behaviour
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">with M365, whether sending or
receiving, if there's a M365 tenant
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">involved it seems to be hitting Junk
for reasons that aren't clear. This
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">is with SPF/DKIM/DMARC/etc all passing.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I'm wondering if potentially a new
policy has shipped which is
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">over-reaching somewhat, as no
bounce-backs are being received so it's a
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">case of delivered-but-not. This is
across a range of clients and
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">clients' clients.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">If we'd only heard of this from a
single client we'd not think much of
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">it, though this is both ways and across
a range of tenants. Would be
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">good to know if there's any substance
to it.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">As we don't run M365 nor have
responsibility for impacted tenants, the
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">request here is to check with the IT
community. Thank you.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Cheers,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Luke<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">_______________________________________________<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">AusNOG mailing list<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><a
href="mailto:AusNOG@lists.ausnog.net"
moz-do-not-send="true" class="moz-txt-link-freetext">AusNOG@lists.ausnog.net</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><a
href="https://can01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.ausnog.net%2Fmailman%2Flistinfo%2Fausnog&data=05%7C01%7Cbill.walker2%40stantec.com%7Cfdef8e31187c4e59995108db31b7097a%7C413c6f2c219a469297d3f2b4d80281e7%7C0%7C0%7C638158434434627152%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=94mZYsIgZkwTGu485JjxfKB1qNaQLTHmaQlXCNgXOks%3D&reserved=0"
moz-do-not-send="true">https://lists.ausnog.net/mailman/listinfo/ausnog</a><o:p></o:p></p>
</div>
</blockquote>
<div style="border:solid #635C75 4.5pt;padding:3.0pt 3.0pt 3.0pt
3.0pt" id="”footer”">
<p style="line-height:11.0pt;background:black"><strong><span
style="font-family:"ITC Avant
Garde";color:white"> Caution:</span></strong><span
style="font-family:"ITC Avant
Garde";color:white"> This email originated from
outside of Stantec. Please take extra precaution.</span><span
style="font-family:"ITC Avant Garde""><o:p></o:p></span></p>
<p style="line-height:11.0pt;background:black"><strong><span
style="font-family:"ITC Avant
Garde";color:white"> Attention:</span></strong><span
style="font-family:"ITC Avant
Garde";color:white"> Ce courriel provient de
l'extérieur de Stantec. Veuillez prendre des précautions
supplémentaires.</span><span style="font-family:"ITC
Avant Garde""><o:p></o:p></span></p>
<p style="line-height:11.0pt;background:black"><strong><span
style="font-family:"ITC Avant
Garde";color:white"> Atención:
</span></strong><span style="font-family:"ITC Avant
Garde";color:white">Este correo electrónico proviene
de fuera de Stantec. Por favor, tome precauciones
adicionales.</span><span style="font-family:"ITC
Avant Garde""><o:p></o:p></span></p>
</div>
</div>
<br>
<fieldset class="moz-mime-attachment-header"></fieldset>
<pre class="moz-quote-pre" wrap="">_______________________________________________
AusNOG mailing list
<a class="moz-txt-link-abbreviated" href="mailto:AusNOG@lists.ausnog.net">AusNOG@lists.ausnog.net</a>
<a class="moz-txt-link-freetext" href="https://lists.ausnog.net/mailman/listinfo/ausnog">https://lists.ausnog.net/mailman/listinfo/ausnog</a>
</pre>
</blockquote>
</body>
</html>