# Just started getting Junked by Microsoft

**URL:** <https://forum.dmarcian.com/t/just-started-getting-junked-by-microsoft/2507>\
**Category:** Microsoft 365\
**Created:** [July 15, 2024, 1:42pm UTC](https://forum.dmarcian.com/t/just-started-getting-junked-by-microsoft/2507 "2024-07-15T13:42:43Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![jpederse98](https://avatars.discourse-cdn.com/v4/letter/j/b5ac83/32.png) [@jpederse98](https://forum.dmarcian.com/u/jpederse98)\
**Post date:** [July 15, 2024, 1:42pm UTC](https://forum.dmarcian.com/t/just-started-getting-junked-by-microsoft/2507/1 "2024-07-15T13:42:43Z")

</div>

We’re in the DOD space and have been doing email with trusted customers for years and just last week we started getting our emails into their domains getting put in the Junk folders. Our DMARC, DKIM and SPF look good and has been working for a long time until last week. Does anyone know of any changes that Microsoft may have made last week to tighten their inbound email requirements. The one header retrieved from a customer showed an inbound MS service of [itar.protection.office365.us](http://itar.protection.office365.us) so we expect them to be pretty tight to protect ITAR.

---

<div class="post-metadata">

**Author:** ![Asher](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.dmarcian.com/asher/32/104_2.png) [@Asher](https://forum.dmarcian.com/u/Asher)\
**Post date:** [July 26, 2024, 2:52pm UTC](https://forum.dmarcian.com/t/just-started-getting-junked-by-microsoft/2507/2 "2024-07-26T14:52:32Z")

</div>

Hi John and welcome to the forums.

Microsoft updates are frequent, and most often not divulged to the public. No major change announced on their part lines up with your timeline. Moreover, several technologies could be the culprit here. To name a few:

- Spam heuristics
- Bayesian networks
- Domain reputation
- Connection filters
- Recipient blocklists/custom filters

It might be worthwhile to understand if they are the only recipient with which you are facing this issue, or is it the Microsoft community at large. Microsoft add a fair bit of information in the headers to understand which security module ends up causing a spam verdict, so it may be worthwhile working with the recipient in an attempt to review a sample.

If you are facing issues across all recipients on Microsoft products, it might be best to follow a false positive submission process.

> **[Manage submissions - Microsoft Defender for Office 365](https://learn.microsoft.com/en-us/defender-office-365/submissions-admin)**
>
> Admins can learn how to use the Submissions page in the Microsoft Defender portal to submit messages, URLs, and email attachments to Microsoft for analysis. Reasons for submission include: legitimate messages that were blocked, suspicious messages...

I hope this helps and good luck!