Ask HN: Is there hope for Microsoft 365 support?

The company I work for (25friday.com) has been hit with what seems to be a keyword blacklist on Microsoft 365 email.

In short, if we send out any email to clients using Microsoft 365 as their email provider containing the textual content "25friday.com" anywhere on the email subject, body or readable attachment (e.g. pdf) the emails fall on a "blackhole" and are neither bounced nor reaching the recipient (they are not in spam or quarantine either).

As you might imagine this is a huge problem for us as email is our primary means of communication with our clients and we need to be careful to never include any mention of our domain in any email we send to them.

For recipients using personal Outlook emails, the emails are received and sent to spam with a spam score of 9 (maximum score).

We've reached Microsoft support and they seem as clueless as we are. They have no idea why this is happening and they are unable to provide any information or progress on the ongoing issue. This has been going on for about a month now.

A few things we have tried:

- We have checked our SPF, DKIM, and DMARC records and they are all set up correctly and passing.

- We have checked our email sending reputation and it is good as far as we can tell.

- We have tried sending emails from different email addresses and domains, but the issue persists.

- We have setup our own Microsoft 365 account to be able to submit false-positive reports on the security portal, but the submissions disappear into the void and we never receive any feedback.

- We have tried some deliverability testing tools and they all report that our emails are being blocked by Microsoft 365, but not by any other email providers.

- We are not on any known/public blacklists

Note that we are using Google Workspaces, but that does not seem to be the issue. The domain itself has been live since 2018 (since the company was founded) and we have never had any issues with email deliverability before. We don't send spam or unsolicited emails. The closest I could think of is a mailing list we have with about 300 subscribers containing mostly client emails but also some emails of people we invite to our events. We send out an approximately monthly newsletter to this list, but we have never had any complaints or issues with it before (we're using Pipedrive for that).

Tangential but I believe that it might be related: if I set my website address as 25friday.com on my LinkedIn profile, the link gets overwritten to a LinkedIn error page. My guess is that since LinkedIn is owned by Microsoft, they are sharing the same blacklist.

Any tips would be greatly appreciated. We're really affected by this and without any recourse to escalate this issue.

We had this happen to one of our apps which redirected to a third-party identity provider which used a different domain name. Basically the app looked like a phishing site to those who clicked on the email links and ended up on a login page on a domain they didn’t recognize. So these users reported the email as phishing in outlook. Microsoft confirmed these user reports were the source of the blocking.

The fix was our own MSFT support case opened via our own E5 subscription which took two weeks to get the app unblocked. To prevent future reports we put a custom hostname on the IdP. So app.example.com now redirects to login.app.example.com

MS are notorious for blacklisting IP ranges from providers like Linode, which makes it impossible for a small biz to run its own commercial system.

I'm not surprised they also keyword block, because Outlook flags Microsoft's own marketing messages as spam.

There really needs to be some kind of global Digital Bill of Rights which provides legal recourse from these giant sclerotic algo-run oligopolies.

MS, Meta, Amazon, YouTube and Apple all have policies that can nuke SMEs on a whim without consequences, often without even noticing, after their algorithms make a wrong decision about imaginary "abuse".

Yeah, this is kind of the point. I'm not sure there's even a legal process for this as this is entirely under MS (opaque) internal control and we're not even based on the US.

Outlook also recently changed the default “report message” action in the UI to be “report phishing/malware” instead of “report spam”. This was a terrible design choice; phishing reports from my org’s own user base has increased 4x since the change which is a lot of false positives.

So maybe folks mean to “report spam” on your emails but “report phishing” instead…