Microsoft Service Incident: Message rejections when sending to third party spam services
Incident Report for Zix | AppRiver
Resolved
Final status: We've confirmed after extensive monitoring that our work to unblock affected IP addresses has successfully reduced the rate of impacted mail flow to pre-incident thresholds, mitigating impact for users.

Scope of impact: This issue may have affected any user's mail flow if the recipient was leveraging a specific third-party antispam service to filter email messages.

Start time: Wednesday, December 24, 2025 at 6:00 PM CST

End time: Monday, February 5, 2024 at 4:13 PM CST

Preliminary root cause: Outbound spam associated with some Microsoft IP addresses was causing all mail from these addresses to be blocked by a specific third-party antispam service.

Next steps:
- We're exploring monitoring optimizations so we can more quickly identify and work to delist blocked IPs should similar future events occur.
Posted Feb 06, 2024 - 07:06 CST
Update
Current status: Our monitoring telemetry continues to indicate a positive trajectory, signaling relief for many users. As previously mentioned, efforts are ongoing to explore additional rule optimizations so we can ensure that impact for residually affected users is effectively minimized.

Scope of impact: This issue may affect any user's mail flow if the recipient is leveraging a specific third-party antispam service to filter email messages.

Start time: Wednesday, December 24, 2025 at 6:00 PM CST

Preliminary root cause: Outbound spam associated with some Microsoft IP addresses is causing all mail from these addresses to be blocked by a specific third-party antispam service.

Next update by: Monday, February 5, 2024 at 6:00 PM CST
Posted Feb 02, 2024 - 09:40 CST
Update
We are continuing to monitor for any further issues.
Posted Jan 31, 2024 - 13:50 CST
Monitoring
Current status: We're continuing to see positive trends in our monitoring telemetry, and we're confident that a large percentage of users are no longer affected by this issue. As our mitigative changes take effect, we recommend that users retry sending email messages that previously returned NDRs, as this may now prove successful. In parallel, we're performing some additional rule optimizations to remediate impact for any users who may be residually affected by this problem.

Scope of impact: This issue may affect any user's mail flow if the recipient is leveraging a specific third-party anti-spam service to filter email messages.

Start time: Wednesday, December 24, 2025 at 6:00 PM CST

Preliminary root cause: Outbound spam associated with some Microsoft IP addresses is causing all mail from these addresses to be blocked by a specific third-party antispam service.

Next update by: Thursday, February 1, 2024 at 6:00 PM CST
Posted Jan 31, 2024 - 13:49 CST
Update
Current status: We've performed some rule optimizations to minimize outbound spam and, while we're continuing to monitor for new reports of impact, our signals indicate a decrease in addresses blocked by the third-party antispam service. We've also confirmed that many formerly blocked IP addresses have since been delisted automatically, providing relief for many users. We'll continue monitoring telemetry for an extended period to ensure that this positive trend persists before confirming resolution.

Scope of impact: This issue may affect any user's mail flow if the recipient is leveraging a specific third-party anti-spam service to filter email messages.

Start time: Wednesday, December 24, 2025 at 6:00 PM CST

Preliminary root cause: Outbound spam associated with some Microsoft IP addresses is causing all mail from these addresses to be blocked by a specific third-party antispam service.

Next update by: Tuesday, January 30, 2024 at 6:00 PM CST
Posted Jan 30, 2024 - 11:00 CST
Update
Current status: Our efforts to collaboratively delist affected IPs with the third-party antispam service are continuing on a case-by-case basis as we identify additional blocked addresses. In parallel, we're examining IP block patterns we've identified via our telemetry so we can pinpoint the most efficacious rule changes and optimizations to reduce outbound spam and alleviate impact.

Scope of impact: This issue may affect any user's mail flow if the recipient is leveraging a specific third-party anti-spam service to filter email messages.

Next update by: Monday, January 29, 2024 at 6:00 PM CST
Posted Jan 26, 2024 - 14:50 CST
Update
Current status: We’re continuing our collaboration with the third-party anti-spam service to delist affected IP addresses that are being blocked. In parallel, we’re investigating any additional workstreams that can further reduce the impact of this issue. This may include further rule changes intended to reduce outbound spam patterns. We understand the impact an issue like this can have on your organization, and we appreciate your partnership and patience as we work to remediate the issue.

Scope of impact: This issue may affect any user's mail flow if the recipient is leveraging a specific third-party anti-spam service to filter email messages.

Next update by: Friday, January 26, 2024 at 3:30 PM CST
Posted Jan 24, 2024 - 14:24 CST
Update
Current status: We’ve implemented additional rule changes intended to further reduce outbound spam patterns, which has produced a reduction in the number of blocked instances. We’re continuing our collaboration with the third-party service to delist affected IP addresses that are being blocked on the third-party’s anti-spam service.

Scope of impact: This issue may affect any user's mail flow if the recipient is leveraging a specific third-party anti-spam service to filter email messages.

Next update by: Wednesday, January 24, 2024 at 1:30 PM CST
Posted Jan 22, 2024 - 16:08 CST
Investigating
Title: Some users may be unable to send or receive email messages, and receive a Non-Delivery Report (NDR) when sending

User impact: Users may be unable to send or receive email messages, and receive an NDR with a 550 or 554 error code when sending.

More info: This issue only occurs if either the sender or user who is receiving the message is utilizing a specific third-party anti-spam service. Senders receive the NDR which states that the message has been rejected due to a 550 or 554 error code and that their host IP address is listed on the third-party anti-spam service.

The error messages state "550 5.7.350 Remote server returned message detected as spam", "554 5.7.1 Service unavailable; Client host [xxx.xxx.xxx.xxx] blocked", or "‎550 5.7.1 This email was rejected because it violates our security policy."

Current status: We’ve implemented additional rule changes intended to further reduce outbound spam patterns, which has produced a reduction in the number of blocked instances. We’re continuing our collaboration with the third-party service to delist affected IP addresses that are being blocked on the third-party’s anti-spam service.

Scope of impact: This issue may affect any user's mail flow if the recipient is leveraging a specific third-party anti-spam service to filter email messages.

Next update by: Wednesday, January 24, 2024 at 1:30 PM CST
Posted Jan 22, 2024 - 13:27 CST
This incident affected: Office 365.