[SOLVED] Pesky O365 Exchange problem

[Markverhyden]

Wondering if anyone has any ideas on this. The customer's O365 provider is Godaddy, which they got on their own. iMac Outlook 2013 on OS X 10.11, MBP same, and a new iPhone and iPad both updated.

One user said some time ago he marked a sender as junk and accidentally did a second sender on his iMac. The second one is now a potential huge customer of theirs. He has clicked on the "this is not spam" on emails in Outlook with no change so I get involved. I started by pushing a rule so that emails from this user get moved to the Inbox. No luck. The senders domain is clean on mxtoolbox.com. Nothing in the email body contains the typical stuff that triggers spam filters.

This is definitely a server side issue as he sees this on all his devices. I've logged into their ECP and put in the following rules.

recipients>contacts added the email as a contact
mail flow>rules added the domain with bypass spam
protection>spam filter>edit default rule to put the email address as well as the domain itself in the allow list

Did this the day before yesterday and he came back a few hours later and said another email landed in junk. I would expect the rule changes to take effect within an hour or so, tops. Unfortunately this is low volume so I may go a day or two until another arrives. Next step is to connect with powershell since there is more granularity using that technique.

Any ideas? As always thanks in advance.

 

[johnrobert]

Have you tried contacting Godaddy since it's server side they should be able to reset something
I know Godaddy are not the best to deal with

 

[GTP]

Wondering if anyone has any ideas on this. The customer's O365 provider is Godaddy, which they got on their own. iMac Outlook 2013 on OS X 10.11, MBP same, and a new iPhone and iPad both updated.

One user said some time ago he marked a sender as junk and accidentally did a second sender on his iMac. The second one is now a potential huge customer of theirs. He has clicked on the "this is not spam" ......

Any ideas? As always thanks in advance.

You may have already seen this?

https://support.office.com/en-us/ar...fice-365-74aaade0-efc0-46ac-b949-f2d1d59256fa

...and this?

https://technet.microsoft.com/en-us/library/jj200718(v=exchg.150).aspx

Hope it helps

 

[freedomit]

You could use telnet to send as the sender and test your whitelist rules

 

[YeOldeStonecat]

Rules to bypass filtering when any e-mail comes from the senders IP address? Should be able to do that in 2 areas..in the spam rules, as well as transport rules.

 

[TurricanII]

The last time I had this problem it turned out to be Mac Mail was doing its own Junk filtering. Check if Mac Mail was ever set up and turn that off or turn off Junk filtering for the O365 mailbox. Of course when Mac Mail or whatever device moves the email into Junk on O365 it moves into Junk on all devices. The last time I had this issue I made these notes. It was for an in house Exchange 2010 server. You can connect to Office 365 with Powershell and may have to use newer commands to achieve the same:
---
Sometimes we need to enable mailbox audit to be able to track what causes email to be deleted/moved into Junk.

Enabling mailbox owner and delegate movement and deletion of messages with this command:

Set-Mailbox -Identity "John Smith" -AuditOwner HardDelete,Move -AuditEnabled $true
Set-Mailbox -Identity "John Smith" -AuditDelegate HardDelete,Move -AuditEnabled $true

Review the audit logs with this Exchange 2010 command. Note that it takes a good 15 minutes for the results of this command to arrive the recipient Inbox. Also, the results are an XML attachment. Open this as an XML table with Excel:

New-MailboxAuditLogSearch -Mailboxes "John Smith" -StatusMailRecipients "helpdesk@itcompany.com" -StartDate 07/26/2015 -EndDate 07/28/2015 -LogonTypes Owner -ShowDetails

This example entry shows one 'Test email' was deleted from the Inbox (and moved in to Junk) overnight. The culprit was Mac Mail/8.2 on home Mac:

2015-07-27T21:42:24
HardDelete Succeeded
\Inbox
Client=WebServices;UserAgent=Mac OS X/10.10.4 (14E46); ExchangeWebServices/5.0 (213); Mail/8.2 (2102)
IP: 213.133.81.223
Subject: Re. Test email

 

[RCHavok797]

Sounds like your client added the sender to the blocked senders list. Did you check and make sure there are no entries in the blocked senders list for the client? In Office 365, client side safe/blocked senders list will override server side settings.

 

[Markverhyden]

Thanks for the ideas.

@johnrobert, yes I did call Godaddy to check the changes I made. They said it should work. The tech seemed pretty knowledgeable but when I mentioned powershell he kind of backed off. That why I love Appriver. If they think something needs powershell they'll ask for permission and do it for you.

@Barcelona, thanks, did not see those. Some I've already done. What is interesting is they mention what @YeOldeStonecat said, use IP's which I did not do since I figured FQDN should properly resolve. So I'll try that.

@TurricanII, Thanks for those tips. I was looking for a way to generate some kind of log file to get a handle on what's going on. I did look at his Apple Mail on his iMac and there were no filter rules other than the defaults plus the Exchange was never setup on Apple Mail. Looked at his MBP and did not see any rules either. But I'll have to check it again just to make sure he has no client side settings as @RCHavok797 mentioned.

I'll also have to see if he remembers what device he was using when he marked the good sender as spam.

 

[Markverhyden]

Can finally put this one away. Did what @YeOldeStonecat said and put the IP address in as well.