Question 1

Our emails land in spam for some recipients

Accepted Answer

1. Run our free Domain quickscan on your primary domain. It returns a list of "missing" or "weak" items in about a minute.
2. Ask the recipient to drag the message from Spam to Inbox. A single manual correction already helps future mail from you.
3. Do not send from Excel, a marketing tool or a new SaaS on behalf of your primary domain without it being in your SPF record. That is reason #1.
4. Avoid words like "FREE", "WIN", shouting capitals, or many exclamation points in the subject and first line.

When to bring us in: 
Editing SPF/DKIM/DMARC is closer to DNS work than mail work. If the scan flags gaps and you do not know who manages your DNS, drop us a line; we will walk you through it.

Question 2

Someone reports receiving phishing emails "from us"

Accepted Answer

1. Ask the recipient to forward the message header. The real sending-server address is in there; almost never your infrastructure.
2. Run the Domain quickscan: if your DMARC policy is "none", spoofing is hard to block. Set to "quarantine" or "reject" and most attempts stop.
3. Send a short note to your clients: "We never send unsolicited payment or login links". Lowers damage from future spoofing.
4. Do not panic-change anything; no password resets, do not disable mailboxes. That does not fix spoofing (your mailbox is not hacked).

When to bring us in: 
Multiple recipients, or the phishing message has a functional-looking reply address at your domain? Reach out. We will get DMARC set properly and filter the known abuse paths.

Question 3

An email bounces (NDR): delivery failed

Accepted Answer

1. Open the NDR message and look for a line like "550 5.1.1" or "Recipient address rejected". That is the reason in two words.
2. Typo in the address: open the mail in Sent Items and resend with the right address. Tip: add to contacts so Outlook auto-suggest stops misfiring.
3. "Mailbox quota exceeded": the recipient has a full mailbox. Phone or text them so they know.
4. "5.7.1 message rejected as spam": your sender is being refused. See the spam-delivery section.
5. "DNS lookup failed": the receiving domain does not exist or is broken. Nothing you can fix from here.

When to bring us in: 
If your own domain is named in the NDR as the rejecting party (your own filter pushing back); we can look inside your tenant.

Question 4

The domain scan says SPF/DKIM/DMARC is missing: what does that mean?

Accepted Answer

1. SPF (TXT record on your domain): lists the IPs or domains allowed to send. Missing, or ?all instead of -all, makes it weak.
2. DKIM (signature): your mail provider digitally signs outgoing mail. Without it the receiver cannot prove it really came from you.
3. DMARC (TXT on _dmarc.yourdomain): tells receivers what to do when SPF and DKIM fail. "none" does nothing, "quarantine" sends suspect mail to spam.
4. Get a first read: run our Domain quickscan and see in plain language what is there and what should improve.

When to bring us in: 
Changes require access to your domain DNS, at the registrar where you bought the domain. Not your mailbox. We can do it with your registrar if this is new territory.

Question 5

Out-of-office sends nothing, or sends too much

Accepted Answer

1. Outlook > File > Automatic Replies. Confirm "Send automatic replies" is on and the time window is correct.
2. Two tabs: "Inside my organisation" and "Outside my organisation". Many fill only the first and external senders get nothing.
3. External limited? Tick "My Contacts only" or "Anyone outside my organisation", not just "My Contacts"; otherwise unknown senders miss it.
4. For Outlook Web: outlook.office.com > gear > "Automatic replies". Same setting, sometimes easier from phone.
5. If it does send but multiple times to one sender: that is normal, Outlook sends once per person per session.

When to bring us in: 
OOO not working for one specific sender, or causing a mail loop? That is a filter or rule issue we can see better from our side.

Question 6

My email signature differs across desktop, web, and phone

Accepted Answer

1. Outlook desktop > File > Options > Mail > Signatures. Local entries; changes do not sync to web or phone.
2. Outlook Web > gear > "Signatures". Separate setting; copy the text manually.
3. Phone (iOS/Android Outlook app): Settings > Signature. Yet another.
4. For consistent company-wide signatures, IT can switch on Microsoft Roaming Signatures or use Exclaimer. Set up once, then synced everywhere.

When to bring us in: 
For unified signatures across users and devices with logo and disclaimers, a centralised tool is the right answer. We do this regularly.

Question 7

New email address or alias for a role or new employee

Accepted Answer

1. Decide: new person = mailbox with its own license. Role / team address = alias or shared mailbox.
2. Aliases are free (up to 400 per user). Shared mailboxes are free up to 50 GB without a separate sign-in.
3. In M365 admin: Active users > [user] > Manage username and email > Add alias. Or Teams & Groups > Shared mailboxes > Add a shared mailbox.
4. Then arrange: signature, auto-reply, and who has access. Before you announce it externally.

When to bring us in: 
For our clients we manage this administratively. One mail to info@vectel.nl with the desired name and who needs access is enough.

Question 8

Suspicious invoice email or "payment request" from a supplier

Accepted Answer

1. Do not click links or buttons. Open the supplier portal directly via a bookmark you already had, or by Googling the real supplier name.
2. Call the supplier on a number you already knew (old invoice, contract, official site). Not the number in the suspect mail.
3. Inspect the sender domain literally: "supplier.com" vs "supplier-pay.com" or "supplier.nl-pay.com" are typical phish forms.
4. Caution: phishers sometimes use a genuinely-hacked supplier account. Still doubt? Call.

When to bring us in: 
Already paid or entered credentials? Call your bank first and then us. The first 24 hours are critical for recovery.

Question 9

I receive DMARC reports but cannot make sense of them

Accepted Answer

1. Collect a week of reports in a separate folder or mailbox. One day says too little.
2. Upload them to a free DMARC report viewer. You get a table of senders with pass/fail per row.
3. Mark what you recognise (your mail provider, your invoicing tool) as legitimate and check it is in your SPF and DKIM.
4. What is left and does not belong is spoofing or forgotten shadow-IT. Do not ignore it, but no need to panic.

When to bring us in: 
If you only see pass/fail and cannot tell which sender belongs to whom, drop us a line; we will sort which rows are legitimate and which to block.

Question 10

Our logo does not show next to our mail in Gmail

Accepted Answer

1. Check first that DMARC is on 'quarantine' or 'reject'. On 'none' BIMI does not work at all.
2. Prepare a square SVG logo without gradients or effects, in the strict BIMI variant of the format.
3. For Gmail and Apple Mail you also need a paid VMC or CMC certificate. Smaller providers sometimes accept without a VMC, but do not count on it.
4. Publish the BIMI TXT record at default._bimi.yourdomain and wait a few days for it to appear.

When to bring us in: 
Preparing the logo you can do yourself; the VMC route runs via a certificate vendor and costs money. Want to know if it is worth it for your volume, ask us.

Question 11

A large recipient asks whether we use MTA-STS

Accepted Answer

1. Host a text file at mta-sts.yourdomain/.well-known/mta-sts.txt with a mode line and your MX names.
2. Add a TXT record at _mta-sts.yourdomain with a version and id field.
3. Start in mode 'testing' and let it run for a few weeks. Only then switch to 'enforce'.
4. Also enable TLS-RPT (see separate entry) so you receive reports of failed TLS connections.

When to bring us in: 
The policy file has to be reachable via HTTPS on a subdomain, which touches both hosting and DNS. If that is not your area, we will set it up for you.

Question 12

What are these TLS-RPT reports I am receiving?

Accepted Answer

1. Add a TXT record at _smtp._tls.yourdomain with a rua field pointing to a collector mailbox.
2. Use a dedicated mailbox or distribution list for these reports; they arrive daily.
3. Skim them now and then. Lots of 'success' is good news. Sudden 'failure' suggests an expired certificate or an unreachable MX.
4. Combine with MTA-STS for the full picture; TLS-RPT alone reports but enforces nothing.

When to bring us in: 
If reports keep showing failures and you cannot tell which MX host is involved, forward us a few; we will read them with you.

Question 13

Mail only arrives after five or ten minutes

Accepted Answer

1. Ask the recipient if they use a greylist or similar filter. A one-time allow can stop future delays.
2. Inspect message headers and look at the time between 'Received' lines. A gap of several minutes confirms greylisting.
3. Sending will work on its own; do not keep resending the same message.
4. If it really has to land now, just call; faster than fighting it technically.

When to bring us in: 
If your whole domain suffers and it keeps recurring, we can check whether a reputation issue is making receivers extra strict.

Question 14

An incoming mail is in quarantine, I do not see it in the inbox

Accepted Answer

1. Check your daily quarantine digest mail. It contains a direct release button.
2. Only release what you really expected. When in doubt, confirm via another channel.
3. Releasing clears this one message but does not automatically add the sender to a safe list.
4. If the same legitimate sender keeps landing in quarantine, ask your admin for a filter exception.

When to bring us in: 
If multiple colleagues miss mail from the same source, or you do not get a quarantine digest at all, we can adjust the tenant rules.

Question 15

Once a week mail suddenly arrives with delay across the board

Accepted Answer

1. List your MX records and note the priorities. Two equal MXes is usually not what you want.
2. Keep one primary MX on low priority and only use a fallback MX you know works and serves the same mailbox.
3. Test the fallback by temporarily blocking the primary in a test setup, not production.
4. Remove old, forgotten MX records from a previous provider; that is a frequent cause.

When to bring us in: 
Changing MX records means editing DNS at your registrar or provider. New territory? Ask us; this is exactly where one slip costs you a day of mail silence.

Question 16

Mail to info@ bounces back and forth and fails

Accepted Answer

1. Sketch on paper who forwards to whom. Start at the address that received the bounce.
2. Look for addresses listed in each other's forward setting, or a group containing itself as a member.
3. Break one link: turn the forward off or remove the self-membership.
4. Test with one external mail, not from another internal address, which can mask the loop.

When to bring us in: 
Lost track of who forwards what? We will pull the map from your tenant and cut where needed.

Question 17

External people cannot post to our group

Accepted Answer

1. Decide first: do you really want anyone to post to this list, or just specific partners?
2. For specific partners: have your admin add those addresses to an allow list on the group.
3. For open groups: enable 'allow external senders' on the group itself, not on the whole tenant.
4. Tell the members the group is open now; so they understand why an odd message suddenly gets through.

When to bring us in: 
Admin access needed to change this. Not sure where that lives, or unsure if you really want it open? Give us a call, we will think along.

Question 18

Mail from a shared mailbox lands in my own Sent, not the shared one

Accepted Answer

1. Ask your admin to enable 'copy items to shared mailbox' on the shared mailbox.
2. Close Outlook once and reopen; the change does not always take effect in a running session.
3. Send a test message from the shared mailbox and check it now appears in shared Sent Items.
4. Old mail will not back-fill; from now on it works. Tell colleagues so they do not hunt for history.

When to bring us in: 
Ask your admin; we can flip it for you if you do not have admin access.

Question 19

I cannot send from another address, I get rejected

Accepted Answer

1. Confirm which address you want to use. People often mix up 'Send As' with 'Send on Behalf'; the latter shows recipients you send on someone else's behalf.
2. Ask your admin to grant you explicit 'Send As' on that mailbox.
3. Close Outlook, wait a few minutes, reopen; rights do not always propagate immediately.
4. Type the From address manually the first time; next time it appears in the dropdown.

When to bring us in: 
If the steps do not help, there may be a directory-sync conflict or an older policy in your tenant. Forward the exact error message.

Question 20

Our newsletter has no 'unsubscribe' button at the top in Gmail

Accepted Answer

1. Send yourself a test newsletter and inspect the full headers. Look for 'List-Unsubscribe'.
2. Missing? Enable 'add list-unsubscribe header' in your sending tool. Almost every modern tool has it.
3. For Gmail's one-click button you also need 'List-Unsubscribe-Post: List-Unsubscribe=One-Click'.
4. Test against a Gmail recipient and check the button appears. Gmail may take a day to pick it up.

When to bring us in: 
If you run the newsletter from a custom script or unknown SaaS, we can help you generate the right header.

Question 21

Outlook keeps suggesting the wrong address

Accepted Answer

1. Start typing the address in a new mail. When the wrong suggestion appears, arrow down to it and remove it with the X next to it.
2. Add the correct address to your contacts so the name suggestion takes over automatically.
3. To wipe the whole cache: Outlook settings has a button to clear the autocomplete list. Only do that if you have a lot of clutter.
4. For shared teams: remind colleagues their cache holds their own clutter too; cleaning yours does not clean theirs.

When to bring us in: 
No escalation needed; small bit of housekeeping.

Question 22

An attachment is rejected as 'too large'

Accepted Answer

1. Upload the file to OneDrive or SharePoint and share a link instead of attaching. The recipient gets it without weighing down their mailbox.
2. For sensitive files: use a shared link with an expiry date and optionally a password. It expires on its own afterwards.
3. Export photos smaller first if peak quality is not needed. Often saves a factor of ten.
4. Very large or many recipients? A transfer portal like WeTransfer is fine, as long as the data is not confidential.

When to bring us in: 
If you regularly share large files with external parties, we can set up a clean solution inside your 365 environment.

Question 23

A client asks if we can mail with S/MIME encryption

Accepted Answer

1. Ask whether the client really needs S/MIME, or whether a password-protected attachment or secure portal is enough. Often the latter is more practical.
2. S/MIME requires a personal certificate per user from a trusted issuer, and you must exchange the public part.
3. Without an exchanged public certificate you can sign encrypted-style but cannot send encrypted to that client.
4. Pilot with one user and one recipient before rolling it out; key management is the real work, not the sending.

When to bring us in: 
Issuing certificates, deploying them to devices and coaching people through key handling is a project. Want to set this up properly, book a call.

Question 24

How do I send an attachment only the recipient can open?

Accepted Answer

1. Make a ZIP and set a password using your archive tool of choice. Pick one you do not send in the same mail.
2. Send the password via a different channel: phone, SMS, or a messaging app. Never the same mail thread.
3. Or: place the file on OneDrive and share with 'specific people' plus a link password.
4. Ask the recipient to confirm they could open it before you delete the source file.

When to bring us in: 
If you do this daily and it gets messy, we will set up a clean flow; so colleagues do not have to invent passwords every time.

Question 25

My mail rule works at the office but not on my phone

Accepted Answer

1. Open your rules in Outlook and see which are marked 'client-only'. Those need a running Outlook.
2. Try recreating the same rule server-side; some actions (like playing a sound) cannot, and force client-side.
3. For rules that must work everywhere, keep actions simple (move, delete, mark) and they stay server-side.
4. Test by closing your laptop and sending a test mail from another address. Does it land in the expected folder?

When to bring us in: 
Got thirty rules fighting each other? Not a one-step fix. Send us a list and we will clean it up.

Question 26

My auto-forward to my personal Gmail no longer works

Accepted Answer

1. Confirm the tenant policy does block external forwarding. Setting it up usually returns a clear notice.
2. Reconsider the need: personal Gmail is rarely the right place for business mail. Your admin probably has reasons.
3. For real exceptions: have the admin allow it for specific users, not tenant-wide.
4. Better alternative: use the Outlook mobile app and you get work mail without forwarding.

When to bring us in: 
Changing this policy is admin work and touches your security posture. If you want an exception, ask us; we will check whether there is a tidier solution first.

Question 27

Our newsletter delivers worse over time

Accepted Answer

1. Inside your newsletter tool, mark addresses that hard-bounce as inactive. Stop mailing them.
2. Also retire addresses that have not opened for months. A clean list outperforms a big list.
3. Set automatic exclusion thresholds; most tools can drop addresses after X bounces.
4. In your last mail to inactive readers, tell them explicitly you will unsubscribe them; sometimes that revives them.

When to bring us in: 
Tangled list history or an older sending system without bounce handling? We can migrate you to a setup that handles it properly.

Question 28

Our messages get flagged as 'possibly misleading' due to the sender name

Accepted Answer

1. Check the sender name as recipients see it, not only the address. Keep it to your own company name, nothing more.
2. Avoid brand names, words like 'support' or 'security', and currency symbols in the name.
3. For signatures: stick to one consistent name format across all mailboxes.
4. In standalone campaigns: make clear in the first lines which company is sending.

When to bring us in: 
Caught penalties over this in DMARC reporting or a complaint from a large receiver? Forward it and we will work to get the classification reversed.

Question 29

SPF check fails with 'too many DNS lookups' or permerror

Accepted Answer

1. Count includes and a/mx mechanisms in your SPF record
2. Flatten SPF using a flatten tool or move ESPs to their own subdomain
3. Remove unused includes (old CRM, old mail provider)
4. Retest with dmarcian or mxtoolbox until lookups are under 10

When to bring us in: 
If departments use separate ESPs and flatten gets messy, split per subdomain.

Question 30

Multiple brands on one mail server, SPF fails for some domains

Accepted Answer

1. Each domain gets its own SPF record with the right include or ip4
2. Check that helo/EHLO matches a hostname on one of the domains
3. Set up DKIM per domain, not one shared key
4. Test with a message from each brand to a Gmail account

When to bring us in: 
If you're unsure about sending IPs, ask the mail provider for the outbound IP list.

Question 31

DKIM key has been live for years, should we rotate?

Accepted Answer

1. Generate a new DKIM key with a different selector
2. Publish the new selector in DNS, leave the old one in place
3. Switch the provider over to the new selector
4. Wait a week, then remove the old DNS record

When to bring us in: 
Rotate at least yearly, more often if you send payroll or invoice mail.

Question 32

Our DKIM-signed mail is being reused by a spammer

Accepted Answer

1. Check Postmaster Tools and SNDS for spikes you didn't send
2. Limit DKIM signing validity with the x= tag
3. Do NOT use the l= tag, sign the full body
4. Rotate the selector if the replay is ongoing

When to bring us in: 
If reputation tanks from replay, get the mail provider to file abuse with receivers.

Question 33

Want to move DMARC to p=reject, worried legit mail will break

Accepted Answer

1. Start with p=quarantine pct=10
2. Read DMARC reports for two weeks, fix each legit source
3. Scale pct to 25, 50, 100
4. Then move to p=reject pct=100

When to bring us in: 
If reports show a source you don't recognise, investigate before scaling further.

Question 34

DMARC report lists ten sending IPs, I can't tell which are ours

Accepted Answer

1. Use a DMARC aggregator (dmarcian, Postmark) to visualise reports
2. Look up the PTR record per IP, that usually reveals the provider
3. Match IPs to your known services (CRM, ESP, ticketing)
4. Unknown sources: block or bring under DKIM/SPF

When to bring us in: 
If you can't trace an IP, don't jump to p=reject, identify first.

Question 35

Mail via a forwarder (Mailman, alumni list) fails DMARC

Accepted Answer

1. Ask the forwarder if it supports ARC signing
2. Enable ARC on the forwarder if the option exists
3. Check Gmail's Authentication-Results header for 'arc=pass'
4. No ARC support: replace the forwarder or upgrade the list software

When to bring us in: 
Many older listservers don't support ARC. Moving to Groups.io or Discourse fixes it.

Question 36

Mail bounced, how do I tell if it's temporary or permanent?

Accepted Answer

1. Read the NDR, find the three-digit code
2. 4xx: retry after a few hours, your mail server usually does this automatically
3. 5xx: remove from list or have the recipient check
4. Repeated soft bounces after a week: treat as hard

When to bring us in: 
If every recipient on one domain soft-bounces, look at greylisting or MX issues on their side.

Question 37

Bounce with 5.7.1: 'message rejected' or 'not authorised'

Accepted Answer

1. Read the full reject text in the NDR, the reason is often inline
2. Check SPF/DKIM/DMARC for the sending domain
3. Check whether your IP is on a blocklist (mxtoolbox)
4. For Microsoft recipients: check sender reputation in SNDS

When to bring us in: 
Some 5.7.1 codes come from transport rules on the receiver side, only they can fix those.

Question 38

Bounce with 5.4.1: 'recipient address rejected, access denied'

Accepted Answer

1. Ask the recipient to check whether your address is blocked
2. Check transport rules in their Exchange Online tenant
3. Send a test from a different domain to rule out a sender issue
4. On hybrid setups: check connector routing between on-prem and cloud

When to bring us in: 
5.4.1 can't be fixed on the sending side if the recipient denies access, they have to look.

Question 39

Bounce with 4.4.7: 'message expired, retry timeout exceeded'

Accepted Answer

1. Check the recipient domain's MX records
2. Test whether their mail server answers on port 25 from your IP
3. Often points to DNS issues or a long outage on the recipient side
4. Reach out by phone, mail is currently not delivering

When to bring us in: 
If everything to one domain 4.4.7s, contact their IT provider directly.

Question 40

Our IP is on a blocklist (Spamhaus, Barracuda)

Accepted Answer

1. Check mxtoolbox for which RBLs list your IP
2. Open the RBL and read why (spam, open relay, compromised account)
3. Fix the root cause before requesting delisting, or you'll be back on immediately
4. Request delisting via the RBL's form

When to bring us in: 
For Spamhaus SBL: dig through mailflow logs, often a hacked user account sending spam.

Question 41

How do we keep an eye on our sender reputation?

Accepted Answer

1. Register your sending IP on Microsoft SNDS
2. Add your domain to Google Postmaster Tools, verify via DNS
3. Wait 1-2 weeks for data to start populating
4. Check weekly for spam rate, IP status, and authentication success

When to bring us in: 
If Postmaster Tools shows red, stop bulk sending until you find the cause.

Question 42

We're getting a new sending IP, what now?

Accepted Answer

1. Start with 50-100 mails per day in week 1
2. Double volume every two days, if open rate stays healthy
3. Send only to engaged recipients first (recent customers)
4. Full warming takes 4-6 weeks at daily cadence

When to bring us in: 
If bounces or spam complaints climb, drop volume back down.

Question 43

Should we get a dedicated IP or stay on shared?

Accepted Answer

1. Under 50k/month: stay on shared, pick an ESP with solid reputation
2. Above 50k/month: consider dedicated for control
3. Dedicated needs warming and consistent volume
4. Irregular sends on dedicated hurt your own reputation

When to bring us in: 
When in doubt, ask the ESP for their shared-IP reputation numbers before switching.

Question 44

Password resets and newsletters use the same domain, is that a problem?

Accepted Answer

1. Split per subdomain: tx.company.com for transactional, news.company.com for marketing
2. Separate SPF, DKIM, DMARC per subdomain
3. Separate ESP or pool per stream
4. Monitor both subdomains independently

When to bring us in: 
If marketing pulls many complaints, also separate physically via different sending IP pool.

Question 45

DMARC fails on alignment while SPF and DKIM both pass

Accepted Answer

1. Check the Return-Path header in the source
2. Compare it to the From address in the header
3. Both must sit on the same organisational domain
4. ESP settings: enable 'custom return path' so the envelope uses your domain too

When to bring us in: 
If your ESP can't do custom return path, switch ESPs, it blocks strict DMARC alignment.

Question 46

Our contact form mails don't deliver, log says 'header injection'

Accepted Answer

1. Check your form script: strip  and 
 from any input that goes into headers
2. Use a mail library (PHPMailer, Symfony Mailer) rather than building headers by hand
3. Read the mail server error log, look for 'invalid header'
4. Test with a payload containing newlines to confirm the filter works

When to bring us in: 
On old legacy forms: replace with a modern library, faster than fixing.

Question 47

Attachment with .exe or a macro Excel doesn't deliver

Accepted Answer

1. Check blocked extensions in Microsoft 365 Defender
2. Send the file in a password-protected zip, share the password separately
3. Or put it in OneDrive/SharePoint and share a link
4. For macros: don't email at all, share internally only

When to bring us in: 
Temporary exceptions are possible, but prefer changing the file format over weakening the policy.

Question 48

Links in our mail start with safelinks.protection.outlook.com

Accepted Answer

1. Confirm in Defender that Safe Links is on (usually correct)
2. Whitelist your own domains only if tracking truly breaks
3. For clients: explain the safelinks prefix resolves to the real URL on click
4. Don't disable globally, that reopens the phishing door

When to bring us in: 
For specific marketing domains: 'Do not rewrite' that URL, not global off.

Question 49

Inbox rules only fire ten minutes after a mail arrives

Accepted Answer

1. Check whether your rule is client-only (icon next to it in the rules menu)
2. Recreate as a server-side rule via Outlook Web or Exchange admin
3. Avoid client-only actions (play sound, show popup)
4. Test by closing the client and receiving a mail

When to bring us in: 
If a rule must be server-side but Outlook downgrades it to client: rebuild via OWA.

Question 50

A transport rule doesn't behave as expected, another rule seems to override it

Accepted Answer

1. Open Exchange admin, sort transport rules by priority
2. Check which rules have 'Stop processing more rules' enabled
3. Reorder so specific rules sit above generic ones
4. Use message trace to see which rule actually fires

When to bring us in: 
If rules tangle: document everything in a spreadsheet before refactoring.

Question 51

Our app can't send more than X mails per hour via Office 365 SMTP

Accepted Answer

1. Audit daily volume per application
2. Under 10k/day/user: stay on O365 but split across multiple accounts
3. Above that: switch to a dedicated relay (SendGrid, Brevo, AWS SES)
4. For transactional, always use dedicated, not O365

When to bring us in: 
For ad-hoc spikes (e.g. newsletter batch): use a separate ESP, don't abuse O365 relay.

Question 52

Microsoft 365 blocks automatic forwarding to external addresses by default

Accepted Answer

1. Open Defender > Anti-spam outbound policy
2. 'Automatic forwarding' is set to 'Automatic - System-controlled'
3. For exceptions: build a separate policy for specific users
4. Always ask why forwarding is needed, a shared mailbox is often better

When to bring us in: 
Forwarding to personal mail is almost always a data leak, decide deliberately and log it.

Question 53

Mail to a distribution group doesn't reach some members

Accepted Answer

1. Run message trace for the group, inspect individual expansion
2. Identify which members bounce or stall
3. Remove dead addresses from the group
4. For large groups: switch to dynamic group or M365 group

When to bring us in: 
On old on-prem distribution groups, consider migrating to M365 Groups.

Question 54

We want 'all staff in Amsterdam' as a mail group without manual upkeep

Accepted Answer

1. Make sure City or Department in Azure AD is properly filled
2. Create a 'dynamic distribution group' in Exchange admin with filter City eq 'Amsterdam'
3. Test with Get-DynamicDistributionGroupMember in PowerShell
4. Document the filter so the next person can maintain it

When to bring us in: 
If attribute data is bad, clean the HR source first. Otherwise you get oddly empty groups.

Question 55

Our MFP/scanner needs to send via a smart host

Accepted Answer

1. Choose between O365 SMTP relay, third-party (SendGrid), or your own relay
2. Configure the device with SMTP server, port 587, STARTTLS
3. Use a service account, not a personal account
4. SPF: add the relay IP or include to your SPF record

When to bring us in: 
For many devices, dedicated relay with IP whitelist beats spreading credentials.

Question 56

We run Exchange on-prem and Exchange Online, mail between mailboxes glitches

Accepted Answer

1. Re-run the Exchange Hybrid Configuration Wizard as a baseline
2. Check certificate binding on the send connector
3. Test mailflow with message trace between on-prem and cloud mailboxes
4. Validate that accepted domains match on both sides

When to bring us in: 
Hybrid stays fragile. Finishing migration to pure cloud is usually the way out.

Question 57

Invitees accept the meeting, but the organiser doesn't see the response

Accepted Answer

1. Ask the invitee whether they forwarded the meeting, that breaks tracking
2. Confirm the response comes from the invited account, not a delegate
3. Cross-tenant: federation/free-busy must be enabled between tenants
4. In Outlook: View > Tracking to see all responses

When to bring us in: 
On shared calendars, tracking lands in the organiser mailbox, not the delegate.

Question 58

On cross-tenant collaboration we can't see each other's availability

Accepted Answer

1. In M365 admin: configure organisation relationship with the other tenant
2. Set free/busy access scope (per user or whole tenant)
3. Test by inviting someone from the other tenant to a meeting
4. Allow up to 24 hours for replication

When to bring us in: 
For long-term collaboration, consider Entra ID guest users, free/busy then works natively.

Question 59

A meeting room accepts double bookings or rejects everything

Accepted Answer

1. Open Exchange admin > Resources > Rooms
2. Check 'Booking options': AutoAccept on, no conflicts allowed
3. Set working days and hours so out-of-hours requests are rejected
4. Test with a sample booking, check the room calendar accepts it

When to bring us in: 
If delegates must approve: enable Manual processing and fill in the delegate list.

Question 60

Someone received mail allegedly from us, how do we analyse it?

Accepted Answer

1. Request the full headers (View source / Show original)
2. Paste into a header analyser (mha.azurewebsites.net or mxtoolbox)
3. Look at Authentication-Results and Received-from
4. Compare Return-Path and From domain to confirm spoofing

When to bring us in: 
For ongoing phishing in your name, report to the attacker's hosting provider and APWG.

Question 61

A user accidentally grants OAuth consent to a malicious app

Accepted Answer

1. Entra > Enterprise applications > find the suspicious app
2. Remove app consent and revoke all tokens
3. Force sign-out of all sessions for that user
4. Audit sent mail for the relevant period via Compliance

When to bring us in: 
Roll out an org-wide OAuth app review: whitelist known apps, block the rest via app-consent policy.

Question 62

We need to find out after the fact where a mail went and what happened to it

Accepted Answer

1. Exchange admin > Mail flow > Message trace
2. Search by sender, recipient, or message-id
3. Trace covers 30 days by default, longer with extended trace
4. Per result, 'View details' for the rules and policies that fired

When to bring us in: 
For traces older than 30 days, use extended/historical trace, report arrives within a day.

Question 63

Gmail/Yahoo require 1-click unsubscribe as of February 2024

Accepted Answer

1. ESP setting: enable 1-click unsubscribe
2. Header List-Unsubscribe-Post: List-Unsubscribe=One-Click must be present
3. Clicking unsubscribe in Gmail must process within 2 days
4. Test with your own Gmail account before going wide

When to bring us in: 
If you don't comply, mail stops being delivered at Gmail/Yahoo, not just spam-filed.

Question 64

We don't have postmaster@ or abuse@ set up

Accepted Answer

1. Create postmaster@yourdomain as an alias to the IT mailbox
2. Create abuse@yourdomain as an alias to IT or the security team
3. Both must actually receive mail and be read
4. On reports: fast response helps reputation and compliance

When to bring us in: 
Ignoring entirely leads to RBL listings and refusal at large receivers.

Email deliverability