Skip to content

Mail with attachment arrives 5 to 15 minutes late, customers complain

Defender for Office 365 Safe Attachments (formerly ATP) detonates attachments in a sandbox before delivery. Default 'Block' waits on sandbox result, which can take 1 to 15 minutes. For real-time inbound (quotes, invoices) 'Dynamic Delivery' is often better: message arrives without attachment, attachment follows after scan.

Try this first

  1. 1Open Microsoft Defender portal → Email & collaboration → Policies & rules → Safe Attachments. Check which policy is active and in which mode.
  2. 2Mode 'Dynamic Delivery' delivers the message immediately with a placeholder and sends the attachment after sandbox is done. Users get text right away, attachment a few minutes later.
  3. 3Restrict Safe Attachments to external senders if internal mail is delayed unnecessarily.
  4. 4In Threat Explorer see how many messages actually hang in sandbox and which senders trigger it. Sometimes a legitimate vendor with malformed PDFs ends up there.
  5. 5Allow-list specific trusted senders via Tenant Allow/Block List, not via mailflow rules which overrule Safe Attachments awkwardly.

When to bring us in

If you handle radiology, large CAD packages or big ZIPs, the sandbox can routinely time out. A Microsoft support case beats blind tuning.

See also

None of the above fits?

Describe your situation below. We pass your input plus the steps you already saw to our AI and return tailored next-step advice. If it's too risky to DIY, we'll say so.

Who are you?

For the AI question we need your email and company, so we can follow up if the AI gets stuck, and to prevent abuse.

Limited to 2 questions per hour and 5 per day, kept lean so the AI stays useful. For more, contacting us directly works better for you and us.

Or skip the DIY entirely

Our Managed IT clients do not look these things up. One point of contact, a fixed monthly price, resolved within working hours.