Mail with attachment arrives 5 to 15 minutes late, customers complain
Defender for Office 365 Safe Attachments (formerly ATP) detonates attachments in a sandbox before delivery. Default 'Block' waits on sandbox result, which can take 1 to 15 minutes. For real-time inbound (quotes, invoices) 'Dynamic Delivery' is often better: message arrives without attachment, attachment follows after scan.
Try this first
- 1Open Microsoft Defender portal → Email & collaboration → Policies & rules → Safe Attachments. Check which policy is active and in which mode.
- 2Mode 'Dynamic Delivery' delivers the message immediately with a placeholder and sends the attachment after sandbox is done. Users get text right away, attachment a few minutes later.
- 3Restrict Safe Attachments to external senders if internal mail is delayed unnecessarily.
- 4In Threat Explorer see how many messages actually hang in sandbox and which senders trigger it. Sometimes a legitimate vendor with malformed PDFs ends up there.
- 5Allow-list specific trusted senders via Tenant Allow/Block List, not via mailflow rules which overrule Safe Attachments awkwardly.
When to bring us in
If you handle radiology, large CAD packages or big ZIPs, the sandbox can routinely time out. A Microsoft support case beats blind tuning.
See also
- Our emails land in spam for some recipientsAlmost always an SPF, DKIM, or DMARC setting that is wrong or missing, or a sender name that mimics a well-known brand.
- Someone reports receiving phishing emails "from us"Read: spoofing. Someone is abusing your sender name, not necessarily your actual mailbox.
- An email bounces (NDR): delivery failedThe NDR text usually states the exact reason. Reading it is step one.
None of the above fits?
Describe your situation below. We pass your input plus the steps you already saw to our AI and return tailored next-step advice. If it's too risky to DIY, we'll say so.
Or skip the DIY entirely
Our Managed IT clients do not look these things up. One point of contact, a fixed monthly price, resolved within working hours.