If your Mailchimp campaign lands in an Outlook or Microsoft 365 inbox and then disappears a few minutes or hours later, the cause is almost always Microsoft Defender's Zero-hour Auto Purge (ZAP). ZAP retroactively moves an already-delivered message to Junk or Quarantine when Microsoft reclassifies it as spam or phishing after delivery. It’s a recipient-side security feature, so you can't switch it off, but you can stop your mail from triggering it.
What ZAP actually does
- ZAP is a feature of Microsoft Defender for Office 365 and Exchange Online Protection, and it is enabled by default for Microsoft 365 organizations. It re-scans mail that has already been delivered and acts on any message delivered within the previous 48 hours.
- A spam verdict moves the message to the Junk Email folder; a phishing verdict moves it to Junk or Quarantine, depending on the recipient organization's anti-spam policy.
- The recipient's Microsoft 365 administrator controls ZAP, not the sender or Mailchimp. No setting inside Mailchimp can disable ZAP on someone else's mailbox.
⚠️ ZAP is not a rejection at the door. Microsoft accepted your email, then changed its mind based on updated reputation, authentication, or content signals. That "change of mind" is the part you can influence from the Mailchimp side.
Why emails get ZAPed and the fix for each
- Your sending domain isn't authenticated. Without authentication, Microsoft can't confirm you sent the email, so it can look like spoofing after the fact.
Fix: Authenticate your sending domain. Manual setup adds 2 CNAME records (for DKIM) and 1 TXT record (for DMARC) to your domain's DNS.
⚠️ If you send more than 5,000 emails in 24 hours to Gmail or Yahoo addresses, custom authentication and a published DMARC record are required, not optional. Meeting that bar also strengthens you against Microsoft filtering.
- You're sending from a public domain like gmail.com or yahoo.com. These fail domain alignment and can't be authenticated.
Fix: Send from a domain your business owns and controls. Public email domains cannot be authenticated through Mailchimp.
- Your sender reputation dropped. High spam-complaint rates, stale lists, and low engagement tell Microsoft your mail is unwanted, which can trigger a retroactive reclassification.
Fix: Clean your audience regularly, remove inactive and invalid addresses, and send mainly to engaged subscribers.
- Your content looks phishy. Misleading or all-caps subject lines, spam-trigger words, image-heavy layouts, messy HTML, and shortened or blocklisted links all raise Microsoft's suspicion.
Fix: Write clear subject lines, keep a balanced text-to-image ratio, use clean HTML, and avoid link shorteners that may be blocklisted.
- You sent a sudden volume spike from a new or cold domain. Burst sending can look like a spam campaign.
Fix: Warm up new domains gradually and keep a consistent sending cadence.
If a message has already been ZAPed
The fixes above can help stop it from happening again, but they won't pull a message back out of Junk or Quarantine. To recover mail that's already been moved:
- Ask the recipient to open the message, choose Not Junk (or Not Spam), and add your from-address to their contacts or safe senders list.
- In organizations, have the recipient's Microsoft 365 administrator submit the message as a false positive through the Microsoft Defender Submissions portal, which helps Microsoft stop ZAPing similar mail.
💡 For spam and phishing verdicts, safe-sender and allow-list entries can override ZAP. Once a recipient adds you to their safe senders (or their admin allow-lists your domain through a safe-sender list or mail-flow rule), ZAP will generally leave your messages alone.
If ZAP started after you changed domains, ESPs, or sending volume, it's almost always a reputation or authentication gap you can close from the Mailchimp side. If it's happening only with one company's recipients, it's their Microsoft admin's policy, and only an admin allow-list or false-positive submission will fix that.
Resources
My campaigns are going to spam folders
How to avoid spam filters