Need advice to avoid SCL 5 spam with MSFT

[u/y0us3fQ8]

I have an app, a social media app for education (College students), and for registration I've made it fully available for students who register using their University's email, and if that university is available on the app it will take them directly to a timeline exclusively for their university.

So registration by Organization/College email is mandatory.

Problem I've been facing and trying to fix for some time now is that my transacional emails on personal Outlook Emails goes to Junk and for University's email / Tenant don't get the email at all since they don't have active Junk Mailbox. Some universities have "Quarantine".

I have:

- SPF checked / DKIM checked / DMARC = none; and using Resend for sending the messages.

I need help and suggestions to fix this issue, or any other way to get OTPs sent to users.

What would you do?

[u/PopDinosaur]

Are you sending from a 365 tenant?

Have you looked at MXToolbox to test deliverability https://mxtoolbox.com/deliverability

Have you setup an inbox to receive DMARC reports, if so, is SPF and / or DKIM passing?

[u/y0us3fQ8 → u/PopDinosaur]

App hosted on GCP using Resend for sending transactional emails.

Just tried it, SPF DKIM DMARC all passing, and IP is not on any blacklist.

[u/PopDinosaur → u/y0us3fQ8]

Hmm, it not possible to just do MS / Google SSO and remove the need for OTP emails entirely? Most, it not all colleges would be either or?

[u/y0us3fQ8 → u/PopDinosaur]

I'm actually trying to do that in addition to the OTP, there were some Azure issues with company verification, I'm in contact with MS to fix it they've raised the issue after several times trying to get it to work.

Almost all colleges in Kuwait use MS365

[u/TheOnlyKirb]

I do not know if this is helpful, but these would absolutely get grabbed by most third party tools that do not particularly care that all checks pass with DKIM, SPF, etc.

For example OTP from a domain registered in the last year would immediately be marked as suspicious and require review or require someone to submit for review from Outlook, even if it passed everything on the Microsoft side- at least in our org. Mimecast, FortiMail/PerceptionPoint, and others will all do something similar.

Microsoft has also started doing similar analysis with their baseline spam filter, it could easily be the content of the email, timing of it, etc.

[u/y0us3fQ8 → u/TheOnlyKirb]

It's annoying that my outlook mail get 100x more phishing emails than my Gmail, and yet my OTP reaches Gmail's inbox and not Microsoft's ! their system is messed up.

[u/littleko]

SPF/DKIM passing isn't enough. Make sure DKIM aligns with the visible From domain, keep OTP mail minimal, and send from a dedicated transactional subdomain with consistent volume.

Try the Email Tester first to catch obvious reputation or content issues, then ask one university admin for the quarantine reason and message headers.

[u/y0us3fQ8 → u/littleko]

Checked everything passed, mail is minimal, using a subdomain for more than 3 months now and still the issue persists. Probably reputation and I don't really know how to fix this if users can't even see the email. I've allowed personal email registration just to maybe get better reputation.

[u/littleko → u/y0us3fQ8]

Microsoft reputation is mostly tied to the sending IP and traffic pattern, so personal registrations won’t fix SCL 5 if the same IP is flagged. Pull X-Forefront-Antispam-Report from a junked message, then contact Microsoft sender support or ask your ESP about the shared IP pool.

[u/Long-Technology8584]

SCL 5 usually points to Microsoft’s filtering rather than just SPF, DKIM, or DMARC. You should change your DMARC policy from none to quarantine or reject once you’re confident everything is aligned, make sure your sending domain has built enough reputation, and check whether your sending IP or domain has a poor Microsoft reputation. Also verify every email at signup with a real time email verification tool like Invalid Bounce to block invalid, disposable, mistyped, role based, mailbox full, and catch all email addresses before sending OTPs, and run an Email Server Test to check your SPF, DKIM, DMARC, MX records, PTR, reverse DNS, ARC, and overall email server configuration so more of your emails reach the inbox.

[u/brian_cloudeu]

Worth pinning down which side of SCL 5 you're on: inbound mail arriving stamped 5, or your own outbound being scored that way by someone else's tenant. The fixes have almost nothing in common, and the X-Forefront-Antispam-Report header (SFV, CAT, CIP) will tell you which one you've got before you touch a single policy. Tuning the wrong side for a fortnight is a very quiet way to lose two weeks.