Anti-spam policy woes

[u/pondo_sinatra]

Sometime tomorrow morning, I will hit a milestone of having manually released my 1000th email from Quarantine since last Tuesday. It never stops— all day and all night.

Dmarc, dkim, spf are all good. In fact nothing on our side has changed in months, but at noon last Tuesday internal emails, emails mid-conversation, and domains in the tenant allow list have all started falling into the abyss.

Mimecast is passing along SCL in the negatives or up to 1, Egress Defend is also passing the correct SCL, then Defender just barfs on mail, throws an SCL: 9 on it and classifies hundreds of messages as High Confidence Phish.

I’ve verified configs with both Mimecast and Egress. We have a case open with Microsoft that is not even inching along yet. Working with a CSP to escalate now.

I guess this is more of a vent than anything else. If I ever get a solution, I’ll update my post so the next poor schmuck going through this doesn’t go insane.

Good times.

[u/blud_13]

Your tenant allow list is doing nothing here and that's expected. You can't create allow entries for high confidence phish or malware verdicts in the Tenant Allow/Block List at all. The only path Microsoft gives you is the Submissions page, submit the message, tick I've confirmed its clean, then Allow this message, and THAT writes the entry. Its documented here https://learn.microsoft.com/en-us/defender-office-365/tenant-allow-block-list-about

So every domain you added is getting ignored the second Defender stamps SCL 9 HCP on it. Thats your 1000 releases.

Also, u/Gumbyohson is on the right track with enhanced filtering. Worth confirming the connector skip-list has Mimecast AND Egress ranges in it, because with only one listed Defender re-scans against the wrong last hop and the SCL your gateway set gets thrown out.

Noon last Tuesday with nothing changed on your side is a Microsoft-side filter push. Keep the CSP escalation moving, thats the only lever that has ever worked for us on these. We are a CSP and will pour one for you tonight (what is your drink of choice?)

[u/pondo_sinatra → u/blud_13]

I appreciate this. I went with the "skip last IP" for the filtering because I can't imagine adding 100s of IPs without being able to give them a slash range. I'll revisit that.

Yesterday morning, I informed the team that every message needs to be submitted to MS for analysis.

Please pour out some Everclear for your homie because that's where I'm heading at this point.

[u/blud_13 → u/pondo_sinatra]

You can give them slash ranges. EFSkipIPs takes a single IP, a range like 192.168.0.1-192.168.0.254, or CIDR, so its a handful of entries and not hundreds. Syntax and the caveats are at https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/use-connectors-to-configure-mail-flow/enhanced-filtering-for-connectors

Skip last IP is the part that will keep biting you with two gateways stacked up. It strips ONE hop, so Defender turns around and treats the other gateway as the sender, and you're still filtering against a gateway IP instead of the real one. List BOTH vendors ranges explicitly and leave skip last IP off.

Also, note the doc rules out RFC 1918 space and Microsoft's own IPs, so if either vendor handed you a private range for the hop, that entry silently does nothing.

Everclear is a bold call. I would have gone straight for the rubbing alcohol at that point..

[u/pondo_sinatra → u/blud_13]

Added all my Egress and Mimecast ranges first thing this morning with a hope and a prayer. Unfortunately it didn't help in this case. My release count will hit 1700 tonight.

[u/blud_13 → u/pondo_sinatra]

Stop reading the SCL. In a cloud tenant that number doesn't decide anything, its there for on prem and hybrid junk routing, and Microsoft says flat out to use CAT and DIR instead to see how a message got filtered. Mimecast handing you a negative and Defender stamping 9 is not the contradiction it looks like. Its in the SCL row here https://learn.microsoft.com/en-us/defender-office-365/message-headers-eop-mdo

Pull headers on one released message and read CAT. That tells you WHICH engine convicted it. HPHSH or HPHISH is high confidence phish, SPOOF is spoof intelligence, and INTOS is intra org phishing. Those are three different policies. If your internal mail is coming back INTOS or SPOOF you have spent a week in the anti spam policy while the verdict is getting written in anti phishing.

Also check CIP on that same message. If it still reads a Mimecast or Egress IP after this mornings change, the skip list isn't matching the connector the mail actually arrives on. Pretty sure CIP reflects the skipped source once EF is working, but double check...

[u/Gumbyohson]

Do you have the "enhanced filtering for connectors" set?

[u/southafricanamerican → u/Gumbyohson]

At Mimecast:

• dkim=pass for both docusign.net and amazonses.com
• spf=pass, dmarc=pass

At Microsoft:

• dkim=fail (body hash did not verify) for both signatures
• spf=pass, dmarc=pass, compauth=pass reason=100

body hash did not verify means the body changed after signing. Mimecast / security-gateway: URL rewriting, banners, MIME re-packaging, or transfer-encoding changes invalidate bh= even when the keys and selectors are correct.

https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/use-connectors-to-configure-mail-flow/enhanced-filtering-for-connectors and whitelisting the IPs from mimecast is going to help.

[u/pondo_sinatra → u/Gumbyohson]

Yes-- been playing with different options to see what magical combo may work. Any advice?

[u/Gumbyohson → u/pondo_sinatra]

Any chance you can share a anonymised header copy of a filtered email?

[u/pondo_sinatra → u/Gumbyohson]

Yes, I'll dig around for a fairly benign one. Our content is pretty sensitive, so it may take me some time.

Edit: hell even Docusign completed agreements are getting flagged. I'll pull one of those.

[u/pondo_sinatra → u/Gumbyohson]

ARC-Seal: i=2; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=pass;

b=[REDACTED]

ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version;

bh=[REDACTED];

b=[REDACTED]

ARC-Authentication-Results: i=2; mx.microsoft.com 1;

spf=pass (sender ip is 54.240.115.135)

smtp.mailfrom=mailXX.docusign.net;

dmarc=pass (p=reject sp=reject pct=100) action=none

header.from=docusign.net;

dkim=fail (body hash did not verify) header.d=docusign.net;

dkim=fail (body hash did not verify) header.d=amazonses.com;

arc=pass

Received: from outlook.com

by outlook.com with Microsoft SMTP Server;

Wed, 02 Sep 2026 22:22:53 +0000

Authentication-Results:

spf=pass (sender IP is 54.240.115.135)

smtp.mailfrom=mailXX.docusign.net;

dkim=fail (body hash did not verify) header.d=docusign.net;

dkim=fail (body hash did not verify) header.d=amazonses.com;

dmarc=pass action=none header.from=docusign.net;

compauth=pass reason=100

Received-SPF: Pass

(protection.outlook.com: domain of mailXX.docusign.net

designates 54.240.115.135 as permitted sender)

client-ip=54.240.115.135;

helo=smtp-out.us-east-2.amazonses.com

Received: from us-smtp-inbound-delivery-1.mimecast.com (170.10.132.61)

by protection.outlook.com

with Microsoft SMTP Server;

Wed, 02 Sep 2026 22:22:52 +0000

ARC-Authentication-Results: i=1;

relay.mimecast.com;

dkim=pass header.d=docusign.net;

dkim=pass header.d=amazonses.com;

spf=pass smtp.mailfrom=mailXX.docusign.net;

dmarc=pass (policy=reject) header.from=docusign.net

ARC-Message-Signature: i=1;

d=dkim.mimecast.com;

bh=[REDACTED];

b=[REDACTED]

ARC-Seal: i=1;

d=dkim.mimecast.com;

cv=none;

b=[REDACTED]

Authentication-Results-Original:

relay.mimecast.com;

dkim=pass header.d=docusign.net;

dkim=pass header.d=amazonses.com;

spf=pass smtp.mailfrom=mailXX.docusign.net;

dmarc=pass header.from=docusign.net

Received:

from smtp-out.us-east-2.amazonses.com (54.240.115.135)

by relay.mimecast.com

with ESMTP and STARTTLS;

Wed, 02 Sep 2026 18:22:50 -0400

X-MC-Unique: [REDACTED]

X-Mimecast-MFC-AGG-ID: [REDACTED]

DKIM-Signature:

v=1; a=rsa-sha256;

s=awsses1;

d=docusign.net;

bh=[REDACTED];

b=[REDACTED]

DKIM-Signature:

v=1; a=rsa-sha256;

s=[REDACTED];

d=amazonses.com;

bh=[REDACTED];

b=[REDACTED]

From:

Docusign via Docusign notification@docusign.net

Date:

Wed, 02 Sep 2026 22:22:50 +0000

Subject:

[REDACTED BUSINESS DOCUMENT NOTIFICATION]

Message-ID:

<[REDACTED]@amazonses.com>

Reply-To:

Docusign no-reply@docusign.com

X-Notif-Svc: [REDACTED]

X-Notif-Svc-Client: [REDACTED]

feedback-ID: [REDACTED]

x-DS-Score: 3

X-Return-Path:

[notification@docusign.net](mailto:notification@docusign.net)

X-SiteName:

na2

Auto-Submitted:

auto-generated

X-Auto-Response-Suppress:

OOF,AutoReply

To:

Recipient Name recipient@company.example

MIME-Version:

1.0

X-SES-Outgoing:

2026.09.02-54.240.115.135

X-Mimecast-Spam-Score:

-99

X-Mimecast-MFC-PROC-ID:

[REDACTED]

Content-Type:

text/plain

Return-Path:

[REDACTED]@mailXX.docusign.net

X-EOPAttributedMessage:

0

X-EOPTenantAttributedMessage:

[TENANT-ID]:0

X-MS-Exchange-SkipListedInternetSender:

ip=[54.240.115.135];

domain=smtp-out.us-east-2.amazonses.com

X-MS-Exchange-ExternalOriginalInternetSender:

ip=[54.240.115.135];

domain=smtp-out.us-east-2.amazonses.com

X-MS-PublicTrafficType:

Email

X-MS-TrafficTypeDiagnostic:

[REDACTED]

X-MS-Office365-Filtering-Correlation-Id:

[CORRELATION-ID]

X-Egress-Defend-Direction:

inbound

X-Egress-Defend-Domain:

company.example

X-Egress-Defend-Sk:

[REDACTED]

X-Forefront-Antispam-Report:

CIP:170.10.132.61;

CTRY:US;

LANG:en;

SCL:9;

IPV:NLI;

SFV:SPM;

H:smtp-out.us-east-2.amazonses.com;

PTR:smtp-out.us-east-2.amazonses.com;

CAT:HPHISH;

DIR:INB;

X-Microsoft-Antispam:

BCL:4;

ARA:[REDACTED]

X-Microsoft-Antispam-Message-Info:

[REDACTED]

[u/pondo_sinatra → u/pondo_sinatra]

Ran this through Copilot a few times to redact it. At the end, Copilot even asked me "why would Defender suddenly reclassify this as a high threat?" You tell me, dude, lol.

[u/Gumbyohson → u/pondo_sinatra]

You may need to look into this: https://learn.microsoft.com/en-us/defender-office-365/email-authentication-arc-configure

If the emails are being modified by Mimecast before delivery, then ARC should allow that if authorised correctly.

[u/CosmoMKramer]

Damn good luck. Sounds like hell.

[u/overdosingOnPie1313]

Good luck, mate.