Start: 4-January-2023 0900 UTC
End: 4-January-2023 1330 UTC
Duration: 4 hours 30 minutes
Microsoft mistakenly flagged a link (protection.eu.inkyphishfence.com/report) in our EU/UK banners as a phish then sent emails with a banner directly to Quarantine. This resulted in most incoming email in the EU/UK regions in O365 going to Quarantine.
Microsoft began identifying protection.eu.inkyphishfence.com/report as a dangerous phish URL which then resulted in all incoming mail with that banner to be sent directly to Quarantine for O365 customers. The EU/UK Report This Email link (protection.eu.inkyphishfence.com/report) should have been added with the other Inky links on the Microsoft internal Do Not Block List, but due to an error it was not. This oversight was not caught until Microsoft’s automated systems blocked the EU/UK Report This Email link inadvertently.
We have verified that all Inky banner links are accounted for and properly formatted on Microsoft’s internal Do Not Block list. We have also added monitoring specifically for EU/UK Regions to ensure we can quickly identify any similar events in the future. We want to ensure that even after emails have been successfully handed back over to O365, they are still delivered as expected to the inbox as intended.
All incoming mail for O365 users in the EU/UK regions was being sent directly to Quarantine by Microsoft. When Microsoft corrected the issue with the false positive, they also released all emails incorrectly sent to Quarantine. This had the unintended side effect of emails that were manually released by admins earlier appear to be delivered again and replaced the original receive date with the date they were released from Quarantine.