Tell HN: Microsoft classifies own emails as junk

[YellowTech]

While going through my Outlook junk folder, I noticed that nearly all my Azure related mails are classified as such.

These e-mails are all real and also sent by addresses like [email protected] with the source SMTP server being in a subdomain of PROD.OUTLOOK.COM.

How comes that Microsoft would not just whitelist their own domains on their own e-mail service?

[zvolsky]

The fact that Microsoft doesn't just whitelist their own domains speaks to their commitment to strict security measures and good engineering culture. Special cases aren't special enough to break the rules.

[wongarsu]

If they don't whitelist and use the rate at which their own emails end as spam to improve their spam filter, that's great engineering culture.

If they don't whitelist and the emails just land in spam without anyone taking notice, that reminds me more of the well-known slightly satirical image of Microsoft's org chart [1]

1: https://bonkersworld.net/organizational-charts

[zenexer]

On the other hand, `notify.trafficmanager.net.`, the domain name used for Edge push notifications through Azure Traffic Manager, currently points to `notify1.ontario.ca.` with a CNAME record. This resulted in an Edge push notification outage a couple weeks ago, but they never fully fixed it. Push notifications are working again because they use subdomains of `notify.trafficmanager.net`, but `notify.trafficmanager.net` itself is simultaneously used by one of their Azure customers--and they seemingly have no idea.

In other words: `*.notify.trafficmanager.net` is special-cased, and this has caused problems.

[toomanydoubts]

>speaks to their commitment to strict security measures and good engineering culture

Does it really or does it just mean that nobody cared enough to do it for whatever reason?

[supernova87a]

Good engineering culture?

I hope this refers to something behind the scenes that I as a Hotmail/Outlook user am unable to see. Because UI and product-wise, I don't see much evidence at all that someone of a good engineering culture cares about the experience I'm having with the product.

More like a team phoning it in.

[nuccy]

Moreover they don't even whitelist their own IPs for some basic checks like SPF, which can be skipped. I have a work email (using Microsoft services) and another company mailing list, which my email is member of (also on Microsoft). At some point sending email to that mailing list triggered bouncing between Microsoft own servers eventually resulting in my email being automatically removed from mailing list. Basic investigation showed that one Microsoft server rejected emails from another one because of bad SPF record. Either company spent months solving the issue with Microsoft. The issue disappeared eventually magically the same way it appeared.

[closeparen]

Teaching people to look for official communication from Microsoft in their spam folders invites phishing attacks. Fastmail puts a special seal on account-related communications from Fastmail; I think that’s good and wise.

[paultopia]

You'd think that they'd have a non-domain-based way to do it, like cryptographically signing their own damn emails with a key embedded in outlook or something.

[wrldos]

Then they go and immediately go and shaft you with a set of non-opt-outable welcome emails with Windows 11. I think any credit due can be shoved up their ass.

[Spooky23]

They can and do whitelist all sorts of things for special cases. Microsoft is good at what they do, but they are a pragmatic company.

My guess here is that some junk folder routing is on client side, or the user flagged junky email from the same infrastructure as junk. Or, O365 tweaked some settings to address the issues with spammers using Outlook infrastructure that bypasses spam controls.

[drowsspa]

Is this sarcasm?

[layer8]

Wouldn’t whitelisting their own products also constitute anticompetitive behavior?

[rkagerer]

Now that it's hit the HN front page and will presumably be drawn to light of some managers, it will be interesting to see if the behavior remains the same in a few weeks.

[bee_rider]

It is a good first step.

They know these are legitimate emails though, so they should treat their presence in the spam folder as essentially a bug report.

[gghffguhvc]

Please use "allowlist"

[manuelmoreale]

Mentioned before in another thread. Google workspace flagged an email from Google domains as spam. And it wasn't even a marketing email from them. It was a reminder that I had a .dev domain about to be renewed. I guess that's what happens when you're just too big. And I don't blame the Gmail team. Google has probably launched and killed a thousand products with a thousand domains so curating that whitelist is probably a hard job

[thomaslord]

I've run into this issue when creating G Suite accounts and sending the initial welcome email (with password reset link) to a user's personal Gmail account. Somehow delivering an email with content written by Google, from Google to Google, is an issue.

[donmcronald]

They don't even need a curated whitelist for high value domains do they? If they've seen 1 million emails from @domains.google and <.1% got flagged as spam, isn't that a good enough indicator to consider the domain a good actor?

I can understand the difficulty in judging new domains, but having established, high value, high volume domains getting their email flagged as spam is ridiculous.

It could also be anti-competitive behaviour. They want the system to be a complex, opaque, black box because then it's more important for other providers to trust their IP ranges because they're a known-good participant. If you're a small sender that wants decent deliverability your options are Google, MS, etc..

[YellowTech]

The specific emails that were marked for me were also reminders about a subscription. Interesting!

[PaulHoule]

After failed Sears and Roebucks, I think Microsoft is the #2 company of all time for "the right hand doesn't know what the left is doing."

It's notorious that they have a hard time replicating products that competitors make look simple: look how the Steam store really works for for games, or how Dropbox works so much better than Onedrive.

[qsort]

Yes, I can't wrap my head around the fact that VS Code and Teams came out of the same company. That the same people who thought "it's a good idea to use CS theory to add a type system to Javascript" are the same people who thought "it's a good idea to put ads in the start menu".

[patja]

When OneDrive works it is nice. Problem is that when it doesn't work, you can be in for a hell of a ride trying to get it working.

I just finished spending more hours than I want to count trying to clean my dad's PC of all licensing and account connections to his former employer's use of Office and OneDrive and onto his personal account and license. In hindsight I wish I had just nuked and paved it, or bought him an iPad with keyboard and mouse.

[crazygringo]

No, literally every large company with a wide variety of products is like that.

It's a fundamental problem of organizations operating across a wide variety of domains, because communication doesn't scale.

[permo-w]

has dropbox not been on life support for a good 5 years now?

[Zetobal]

The gun meme always seemed kind of fitting.

https://i.insider.com/4e0b3416cadcbb0d37010000?width=400&for...

[hooby]

It would seem they actually do whitelist some of their own stuff - specifically those weird "Microsoft Viva" emails that Outlook users get.

A year or two ago, I did get Outlook to classify those emails as "Junk" automatically, by repeatedly reporting them - but then something changed, and after that they never were marked as "junk" again - no matter how often I do report them.

[zamadatix]

I've never gotten a Microsoft Viva email across a couple of O365 accounts but none of the orgs ever set up Viva to my knowledge. If it's something your org set up it'd make sense it could break the rules, otherwise dunno.

[JohnFen]

Those emails are awful, but in fairness to Microsoft, there is a link in them that takes you to the settings page where you can turn them off. It worked for me, and I haven't received another one after that.

[InfamousRece]

It’s possible that many users classify them as junk and so the Bayesian filters learn from that. Plus they might actually be junk. The filters are usually content based.

[rollcat]

Yep, my first reaction was, "seems to work as designed". The fix isn't to whitelist, the fix is to make their own emails more relevant (or easier to unsubscribe from).

[brightball]

Microsoft's disjointed approach to email doesn't surprise me here. They're actively enabling more phishing and fraud by not respecting the DMARC standard or participating in sending aggregate reports.

For all that people like to bag on Google recently, Google has worked harder than anybody on this.

[donmcronald]

> They're actively enabling more phishing and fraud by not respecting the DMARC standard or participating in sending aggregate reports.

Yep. There are situations where they'll simply ignore DMARC aligned messages if they don't like the content, filter them into (admin only) quarantine, and refuse to let you create rules for special cases so you receive important messages.

I know because I've had it happen.

[natch]

> For all that people like to bag on Google recently, Google has worked harder than anybody on this.

Oh come on. Back when they first built Gmail, maybe sure.

But in the last 10 years or so? They’ve been totally ignoring the fact that they categorize their own non-marketing non-spammy emails, specifically requested on specific non-spammy topics by the user, generated by Google, and sent by Google, as spam. I don’t think they have worked harder than anybody on this. Snacked harder, maybe.

[CamperBob2]

Then again, Google benefits if email goes away entirely. Ditto Meta and, yes, Microsoft.

We are seeing the initial skirmishes in a knock-down, drag-out war that users are going to lose.

[ggambetta]

Gotta appreciate the honesty!

[moffkalast]

Spam filters working as intended.

[rossdavidh]

In a roundabout way, this is to Microsoft's credit, sort of...

[jasonlotito]

Is this not what you would want? What you classify as junk might be something someone else reads. But I would want any junk filter to be based on my usage.

In fact, the suggest that they should whitelist their own domains seems to be fairly monopolistic, something Microsoft has had to deal with in the past.

This seems appropriate and right, and not any indication of anything other than things work as they should.

[mike256]

You're lucky that those mails reached your account. Don't use Microsoft services for email. Especially not outlook.com ones. Sometimes mails sent from little private mail servers just vanish. Not in Inbox, not in Spam. Also no error for the sender. Very bad.

[Double_a_92]

Something is generally wrong with Microsofts spam filter. I had to use workflows to completely disable it, because it started putting important things in it. Literally emails from people that answered to emails I initiated...

[extr0pian]

Somewhat related, I had recently tried sending an email to [email protected] and my emails were rejected. I tried a couple of times using two domains and I could only assume they were blocked because I had "microsoft" in the username (so "microsoft@[mydomain].is" and "microsoft@[mydomain].xyz". I guess it's understandable as sending an email with "microsoft" in the username could be construed as a phishing attempt against Microsoft employees.

[tims33]

Hard to believe that they've owned Hotmail/Outlook.com for over 20 years and their spam filtering is still atrocious. Gmail is 100x better and so is O365.

[theSoenke]

Since weeks I have the opposite problem that outlook.com does not seem to detect spam at all anymore. Getting a dozen obvious spam emails a day right in my inbox

[s1mon]

In other news, water is wet.

Junk email classification seems to be hard for everyone. I've seen Apple and Google do similar things with their respective email clients and messages from their own companies.

At a previous job, we might have lost a significant contract if I hadn't been checking my Gmail junk folder. A former client was trying to contact me from a new company about potential work, and Gmail must have thought the start-up's domain was risky.

[ama5322]

In my old organization, internal emails (same domain, internally sent) were regularly classified as spam if the UA wasn't outlook. "Clutter" added another circle of hell, as not only you had to explain "check your junk folder" but also "check your clutter folder".

I attributed this to the sheer incompetence of the local admins. The same organization later switched to O365, and the problem remained unchanged.

[klyrs]

I always mark that stuff junk. You're welcome.

[RajT88]

I saw a bunch of mails just now in my junk folder from Microsoft support engineers, from threads I was CC'd on. That was it though.

[JohnFen]

Since I have yet to receive an email from Microsoft that wasn't junk, I wish my Outlook installation marked it all as spam, too.

[nunez]

This was the breaking point for me leaving Microsoft 365.

I was losing a ton of important email because Microsoft would flag it as junk.

And even though I had complete admin rights over my tenant, I had no idea how to disable junk mail entirely.

(Also, fun fact, MS _still_ only gives you a 50GB mailbox! Google's at, like, a terabyte per user now...)