I woke up to find that several of our clients are having issues with their scan-to-email setups since yesterday. We use Direct Send via an MX record and an IP-based Inbound Connector in Microsoft 365, and now multiple customer scans are getting flagged and quarantined. The headers indicate they're being marked as High Confidence Spam (SCL:8), with the diagnostic info showing 'IP Not on List' (IPV:NLI). I've checked and the SPF is passing, and there haven't been any changes on our printer or firewall setups. It seems like Microsoft might have increased their EOP heuristics for unauthenticated relay traffic around the same time as the High Volume Email GA a few weeks ago. I might be off base, but it feels like something has changed. We're in the process of transitioning customers to SMTP2GO, which most of them are moving to, but there are still a few relying on the M365 SMTP relay for their printers. Is anyone else experiencing this issue? Could this be a sign that the IP-connector method is becoming obsolete?
4 Answers
We just encountered this issue with one of our printers a few days ago. Super annoying!
We faced a similar issue a few weeks back with our client’s multifunction printers. SPF was passing, yet EOP flagged everything as HSPM with that IPV:NLI message. I think you’re onto something with Microsoft tightening their EOP settings. Since the connector IP isn’t recognized as a trusted sender, double-check that the connector is set up properly and that the source IP hasn’t changed (some firewalls can rotate outbound IPs). A quick fix that worked for us was to set up a transport rule to bypass spam filtering for that connector's IP range. Long term, moving to authenticated SMTP submission or using an external relay like SMTP2GO is a smart move. Microsoft has been making unauthenticated relays more difficult for a while now, and this seems like another step in that direction.
Yeah, I noticed the same thing starting yesterday with several scan-to-email devices. It’s frustrating!
I just tested it a few minutes ago and the SCL was at 1. Seems inconsistent, though.
Has everything gone back to normal for you now?