A specific Zoom webinar invitation is being delivered directly to Deleted Items for every recipient, while other messages from the same sender arrive normally. I checked transport rules, Defender actions, hidden mailbox rules, and Outlook on the web, but nothing explains it. Message trace shows the email passing through the disclaimer and Safe Links rules, then being delivered to Deleted Items. The headers show SCL -1, CAT:NONE, and SFV:SKN, suggesting the message was treated as trusted rather than spam. The message also contains Authentication-Results showing SPF softfail, DKIM failure, and DMARC failure, although Authentication-Results-Original shows all three passing. What could be forcing this message into Deleted Items?
3 Answers
Submit the original message through the Microsoft Defender analysis workflow and review the resulting verdict and delivery explanation. Also inspect the expanded message-trace details around the Deleted Items delivery event. Those records can identify whether the move happened during mailbox processing, through a policy action, or from a client-side rule that is not obvious in the normal rule list.
The SPF, DKIM, and DMARC failures are worth investigating, but they normally lead to rejection, quarantine, or junk handling—not a normal delivery to Deleted Items. The important clue is the mailbox-delivery destination, so I would expand the full message-trace event and check whether an inbox rule, client rule, or post-delivery action is being recorded there.
That was my thought too. A policy failure alone would not usually explain a direct move to Deleted Items, especially with SCL set to -1.
Check mailbox rules from Outlook on the web as well as the desktop client, including hidden or corrupted rules. Since every recipient is affected, also compare the exact message headers and recipient handling. It may be a sender-specific rule, a stale client rule, or a rule created by a security product rather than a transport rule.
The rules and web client were checked, and the behavior affects all recipients. Other messages from the sender work normally; only mail from the no-reply Zoom address is being moved.
That analysis should be more useful than the summary trace. The conflicting authentication results may indicate the message was modified or reprocessed somewhere before final delivery, so preserving the original headers is important.