Our organization is having a serious issue with legitimate messages being flagged by Proofpoint Essentials, especially emails sent from an on-site mail server that relay through Proofpoint and messages destined for the finance team. Support has a P1 ticket, but the bigger problem is that messages marked as remediated and released from Proofpoint quarantine are not arriving in our Microsoft 365 mailboxes. This is the first time we have encountered an issue like this, so I'm trying to determine whether it is widespread or specific to our configuration.
3 Answers
Treat the false positives and the failed releases as two separate problems. Take one released message ID from Proofpoint and run a message trace in the Microsoft 365 admin center. That should show whether the message was rejected, quarantined again, redirected, or never re-injected. If Proofpoint reports a successful release but Microsoft 365 has no trace at all, that points strongly to a vendor-side delivery problem.
Check Microsoft Defender quarantine as well as Proofpoint. A common pattern is that Proofpoint releases the message, it comes back through the inbound connector, and Exchange Online quarantines it a second time. Message trace will show where it stopped. Also verify that the connector only accepts the expected Proofpoint hosts and that the released message is actually arriving through that connector. If appropriate for your setup, review enhanced filtering and connector transport rules so Microsoft 365 evaluates the original sender correctly instead of treating Proofpoint as the source.
The finance-specific targeting could indicate a change in impersonation, supplier-risk, or lookalike-domain detection rather than a general mail outage. It’s also worth checking whether other organizations using Proofpoint are seeing delivery problems with the same senders. Another report mentioned that messages to and from Proofpoint-protected recipients were failing too, so there may be a broader service-side issue, but the trace data should distinguish that from a local connector or mail-flow rule problem.
That’s helpful. I’ll compare the Proofpoint release records with Microsoft 365 message traces instead of assuming that a successful release means delivery. The possibility of a second quarantine would explain why users never see the messages.