Why are Zoom webinar emails being delivered straight to Deleted Items?
Asked by
MellowCedar47
A specific Zoom webinar invitation is immediately delivered to Deleted Items for every recipient in the organization. Transport rules, Defender actions, hidden mailbox rules, Outlook, and webmail rules have been checked without finding anything responsible. The message has SCL -1 and is marked as skipped by filtering, but the headers still show `X-Microsoft-Antispam-Mailbox-Delivery: dest:D`. Message trace shows the disclaimer and Safe Links transport rules processing successfully, followed by delivery to Deleted Items. Authentication results are inconsistent: the original SPF, DKIM, and DMARC checks passed, while Microsoft's later checks show SPF softfail, DKIM body-hash failure, and DMARC failure. Other messages from the sender arrive normally; only messages from the no-reply Zoom address are affected. What could be forcing these messages into Deleted Items?
Answers
Check the complete message trace details and expand the delivery event. It may identify a specific mailbox rule, client action, or post-delivery operation that the high-level trace output does not show. Also compare the raw headers of a working message from the same sender with one that is deleted.
Reply to this answer
Even if Outlook rules look clean, check rules through webmail and review any hidden or server-side rules. A compromised account can have an obscure rule that moves messages based on sender or subject, although the fact that every recipient is affected makes a tenant-wide filtering or sender-specific issue more likely.
Reply to this answer
Submit the message through Microsoft’s Defender message analysis or submission workflow and review the verdict after processing. It can expose a filtering or delivery reason that is not obvious from the headers. The sender should also verify that the message is not being modified after the original SPF and DKIM checks, since the later DKIM body-hash failure and DMARC failure could indicate rewriting or a forwarding/gateway issue.
Reply to this answer
The authentication failures are worth investigating, but they normally lead to quarantine, junk, or rejection rather than directly moving a message to Deleted Items. The `dest:D` value indicates the mailbox delivery location, so the cause may be a mailbox-level action rather than the spam score itself.
Reply to this answer
The disclaimer and Safe Links rules may not be the direct cause, but temporarily excluding a test message from those rules could help isolate where the destination changes. Since the message is being rewritten or evaluated differently later in the path, compare the gateway output, transport processing, and final mailbox headers rather than relying only on the initial authentication results.
Reply to this answer
Add your answer
Answers are reviewed before publication.
MellowCedar47: I checked both Outlook and webmail, including hidden rules, and found nothing unusual. Since this happens to all recipients and only affects this particular no-reply address, it does not look like an individual mailbox rule.