A specific Zoom webinar invitation is immediately delivered to Deleted Items for every recipient in the organization. Transport rules, Defender actions, hidden mailbox rules, Outlook, and webmail rules have been checked without finding anything responsible. The message has SCL -1 and is marked as skipped by filtering, but the headers still show `X-Microsoft-Antispam-Mailbox-Delivery: dest:D`. Message trace shows the disclaimer and Safe Links transport rules processing successfully, followed by delivery to Deleted Items. Authentication results are inconsistent: the original SPF, DKIM, and DMARC checks passed, while Microsoft's later checks show SPF softfail, DKIM body-hash failure, and DMARC failure. Other messages from the sender arrive normally; only messages from the no-reply Zoom address are affected. What could be forcing these messages into Deleted Items?
3 Answers
Submit the message through Microsoft’s Defender message analysis or submission workflow and review the verdict after processing. It can expose a filtering or delivery reason that is not obvious from the headers. The sender should also verify that the message is not being modified after the original SPF and DKIM checks, since the later DKIM body-hash failure and DMARC failure could indicate rewriting or a forwarding/gateway issue.
Even if Outlook rules look clean, check rules through webmail and review any hidden or server-side rules. A compromised account can have an obscure rule that moves messages based on sender or subject, although the fact that every recipient is affected makes a tenant-wide filtering or sender-specific issue more likely.
Check the complete message trace details and expand the delivery event. It may identify a specific mailbox rule, client action, or post-delivery operation that the high-level trace output does not show. Also compare the raw headers of a working message from the same sender with one that is deleted.
I checked both Outlook and webmail, including hidden rules, and found nothing unusual. Since this happens to all recipients and only affects this particular no-reply address, it does not look like an individual mailbox rule.