365 Emails being quarantined

The symptoms indicate that messages are being treated as suspicious by recipients’ Microsoft 365 filtering, especially for new recipients who have no prior interaction history with the domain. The fix is to strengthen and verify the domain’s email authentication and then use Defender/Quarantine workflows on the recipient side to train Microsoft 365 that the mail is legitimate.

Use the following steps:

1. Verify DNS and email authentication
   • Confirm that DNS is correctly configured for the sending domain (MX, SPF, DKIM, and DMARC) with the domain host. Incorrect or incomplete DNS can cause filtering issues.
   • Ensure SPF, DKIM, and DMARC are all in place and valid for the domain, as these are key signals for Microsoft 365 filtering and sender reputation.
   • Follow a gradual DMARC rollout: start with p=none, monitor, then move to p=quarantine, and finally p=reject only after confirming that all legitimate senders for the domain pass DMARC. See the DMARC rollout guidance in the context.
2. Improve and monitor sender reputation
   • Microsoft 365 uses multiple factors to decide whether to quarantine: sending IP reputation, domain reputation, email authentication, list accuracy, complaint rates, and content.
   • Ensure that:
     • No bulk or unsolicited mail is being sent from the domain.
     • Mailing lists are clean (no high bounce or complaint rates).
     • Content is not spam-like.
   • If using a new IP or recently changed sending infrastructure, expect a ramp-up period while the IP builds reputation. Maintain low complaint rates and accurate lists during this period.
3. Use DMARC monitoring to detect issues
   • With DMARC set to p=none initially, review DMARC aggregate and forensic reports to see which messages fail DMARC and why (SPF/DKIM alignment issues, unexpected senders, etc.).
   • Fix any legitimate sources that are failing DMARC before tightening the policy.
4. Work with affected customers’ admins
   • When a customer reports that messages are quarantined in Microsoft 365:
     • Ask their Microsoft 365 admin to check the Microsoft Defender for Office 365 quarantine and release the messages.
     • Admins should submit released messages to Microsoft as false positives and optionally create a temporary allow entry in the Tenant Allow/Block List. This helps Microsoft learn that the messages are legitimate and reduces future quarantining.
     • End users can also release and submit quarantined messages from their quarantine email digests, which further trains the system.
5. Continue tuning until false positives stop
   • After submissions, Microsoft adjusts filtering based on verdicts. If false positives are due to organization configuration on the recipient side, their admins can adjust policies (for example, anti-spam/anti-phishing actions) to reduce quarantine and prefer delivery to Junk Email instead.
   • On the sending side, keep monitoring DMARC/SPF/DKIM and reputation signals and avoid any practices that might look like spam.

If, after DNS and authentication are fully correct and reputation is clean, messages are still consistently quarantined across multiple Microsoft 365 tenants, the next step is for an affected recipient’s admin to open a support case with Microsoft and reference the false-positive submissions so the service-wide filters can be adjusted.

References:

• External senders - Troubleshoot email sent to Microsoft 365
• Quarantined email messages in cloud organizations
• How to handle legitimate emails getting blocked (false positives) using Microsoft Defender for Office 365
• Set up DMARC to validate the From address domain for cloud senders