Why is Hotmail Spam Filtering So Bad???

Where is the option to change the automatic filter? I click the delete group, and the junk option isn't there. I've been trying to find it for days and days

Mancy - MSFT in March 2022 referred to features that are no longer available.

If outlook is sending these messages to Junk, they're considered to be "blocked." There is nothing else that you can do except delete them manually if you don't want to wait for automatic deletion.

If they're in the Inbox, click on the 3 dots just above the message then Report > Report junk.

Don

Where is the option to change the automatic filter? I click the delete group, and the junk option isn't there. I've been trying to find it for days and days

Hello,

I went through their "Microsoft Support" account on Twitter : https://twitter.com/MicrosoftHelps

First I explained the issue receiving a lot of junk everyday and that the filter in outlook doesn't seem to do anything as obvious junk are going through.

First they told me to block the sender, which isn't possible as there is no real sender and Outlook.com doesn't even allow that option (because can't block a sender if there is none).

Then they asked me to check the header (i didn't know how to do that in outlook webapp, just click on the three dots above in the email, then View then "mesage source" (mine is in French so i'm translating, it might be something else in yours).

Basically when you send an email it goes through different servers before reaching the final destination. Each server will add some information (the "Received from" in the header). In that header you see the different check and information provided in the initial email and you see the check done by Microsoft server.

The SPF means Sender Policy Framework (SPF) is an email-authentication standard used to prevent spammers from sending messages that appear to come from a spoofed domain. It also helps to ensure that emails are delivered correctly – without being delivered to a recipient's spam box. This alone would stop 95% of the junk normally. If there is no spf, the email should be considered as spam every time.

Then you have the DKIM (DomainKeys Identified Mail) is a protocol that allows an organization to take responsibility for transmitting a message by signing it in a way that mailbox providers can verify. DKIM record verification is made possible through cryptographic authentication. It's not used that much (but it is used by biggest companies normally who rotate the key each 6 months). I understand this one is not set on by default but it should at least be an option in outlook.com. I would prefer to check if a real mail has been put in my junk instead of cleaning my mailbox everyday.

The DMARC combines each of the protection together to confirm a global conformance. Normally when you have such a header the email should always be considered as SPAM, but it's not the case for outlook.com :

Authentication-Results: spf=none (sender IP is 5.253.247.222)
 smtp.helo=avtekuw.club; dkim=none (message not signed)
 header.d=none;dmarc=none action=none
 header.from=enews.electrabel.com;compauth=pass reason=105
Received-SPF: None (protection.outlook.com: avtekuw.club does not designate
 permitted sender hosts)

And i'm indeed submitting the phishing via the webapp. I didn't get any reply "not delivered" lately so it might have been a bug at their side. I'm still reporting 10 emails per day as phishing and they keep coming unfortunately. With the same header.

Honestly if they could add a single option for SPF / DKIM that would already change everything.

I'd love to also bug the Twitter folks about this issue. I'm not an expert in email transport, can I ask you what you found the best approach and how you got the best milage out of the exchange?

What I understand from your post is, in the Message header, evidence that SPF failed is the dkim = none and the dmarc is not present (=none) <-- if those conditions are present in the message header, it's a clear sign of a fake email. If I have that wrong somehow, please educate me so I can ask them the right way. (I'll check my headers but I think I've seen at least the dkim before.)

I figure if more folks start bugging them, there's a % chance they will take some steps to improve the filters so we all don't have to make a million rules!

And just separately, when I submit a Junk or Phishing report via webmail (logging into outlook or hotmail.com via a browser), I don't get a message back saying it was rejected, I don't get anything back at all in fact. But you say you are in the web-based outlook.com also, right?

So, i've been for 4 days in discussion with Microsoft support on Twitter. Doesn't look like they understand anything, they keep sending me to "how to enable junk protection" or "mark them as phishing". It looks like only the web version of outlook.com is making real submission of phishing emails. The Android app might not do anything.

So I tried via the Web App, and now for each report I get an autoreply from Microsoft. It appears that they reject those submissions because they detect it as spam. So somewhere they have a filter working, just not using it on outlook/hotmail:

Diagnostic information for administrators: 

Generating server: TYCPR01MB10762.jpnprd01.prod.outlook.com 

******@outlooksen.onmicrosoft.com 

Remote server returned '550 5.7.520 Message blocked because it contains content identified as spam. AS(4810)' 

Original message headers: 

Received: from TYAPR01CA0171.jpnprd01.prod.outlook.com (2603:1096:404:ba::15) 

 by TYCPR01MB10762.jpnprd01.prod.outlook.com (2603:1096:400:296::13) with 

 Microsoft SMTP Server (version=TLS1_2, 

 cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6277.31; Thu, 6 Apr 

 2023 20:21:39 +0000 

Received: from TYDGAS01FC006.eop-gas01.prod.protection.outlook.com 

 (2603:1096:404:ba:cafe::74) by TYAPR01CA0171.outlook.office365.com 

 (2603:1096:404:ba::15) with Microsoft SMTP Server (version=TLS1_2, 

 cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6277.31 via Frontend 

 Transport; Thu, 6 Apr 2023 20:21:39 +0000 

Received: from DM5SVC01SF008 (2a01:111:f400:ffe2::126) by 

 TYDGAS01FC006.mail.protection.outlook.com (2603:1096:2209:a::77) with 

 Microsoft SMTP Server (version=TLS1_2, 

 cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.6298.19 via Frontend 

 Transport; Thu, 6 Apr 2023 20:21:39 +0000 

X-IncomingTopHeaderMarker: OriginalChecksum:D7FDA99FCC04D8977A2380F1DADF0AF0F0A0292CDDCC6E1A443E273166B51EA1;UpperCasedChecksum:2B6D96E1B0088ADF28B92861D4D0C1F7AC1ED8F21B08CB5FF9596CF41E2E2CAD;SizeAsReceived:319;Count:6 

From: <> 

Subject: Consumer submission forwarded from XMR 

To: <******@outlooksen.onmicrosoft.com> 

MIME-Version: 1.0  

X-MS-Exchange-KEStore-Submitter-Organization-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa 

Content-Type: multipart/mixed; 

	boundary="5B7FB9FC-1159-45CC-BD54-B8DE83FC5203" 

X-IncomingHeaderCount: 6 

Message-ID: <******@TYDGAS01FC006.eop-gas01.prod.protection.outlook.com> 

Return-Path: ******@outlook.com 

Date: Thu, 6 Apr 2023 20:21:39 +0000 

X-EOPAttributedMessage: 0 

X-MS-PublicTrafficType: Email 

X-MS-TrafficTypeDiagnostic: TYDGAS01FC006:EE_|TYCPR01MB10762:EE_ 

X-MS-Office365-Filtering-Correlation-Id: 56bc1e37-aefe-48d0-17bf-08db36dc8798 

X-Microsoft-Antispam: BCL:0; 

X-Microsoft-Antispam-Message-Info: 

	pYk890e8Ke4CSTX4f9eP8FbkiwbA1MWtzz+SE6iOLkWTAgmaAAJxpZsDr9tgxRq/R5vUl9giKhu/zMTUGqrFj4vlzjE6jtAA8lUszHcOh+iwRyof9tm2Y6tY7xqQv5C5ZVxYXCaBtAAP9todD8EldSubPbTAHgeRqALog1mm112GeEn7G4UD8CiKkRc25Rrp6VuIbhBMpZ+Wn+bIt1d3HgAa9RLumMsPcZfdcSy1+VOI2VSxovlRzc+wbNSE6oM/m+Ss6DE3VszmUkxtbVT7qzslphc2TdG4s2HapmiolJhS5XGLlmzzPpXeaZ6kVVSV/Nu5XUG9ZyRSsorA6dZppoQ6kB468SISrhsFXGjCkHm+8U/Ne5y6zDkVsoOqyxuGlVC/NCzrvtfo06SqAsTroRDgl/A29UpoLgOPYvVuLAjRMgP232/5FdH0hNvK5Vi/itOF6xNnKAeplZi1kquwza9g4Kulh4b3UeyhAQM4Ab2MZx9TW6z1zYe67Qx9S6O7zLUNJU3GYeTIMncF6f1zQ4ClN0OZAKtPAkuHgt552Kn3rLf56jhcLw7pn73RC4yCCUNW8bRqCNYqbXWm71rQCNGDyuaW4tWoOxdTzlXZ2BE=