A Staffing Firm's Microsoft Email Went From 100% Spam to 100% Inbox in Seven Days

The client is a staffing and recruiting firm that runs candidate outreach, business development, and daily client communications from a single domain on Microsoft 365. Their sending is deliberate and one-to-one, not high-volume blasting. They came to us in August 2026, the week new mail to established contacts stopped reaching inboxes.

Brand-new emails to existing contacts had suddenly stopped landing. There were no bounces, and Microsoft's mail trace reported every message as "delivered." That reassurance was the trap. A trace only confirms the receiving server accepted the message. It says nothing about where the message went after that: inbox, junk folder, or quarantine. Two active deals were mid-conversation when the outbound went quiet, and the firm had no way to see why.

Our seed testing put placement at 75% inbox and 25% spam. The failures were not spread evenly. They sat almost entirely at Microsoft-hosted mailboxes, which returned 100% spam, while nearly every other provider inboxed at 100%. Because the firm's audience lives mostly on Microsoft 365, that one block explained the entire reported symptom. Authentication was clean the whole time (SPF, DKIM, and DMARC all passed), so this was never a configuration error.

The placement test showed us where mail landed. The message headers showed us why. Microsoft's machine-learning filter was scoring the firm's external recruiting messages against its "recruitment phishing" profile, the pattern it uses to catch credential-harvesting scams that impersonate recruiters. Real recruiting outreach and that scam pattern look nearly identical to the model. Both talk about hiring and candidates, both ask the reader to schedule time, and both come from a sender the recipient rarely hears from.

The deeper problem was structural. Cold outreach and client communication shared one domain, so the phishing classification bled onto legitimate mail. That is why old email threads kept delivering while new sends vanished into quarantine.

Rather than move DNS on a hunch, we escalated directly to Microsoft's anti-abuse, deliverability, and email teams and secured a mitigation that cleared the false positive for Microsoft 365 delivery. Then we retested to confirm it held. The lasting fix was separation. Candidate outreach and business development move onto dedicated domains, so cold traffic can never contaminate client mail again.