The big reason is enterprises buy into O365 and running their email through Outlook instead of on-prem or at another provider is part of that. For the same reason they use Teams over Zoom or Slack or other alternatives.

No worries. If you migrate your email server to Azure(TM) the delivery is guaranteed.

Keep a few throwaway Hotmail/Outlook addresses in your password manager, in case you need to use a Windows PC that demands a Microslop account. That's about the end of their usefulness.

Just like Internet Explorer used to be the program you used once -- and only once -- to download a proper browser.

One IP address (exclusively ours) among our email IPs at my place of employment was affected. We have used that IP for nine years. Emails are strictly transactional (receipts, password resets, et cetera).

The "rate limiting" started two weeks ago, giving us a code that Microsoft's documentation doesn't even list. It remains unresolved. Never had critical issues like this on our transactional IPs prior to this, and this particular IP address is still delivering just fine to other consumer and corporate email systems.

> There's no hint as to how many users were actually affected.

How many users would you see as the threshold then?

Since you stated that there is a spin to this, how many users would go over your defined threshold level?

outlook.com and Office 365 are very different beasts. with the latter problems are more often something (mis)configured by the customer/administrator of the 365 account rather than microsoft themselves, and there are steps the customer can take to work around the issue. With outlook.com there is nothing the recipient can do.

My org (USA) was affected. I wasn't the primary person dealing with it, but from what I gather one user marked one of our emails as junk, and then suddenly all of our emails to Outlook users started getting blocked.

Your intuition is way off, like dangerously off. But your comment is a great example to show a smug lawyer at Microsoft when they try to say there is no basis for the claim that these blocks against legitimate senders are defamatory.

This has been affecting reputable senders who take spam reporting seriously, including MXRoute and Discourse.

> No reports probably means your reporting system is broken.

"No reports" can mean a lot of things. There is no "probably".

The "you" in "your" is Microsoft because under a certain volume of email, they don't even send reports. I regularly test the abuse contact address for my server because of this exact unfair assumption - that it must be my fault. I have never once gotten an abuse report notification from Microsoft, but I have gotten a bounce message saying that I'm blocked because I apparently send spam! Btw, this was in reply to an email from a Microsoft user.

Worse, I figured I'd just disallow any email from a Microsoft property - if an outlook (or hotmail or live or anyone else) sends an email, I can just bounce it and tell them to use a different service to reach me since I can't reply. Nope! Microsoft won't surface the bounce message to the user.

So, I am barred from replying to Microsoft emails. I am also barred from informing the sender that their email won't reach me.

It's defamation - the sender is always going to assume that it is my fault if I didn't reply even if the reason I "didn't reply" is outside of my control.

> So putting that together, it seems like a small ISP screwed up and let spammers go wild, and Outlook blocked them for it. I can't really fault Outlook for that.

Yes, in your imagined scenario, you can't really fault outlook. In the real world, however, outlook is very much to blame.

This is the price every small sender pays. The unblock request process is essentially designed to make you give up or move to a large ESP. There's no appeals process, no SLA, no acknowledgment that your reputation data might just be wrong. You're at the mercy of a system that treats false positives as acceptable damage.

BTW your domain is missing SPF and DMARC records.

This is an extremely widespread issue. I send close to a million emails per month across dozens of different providers (all newsletters.) These are all from high reputation domains and email accounts. We are completely unable to make anything happen with Microslop. It is infuriating.

The article has hyperlinks in it, e.g. to this:

https://learn.microsoft.com/en-us/answers/questions/5786144/...

which comes from an ESP serving millions of users.

You could start the process now, before the ruin?

Agreed. I was an early outlook.com user (was working at MS when it launched, I think internal users got slightly early access allowing me to claim a nicer name than my Gmail) but despite having well over a decade of accounts tied to it got so angry at certain messages never appearing that a couple of years ago I reversed the flow of forwarding and swapped to another account as my primary.

Sounds like it's gotten even worse.

It's certainly not free to run and maybe it doesn't really make sense for Microsoft to run Outlook.com anymore, except that it's an easy way to motivate people to having a Microsoft account.

Outlook.com certainly has to show up as an expense, one that Microsoft would like to reduce. When you look at what other providers charge for a single email account, it's hard to see Microsoft making money of Outlook.com. There's obviously something to be said for scale, but still, it must cost them something.

Often these "spam" reports by end users are just accidental clicks as well. Many of the abuse reports we get are like an email from someone's Mum and visibly legitimate. At other times there are users who use the Report Spam function as a kind of inbox management tool - a way of moving mail away so they don't have to see it because Trash or Delete or whatever is just further away from their pointer.

I wonder how many accounts on other services were then hijacked using "forgot my password" attacks.

UPDATE: After a bit of digging it looks like they started the username recycling policy in 2013, may have quietly stopped doing that in 2018 but formalized no longer doing that in 2021: https://web.archive.org/web/20230627104616/https://www.micro...

"Summary of changes to the Microsoft Services Agreement – June 15, 2021 [...] In the Outlook and Office Services sections, we’ve removed the Outlook.com section to clarify that an email address or username is not recycled into our system or assigned to another user."

They wiped all the emails from my 25 year old Hotmail account. Pretty weak. I refuse to use Microsoft products except if forced, and do my best to evangelize this position.

Someone recently leveraged some kind of automated spam attack against my domain using Zendesk's email servers. For some reason, Zendesk doesn't enforce SPF and DKIM checks when opening new tickets, so I got flooded with "your new account has been registered" and "thank you for filing a ticket" emails.

I blocked off Zendesk entirely because they didn't fix their shitty email system. The other newsletter mail services (mailgun/sendgrid/etc.) are just as bad for this.

There are plenty of reasons why large email senders could (and should) be on reputation blacklists. None of these email delivery companies seem to care very much about the spam they send until shit hits the fan, and now that it did it seems everyone blames the people maintaining the blacklists.

I learned this lesson the hard way with OneDrive.

Now I only use Windows for legacy software that my customers force on me.

Fedora has not just been liberating, but jaw dropping. I actually felt offended that I had wasted so much time on debian-family/ubuntu/mint and windows.

I would start migrating to an email domain that you control. It will come useful at one point or another.

I always thought of outlook.com as a rebranding of Hotmail (which itself had been continually evolving, was probably actually “Live” at that point), I would expect it is the same (ever evolving) infrastructure.

In which case, people like me with an @hotmail.com address from the 90’s were much earlier users of the outlook.com email boxes than when the domain was “launched” by Microsoft.

> it's an easy way to motivate people to having a Microsoft account.

Can you actually use a non-outlook account for windows? Or are you talking about a different kind of "ms account"?

>It's certainly not free to run and maybe it doesn't really make sense for Microsoft to run Outlook.com anymore, except that it's an easy way to motivate people to having a Microsoft account.

it also funnels people into using exchange for work. more like a "marketing expense".

It's wild to me they ever started doing this in the first place. And in 2013 no less, it isn't like the hijacking risk was some far off concept at that point.

I tell my friends and family to never click unsubscribe links, unless they had proactively subscribed. Buying something from a company that requires an email does not count. unsolicited marketing emails are spam and should be treated as such. Double so if that company sends marketing emails disguised behind support@company.com.

"Report spam" is quicker and easier than "unsubscribe".

Gmail added a popup asking the user if they want to unsubscribe when flagging a newsletter with the appropriate unsubscribe headers, so it must be common enough to warrant Gmail developer attention.

Most people will never pay for email service. Which leaves you Google, MS or god forbid your own ISP.

This was widespread, I was also affected. I think you can create spoof tickets / accounts over Https with no verification and zendesk don't want to do anything which adds friction.

OneDrive was born enshittified.

The concept, way back when, was great. I tried to use it, by a previous name, for replicating / distributing data backups and it always worked great... for a few days, maybe weeks. And then something unrecoverable went wrong, and I had to re-set it up essentially from scratch and it worked great... for a few days, maybe weeks. And then something unrecoverable went wrong.

In the intervening 15+ years, OneDrive has never made my experience of computing better. It has only ever nagged, slowed, and failed. And that was before Microslop went down the x% AI coding path.

Yep this. I migrated from Gmail to my own domain years ago. It was painful. Weirdly enough, I think the longest holdouts were my parents, who were still sending email to my Gmail account a decade after I stopped using the address.

I moved my email to Fastmail, and I’ve been very happy ever since. But now that I own the domain, moving to a different provider - if I ever need to - would be trivial.

> Double so if that company sends marketing emails disguised behind support@company.com

That’s typically not a disguise but a clear means of indicating that you can reply to the email

Pretty sure hotmail/outlook also has the same sort of popup for spam reports. I think accidental would be kind of hard with that popup.

Does gmail still insert ads in the free tier? That would be a reason to keep people reading as many emails as possible.

> Gmail added a popup asking the user if they want to unsubscribe when flagging a newsletter with the appropriate unsubscribe headers

Unfortunately close to 100% of the spam I'm flagging causes this popup now :-/

I'm getting a dozen spam a day now on my Gmail account ... I think they're losing the battle.

I moved to Fastmail, set it up with Gmail so I received forwarded emails. Years later there’s still a long tail of senders using my Gmail, but I get the emails forwarded, and only actually log in to Gmail every six months or so.

I personally like when you open any office doc, do nothing to it before closing and you get the scary warning asking if you want to save your document (to onedrive) implying all is lost if you select no. I am sure millions of tech unsavvy people have been conned into sending their data to Bill Gates.

How is it not a disguise? It means you can't block marketing emails without also blocking the legitimate support emails.

No, sending marketing from support emails is almost certainly trying to game spam filters. Marketing@company.com would work for the allow replies purpose.

> sending marketing from support emails is almost certainly trying to game spam filters

That is not how spam filters work.

If I've interacted with a specific email address, like support@company.com, my email provider will put them in my inbox.