Detecting Domains Where Their Emails Will Be Routed To Junk Folders Due To New Outlook Requirement
Query
EmailEvents
| where Timestamp > ago(1d)
| extend SPF = tostring(parse_json(AuthenticationDetails).SPF)
| extend DMARC = tostring(parse_json(AuthenticationDetails).DMARC)
| extend DKIM = tostring(parse_json(AuthenticationDetails).DKIM)
| where SPF !has "pass" or DMARC !has "pass" or DKIM !has "pass"
| summarize Total_Emails=count() by InternetMessageId, SenderFromDomain, SPF, DMARC, DKIM
| where Total_Emails > 4000
| order by Total_EmailsAbout this query
Explanation
This query is designed to identify email domains that are at risk of having their messages sent to the Junk folder in Outlook due to non-compliance with certain email authentication standards. Here's a simple breakdown:
-
Context: Starting May 5th, 2025, Outlook will start routing emails from high-volume domains (sending over 5,000 emails per day) to the Junk folder if they don't comply with SPF, DKIM, and DMARC standards. Eventually, non-compliant emails may be rejected entirely.
-
Purpose of the Query: The query aims to detect domains that are currently not passing these authentication checks and are sending a large volume of emails (over 4,000 emails in the past day).
-
How the Query Works:
- It looks at email events from the past day.
- It extracts the results of SPF, DKIM, and DMARC checks from the email authentication details.
- It filters out emails that fail any of these checks (i.e., SPF, DKIM, or DMARC does not have a "pass" status).
- It counts the total number of emails sent by each domain that failed these checks.
- It focuses on domains sending more than 4,000 emails, which are close to the 5,000-email threshold.
- Finally, it orders the results by the total number of emails sent.
This helps organizations identify and address compliance issues before Outlook starts routing their emails to the Junk folder, thereby maintaining effective email communication.
