False positive Office 365 blocking emails sent through 3CX SMTP Server

[JamieR]

Just an FYI that Office 365 are now blocking 3CX welcome emails. One reason could be that they're being sent through the SendGrid 3CX SMTP Server (168.245.58.221) that is now on a number of DNSBLs. I'm seeing this behaviour on several tenancies I look after.

Slightly worrying in that the predominate block reason is malware.

Simply whitelisting "from" address or IP address is not practical for many people - the 3CX team need to request the delisting of this address from all affected blacklists and work with various vendors to resolve the reputation issue.

Original Threats​

None

Latest Threats​

Malware, Spam

Original location​

Quarantine

Latest delivery location​

Quarantine

Delivery action​

Blocked

Detection technologies​

URL detonation reputation, Mixed analysis detection

 

[Charles_3CX]

Hi, please check, as this has already been answered here for the 365 issues you are reporting and for the IP backlist here.

You should also be using the latest support version, Update 8 Build 939, from which welcomes emails do not contain the download URL for the V16 legacy app, which is free of malware by the way.

If you are already on the latest supported version, means you have a custom welcome email template carried over from the previous version that needs to be removed per this thread.

 

[Charles_3CX]

We have made some tests from our side and can not find any issue with sending welcome emails from the latest version with the latest welcome email templates to our 365 email accounts.

We have also de-listed the detection of the link within MS Defender.

Can you please let us know if you can also receive emails to your 365 users now that you have whitelisted the IP?

 

[greychain]

I am also unable to send welcome emails or status emails from our PBX using 3CX smtp

 

[TheodorosG_3CX]

@greychain Note that this forum post is regarding Welcome emails that are blocked from O365.
If you do not receive other notifications this is might be different. What is the installed version of your PBX?

 

[greychain]

18.0 (Build 939), I can get the emails sent to gmail accounts

 

[TheodorosG_3CX]

Are you using any custom Welcome email template(you may check post here)?
Also in your Azure portal do you see the emails blocked?
The test SMTP is received?

 

[greychain]

No custom templates, fresh install from last week, Test SMTP works to non-office email but not to office email

 

[TheodorosG_3CX]

Please create a ticket to the Technical Support as it might require to check the email addresses from our side.

 

[Dmcleod-Stratus]

Hello, was there a resolution to this issue, I upgraded to version v18.0.9.20 last week for a customer (worked fine before) and now have the same issue, they are on hybrid exchange & I can get welcome emails to gmail accounts but not to Office 365 or local email (exchange).

Thanks for the insight.

 

[TheodorosG_3CX]

Do you have any custom welcome email template as it is also described in this post?
Does your welcome email also include the config file for the Legacy Windows Client?

 

[Dmcleod-Stratus]

I do not have any custom templates or the Config file. (although this customer would like the option to email the Config file, they have their reasons)

appears to be related to Office 365. the emails are now arriving just fine, (FYI:looks like previously they were taking a few hours to show up, it also looks like they eventually did all send. Gmails were always only a few seconds.) Thank you.

 

[Charles_3CX]

I do not have any custom templates or the Config file. (although this customer would like the option to email the Config file, they have their reasons)

appears to be related to Office 365. the emails are now arriving just fine, (FYI:looks like previously they were taking a few hours to show up, it also looks like they eventually did all send. Gmails were always only a few seconds.) Thank you.

This will not be possible; we removed the configs and QR codes from the email templates for security reasons.

I am glad that this is now working for you, though.