Microsoft 365 High-risk delivery pool

Created by Marc Chouinard, Modified on Mon, 26 Feb 2024 at 03:40 PM by Yves Lacombe


Situation  Outbound email from 365 to ProofPoint show 'Delivered' in 365 but cannot be found in ProofPoint / ModusCloud.
Solution   Add the High-risk delivery pool to the Sender Servers list.

 


If you are having problems sending out auto-forwarded emails to the outside world and all items from the following list is true, then you will need to add the High-Risk IP Pool in the Sender Servers list in ProofPoint.


- You are on Microsoft 365
- You have an automatic forward set on an account or have a rule forwarding incoming emails to an external domain
- You are using ProofPoint for outbound emails
- Microsoft 365 email trace show the email was delivered to outbound-us1.ppe-hosted.com ProofPoint)
- You can't see that outbound message in ProofPoint Log search
- You don't get any bounces for that message

Then you need to add 40.95.0.0/16 to the sending servers to allow High Risk IP Range from Microsoft.


It would also be recommend that this IP range be added to your existing SPF record. This would look similar to the example below.


  • v=spf1 include:spf.protection.outlook.com include:_spf-us.ppe-hosted.com  ip4:40.95.0.0/16 -all


Log on ProofPoint and go to Account Management / Domains and click on [NEW SENDING SERVER].  Add 40.95.0.0/16 and click the [SAVE] button completely at the right.




https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/outbound-spam-high-risk-delivery-pool-about?view=o365-worldwide#high-risk-delivery-pool