Greylisting defers all emails from Office 365 accounts

Symptoms

• Messages from Office365 mail accounts get deferred by greylisting handler with the following error in /var/log/maillog:

  CONFIG_TEXT: /usr/lib64/plesk-9.0/psa-pc-remote[956]: DEFER during call 'grey' handler
  /usr/lib64/plesk-9.0/psa-pc-remote[956]: Message aborted.
  postfix/smtpd[2028]: 61AF6E27BAB4: milter-reject: DATA from mail-*.outbound.protection.outlook.com[10.10.10.10]: 451 4.7.1 Service unavailable - try again later; from=<user1@officeaccount.com> to=<user2@pleskaccount.com> proto=ESMTP helo=<*.outbound.protection.outlook.com>

  OR

  CONFIG_TEXT: server postfix/cleanup[17368]: C860512160C: milter-reject: END-OF-MESSAGE from mail-eopbgr60135.outbound.protection.outlook.com[40.107.6.135]: 4.7.24 SPF validation error.; from=user1@officeaccount.com to=user2@pleskaccount.com proto=ESMTP helo=<EUR01-DB5-obe.outbound.protection.outlook.com>

• In some cases email messages are delivered within 1-2 days.

• The following message can be delivered to a sender (Office365 mail account):

  PLESK_INFO: Final-recipient: RFC822; 1@pleskaccount.com
  Action: failed
  Status: 5.4.0
  X-Supplementary-Info: < #5.4.300 smtp;550 5.4.300 Message expired -> 451 4.7.1 Service unavailable - try again later>

Cause

Emails from *protection.outlook.com are sent from multiple IP addresses. This causes greylisting treat every new retry as a new message, so there is a delay in message delivery until the same pair of email/IP address is logged.

Resolution

If greylisting is enabled at Plesk > Tools & Settings > Spam Filter, set up a server-wide white list for Office 365 domains - a list of hosts which emails will be accepted without greylisting check-ups:

1. Connect to a Plesk server via SSH.

2. Run the command:

# /usr/local/psa/bin/grey_listing -u -domains-whitelist add:*outbound.protection.outlook.com

For more information about configuring greylisting, see:

• How to configure greylisting? 

Additionally, check the following Microsoft TechNet article and make sure that the network allows connections from Exchange Online Protection (EOP) IP address ranges.