Rich, The North Dakota University System is also seeing this with a few lists and some domains on the tenant, but not all. I opened a support ticket with Microsoft support, they said this was a "False Positive," but to correct it we needed to implement DKIM and DMARC to allow EOP to re-learn that these messages are not spoofing. An SPF record by itself is not enough. We are still working with support to see if there is anything else that can be done. John Underwood From: LISTSERV Site Administrators' Forum [mailto:[log in to unmask]] On Behalf Of Helmke,Richard A Sent: Monday, November 21, 2016 8:19 PM To: [log in to unmask] Subject: Office 365 and fraud detection errors We are running a RedHat/Postfix configuration of LISTSERV 16.0-2014B. Within the last 20 days a number of our subscribers on various lists have started receiving: "This sender failed our fraud detection checks and may not be who they appear to be. Learn about spoofing at http://aka.ms/LearnAboutSpoofing" This occurs after the subscriber on Office 365 has submitted a posting and after distribution his copy is sent to him with this flag -- no other subscribers on other domains see this error, but other subscribers in his domain also see this warning. We have a valid SPF record in place for listserv.cuis.edu, but have not implemented any kind of DKIM or DMARC records on LISTSERV (or elsewhere). Is this a 'new' common problem? Is there a workaround (there are many domains affected because many of our subscribers are Office 365 users)? Both LSoft and Microsoft have suggested that a valid SPF record for our LISTSERV should be enough, but that is obviously not working for us. -Rich Helmke ________________________________ To unsubscribe from the LSTSRV-L list, click the following link: http://peach.ease.lsoft.com/scripts/wa-PEACH.exe?SUBED1=LSTSRV-L&A=1 ############################ To unsubscribe from the LSTSRV-L list: write to: mailto:[log in to unmask] or click the following link: http://peach.ease.lsoft.com/scripts/wa-PEACH.exe?SUBED1=LSTSRV-L&A=1