Fix Sophos Phishing Simulation Emails Not Delivered in Microsoft 365
Question details
Sophos phishing simulation messages are failing to deliver and bouncing with SMTP 554 and 421 errors despite the sender being on the allow list.
- Product
- Microsoft 365
- Device & OS
- not provided
- Scenario
- Running third-party Sophos phishing campaigns through Microsoft 365 mailboxes.
- Observed behavior
- The simulation emails bounce back with SMTP 554 (permanent rejection) and 421 (transient error/DNS lookup failure) error codes, even after setting up transport rules to allow Sophos domains and IP addresses.
Ensure you have Exchange Online Administrator and Security Administrator privileges in your Microsoft 365 tenant to modify mail flow rules and threat policies.
Configure Advanced Delivery for Phishing Simulations in Microsoft 365 Defender
Standard Exchange mail flow rules (like setting SCL to -1) are often overridden by Microsoft's secure-by-default policies. Using the Advanced Delivery policy is the official method to permit third-party simulations.
Microsoft 365 has transitioned away from relying solely on mail flow rules for phishing simulations. To prevent SMTP 554 bounce errors and message expirations, you must configure the third-party simulator in the Defender portal.
Log in to the Microsoft 365 Defender portal at security.microsoft.com. Navigate to 'Policies & rules' and select 'Threat policies'.
Under the 'Rules' section, click on 'Advanced delivery'. Select the 'Phishing simulation' tab to manage authorized third-party campaigns.
Click the 'Add' icon. Enter the sending domains and IP addresses provided by Sophos for their simulation emails, then save your configuration. Allow up to 12 hours for the policy to fully propagate.
Verify Connectors and DNS Configuration
Check for DNS lookup failures causing SMTP 421 errors and ensure inbound connectors are not improperly throttling the connection.
Analyze the Non-Delivery Report (NDR) via Message Trace
Use Exchange Online's Message Trace to pinpoint the exact filtering layer or routing hop that is rejecting the Sophos emails.
Looking for a Lightweight, Hassle-Free Alternative to Microsoft Office?
Troubleshooting Exchange mail flow rules and Microsoft 365 delivery policies can be highly complex. While WPS Office does not handle Exchange routing, it offers a refreshing, lightweight, and completely free alternative for your daily document creation needs. Avoid complex admin overhead when you just need to edit Word, Excel, or PowerPoint files.
- 1. Visit the Official Website: Go to the official WPS Office website to download the appropriate installer for your operating system.
- 2. Install WPS Office: Run the downloaded installer file and follow the simple on-screen instructions to complete the setup.
- 3. Start Creating: Open WPS Office and immediately start viewing and editing your existing Microsoft Office documents without formatting issues.
Frequently Asked Questions
Why am I getting an SMTP 554 error for phishing simulation emails?
SMTP 554 is a permanent delivery failure often caused by Microsoft 365's strict spam or malware filtering policies blocking the simulation IP. Setting up 'Advanced Delivery' for phishing simulations bypasses these strict secure-by-default blocks.
What causes an SMTP 421 error in Microsoft Exchange Online?
SMTP 421 represents a transient error, indicating the receiving server is temporarily unable to process the message. This can be caused by DNS lookup failures, temporary routing issues, or connection throttling limits being exceeded.
Can I use an Exchange mail flow rule instead of Advanced Delivery for simulations?
While using an Exchange mail flow rule (setting SCL to -1) was a past practice, Microsoft now overrides these rules for high-confidence phishing and malware. The official and supported method is to configure the simulation in the Microsoft 365 Defender 'Advanced Delivery' policy.
