Security Policy Errors

How to Fix SparkPost Bulk Email Outages Caused by Microsoft 365 URL Scanning

John Wilson Oct 9, 2026 870 views

Question details

High-volume senders are experiencing SparkPost service outages and distorted click analytics due to excessive request volumes generated by Microsoft 365 URL scanning.

How to Fix SparkPost Bulk Email Outages Caused by Microsoft 365 URL Scanning

Product: Microsoft 365
Device & OS: not provided
Scenario: Sending bulk emails containing tracking links through SparkPost to recipients using Microsoft 365.
Observed behavior: Microsoft 365 security services generate an unusually high volume of requests for email links, resembling a denial-of-service attack, which leads to server outages and skewed click analytics.

Before you start

Before attempting any fixes, gather your server request logs, message headers, and timestamps to accurately document the specific Microsoft IP ranges causing the request spikes.

Solution 1Recommended

Document the Issue and Contact Support Teams

Engaging support with comprehensive diagnostic data is the most effective way to resolve false-positive DDoS-like behavior from Microsoft Safe Links.

Microsoft's security features, such as Safe Links, aggressively scan incoming URLs to protect end users. For bulk senders, this can inadvertently simulate an attack. You must work with both Microsoft and SparkPost to whitelist or adjust the scanning threshold for your sending domains.

Collect Email Evidence

Gather multiple samples of the affected message headers, your sending domains, specific URLs being scanned, and exact timestamps of the spikes.

Export Request Logs

Extract your server request logs to clearly demonstrate the unusually high volume of requests originating from Microsoft IP ranges.

Submit a Support Ticket to SparkPost

Contact SparkPost support, outlining the outage and how the Microsoft URL scanning is distorting your email analytics.

Contact Microsoft 365 Support

Log in to the Microsoft 365 Admin Center and open a support request. Provide all gathered logs and ask them to investigate the behavior of their Safe Links or security services.

Do Not Block Microsoft IPs: Blocking Microsoft IP addresses to stop the request volume is highly discouraged. Doing so can prevent users from accessing legitimate links and may severely damage your mail delivery reputation.

Solution 2

Optimize Email Links and Review Delivery Practices

Minimizing the number of scanned URLs in your emails can significantly reduce the overall request load generated by Microsoft 365 scanning bots.

Free Microsoft Office alternative

A Lightweight Alternative for Your Daily Office Tasks

While resolving complex email server outages and Microsoft 365 security scanning issues, you can maintain peak productivity for your documents, spreadsheets, and presentations. WPS Office offers a free, highly compatible alternative to Microsoft Office.

1. Download the Installer: Visit the official WPS website to download the free installation package for your operating system.
2. Install the Suite: Run the installer to quickly set up WPS Writer, Spreadsheet, and Presentation on your computer.
3. Open Your Files: Launch WPS Office and directly open your existing .docx, .xlsx, and .pptx files with zero formatting loss.

Ensure uninterrupted document workflows while troubleshooting Microsoft 365 email delivery errors.Fully compatible with Microsoft Word, Excel, and PowerPoint file formats.Lightweight application that requires minimal system resources.Completely free to use with an intuitive, familiar interface for seamless migration.

microsoft office alternative - wps office

Frequently Asked Questions

Why is Microsoft 365 generating so many requests to my bulk email links?

Microsoft 365 uses security services like Safe Links to aggressively scan incoming URLs for malicious content before delivering emails to users. For high-volume senders, this automated scanning can generate an overwhelming number of requests that resemble a denial-of-service (DDoS) attack.

Should I block the Microsoft IPs causing the request spikes?

No. Blocking Microsoft IP addresses is highly discouraged. While it stops the scanning requests, it will also prevent legitimate users from opening the links in your emails and can negatively impact your overall mail delivery rates with Microsoft.

How can I stop Microsoft URL scanning from distorting my email click analytics?

You should work with SparkPost support to implement filters that can identify and ignore automated security bot clicks. Additionally, providing your server logs to Microsoft support can help them adjust their scanning behavior to reduce false-positive click tracking.