Our thinking


Emails in Microsoft 365 landing in Inbox and then going to Deleted Items after a few seconds

I have a client with a strange, ongoing issue with their email. Particular emails – in this case invoices I send them from Xero, land in the Inbox and then a few seconds later they disappear and end up in Deleted Items.

At first I thought it might be an account compromise and the threat actor was deleting invoices to cover their trail, but even though MFA was on and we changed the password, this behaviour still continued.

I then looked in rules, both in the individual user’s account via Outlook on the Web and also looking through Exchange transport rules in the Exchange Admin Centre, and no dice – there was nothing that was acting on these emails.

I created a folder underneath the Inbox and then set up an Inbox rule to move emails to this folder, and this rule triggered as it should, and moved all incoming emails to this folder. This was however just a stop-gap solution and I really wanted to get to the root cause.

When I was going through the user’s Inbox via his iPad, I looked in the Deleted Items folder and noticed that Mail said the email was from a sender in the blocked list.

Somehow the user had inadvertently added the sender to the block list – which meant that whenever iOS saw an email from this sender, it put it in the bin. This was particularly frustrating as I use Xero, so the emails come from [email protected], so all of this clients suppliers who used Xero ended up with their invoices in the bin.

Tapping on Settings was not much help as it took me to the Blocked list (You can also reach it via Settings > Mail > Blocked) however there were hundreds, possibly thousands of phone numbers and emails in the block list. The block list appears to display entries in the order in which they have been added and after going cross-eyed for about half an hour trying to find a needle in the haystack, I thought that there had to be a better way.

Going back into the email and tapping on the contact shows that the contact is blocked, and there is a button to Unblock this Contact.

Tapping on this and giving it a few seconds to sync to other iOS devices quickly fixed the issue.

TLDR;

If a contact is blocked, all emails from this contact will appear in the Inbox briefly and then be sent to the bin. You can go into the email, tap on the contact in the From: field and then tap on Unblock this Contact to remove them from the blocked list.

Leave a Reply