Problem
unixpass sends notification e-mails (invitations, registration codes) through the company’s Microsoft 365 / Exchange Online mail infrastructure using an internal sender address (e.g. noreply@your-domain.com).
E-mails delivered to external recipients render correctly: all images load and all links are clickable. E-mails delivered to internal recipients (same domain) arrive with images missing and links disabled.
Root cause
This is the typical symptom of Exchange Online classifying the messages as suspicious on the internal delivery path. Because the application sends with an internal sender address without passing Microsoft’s composite authentication (compauth), Exchange treats the messages as potential intra-org spoofing. Outlook then automatically disables images and hyperlinks in the affected messages. External recipients are unaffected because their mail systems apply different checks.
X-Forefront-Antispam-Report (e.g. CAT:SPOOF, CAT:PHSH, high SCL) and Authentication-Results (compauth=fail).Recommended actions for the IT team
Analyse the headers of an affected internal e-mail
Confirm the diagnosis using the Message Header Analyzer. Key fields: X-Forefront-Antispam-Report and Authentication-Results (compauth).
Review how unixpass submits mail to O365
Direct Send is the most common cause of this issue. Cleanest options: authenticated sending via a dedicated, licensed mailbox (SMTP AUTH or, preferably, the Microsoft Graph API — see the howto “Custom e-mail sending via Microsoft 365”), or an inbound connector restricted to the fixed IP address of the unixpass system.
Set up sender authentication properly
Add the sending IP address to the SPF record of your domain and, ideally, configure DKIM signing for the system. The messages will then pass composite authentication on the internal path as well.
Configure exceptions in Microsoft Defender for Office 365
Create a spoofed-sender allow entry in the Tenant Allow/Block List (sender address + sending infrastructure). Alternatively or additionally, create a mail flow rule: sender IP = unixpass system → set SCL to −1 (bypass spam filtering). Effective immediately, but intended as a bridge — not a replacement for steps 2–3.
Review the anti-phishing policy
Check whether Spoof Intelligence is intercepting the messages and register the system as a trusted sender in the anti-phishing policy.
Summary
| Approach | Measure |
|---|---|
| Quick fix | Transport rule (SCL −1) and/or spoofed-sender allow entry (step 4) — takes effect immediately. |
| Sustainable fix | Authenticated submission plus correct SPF/DKIM configuration (steps 2–3) — messages are then delivered as fully authenticated internally, and Outlook displays images and links normally. |