Almost every business runs on one assumption: if I hit send, it arrived. We only question it when a customer says “I never got that quote”, and even then our first thought is their spam folder.
The truth is less comfortable. Email delivery isn’t guaranteed. Email security systems sit between you and the person you’re writing to, they get more aggressive every month, and sometimes they get it wrong. We found that out first-hand recently, when it happened inside our own group at Kinetics.
What happened
For more than a year, every email leaving Kinetics had a neat line in the signature: “You can now book and manage appointments using our Booking Page.” It linked to the Microsoft 365 booking page through Exclaimer, the signature management platform. Thousands of emails, no problems at all.
Then one Thursday afternoon it stopped working.
Of course, nobody knew. From our side, emails were sending normally. No bounces, no error messages, nothing to suggest a problem. It was only when a client mentioned they hadn’t received something that we started digging, and found that emails had been quietly quarantined by recipients’ mail systems since that Thursday afternoon.
The cause? That same booking link that had been fine for the past twelve months.
Why a genuine link looked like phishing
Microsoft had updated its threat detection, and the booking link suddenly ticked too many boxes on its “high confidence phishing” checks. Not because it was malicious (it wasn’t), but because on paper it looked exactly like something an attacker would build:
- A redirect chain. The link went via Exclaimer before landing on Microsoft, a classic phishing pattern.
- Hidden parameters. The real destination was encoded inside the redirect, which security engines distrust.
- A login page at the end. It landed on outlook.office365.com, a favourite target for stealing passwords.
- A brand impersonation pattern. A third-party redirect combined with a Microsoft login domain is a textbook attack signature.
- A tracking wrapper. The redirect doubles as tracking, which attackers use too.
Any one of those on its own is nothing. All together, they tipped the scales.
The lesson: don’t assume it got there
This is the bit that should make every business stop and think. A link that worked perfectly for a year suddenly stopped, with no warning at all.
The rules that decide whether your email gets delivered aren’t fixed. They change all the time, without notice, and they’re tuned far more towards blocking bad email than letting good email through. Microsoft, Google, Mimecast, Proofpoint and the rest are under huge pressure to stop phishing, so they’ll understandably lean towards blocking anything that looks suspicious, even when it isn’t.
What that means for you:
- Sent isn’t delivered. Your email can be dropped or quarantined without anyone, you or the recipient, being told.
- What’s safe today might be blocked tomorrow. Signatures, marketing footers, tracking links, attachments and even certain phrases can become triggers overnight.
- Important things need a backup. If you’ve sent something that matters (a quote, a contract, payment details, a deliverable), don’t assume it landed. Check by phone, text or by asking them to confirm.
- Listen to the silence. If a client or a whole domain suddenly goes quiet, they may not be ignoring you. They may not be getting your emails.
What was done about it
The booking link was taken out of the signature while Microsoft and Exclaimer worked on a long-term fix.
The takeaway
If it can happen to an IT company that watches this stuff for a living, it can happen to anyone. Next time you send something important and hear nothing back, don’t assume it arrived. Pick up the phone. It’s a small habit, and it might just save you a deal.
Worried your emails might not be getting through? Book a free health check, or call us on 0800 688 768.