Unblocking Office365 emails for Atlassian Cloud

[#1]

Sometimes email notifications or invitations from Atlassian Cloud services (Jira, Confluence, Bitbucket, Trello, and more) may not deliver correctly. Here we’ll go over creating a Mail Flow rule in Exchange Online to ensure emails from Atlassian don’t get stuck. This article is intended for anyone using Office365, Exchange Online, or Outlook as part of an O365 tenant.

This rule should help prevent emails from bouncing or an address from getting blocked. Particularly, if Atlassian Support has helped remove an email address from the “block list” or “bounce list” and mentioned this error:

550: 550 5.4.1 Recipient address rejected: Access denied.

An Exchange Admin user will need to complete the following steps:

1. Log in to Exchange Admin Center, and click on the Rules link in the Mail flow section. Click here for a direct link

2. Click the + icon to create a new rule, and choose Bypass spam filtering… from the list
   

3. Enter the name for the rule in the Name field. Suggestion: “Atlassian Cloud”

4. In the “apply this rule if” dropdown, select “A message header > includes any of these words”
   and type Authentication-Results for the header, followed by dmarc=bestguesspass and dmarc=pass for the values. DMARC is an important anti-spoofing authentication mechanism, and this step ensures only validated emails get processed by the rule.
   

5. Click the add condition button to add another condition

6. For the second condition, select “The Sender’s domain is…” and add atlassian.net and atlassian.com

7. Alternatively, you can use the IP ranges published on the Outbound Email section of our IP addresses and domains list. Microsoft’s documentation notes that the domain name is preferable to IP addresses.

8. Confirm the “Stop processing more rules” box is checked. This box is checked by default.
   
   (completed rule shown here - click image to expand)
   
   

9. Save the rule!

10. If you have other transport or mail flow rules set up, reprioritize this rule to take precedence before other rules.

Why this is necessary

If you are currently not receiving emails or invitations from Atlassian Cloud, it is possible your email address is on the bounce list. Our mail delivery service keeps track of addresses which have returned error codes. Office365 and Exchange Online in particular will return an error code to our mail service if the SCL at your organization exceeds a certain level. Our mail service will then pause delivery of future emails to that address, in order to stay in good standing with spam prevention lists. While the mail flow rule above will fix this particular error for future emails, you may need to contact Atlassian Support to remove your email address from the bounce list. You can do this by raising a support issue if you are an Atlassian Site Admin, or by creating a new question on Community and requesting to be unblocked.

Additional note

This rule (using the atlassian.net and atlassian.com domains) will not cover messages sent if you have configured Jira Cloud to send emails on behalf of your domain . If Jira is sending emails using your organization's domain name, please follow the documentation to ensure you have set up SPF and DKIM records set up correctly on your domain. Jira will then be able to send emails that pass DMARC, and any mail flow rules you want to add for those emails should use your organization's domain.

[Yatish Madhav]

Thanks for this post! 

[Eric Tiffany]

Bypass Spam Filtering is no longer an option in the Add a rule list.