Using anti-malware software can affect response processing

If you use email notifications with response links to notify users, it's possible that malware protection (antivirus) software can affect response processing by xMatters.

This is because some malware protection software, such as Proofpoint, scans incoming email and automatically follows links found in the email content (and sometimes even overwrites the links). So, by the time a user clicks on their response choice from the email notification, the actual URL of that response may have been invoked several times.

What can you do?

1. In the Exchange Admin center, go to Mail flow > Rules.
2. Create a rule named "Bypass xMatters ATP Links".
3. Apply this rule to "Senders IP address is in the range":

167.89.94.254
168.245.127.202
159.135.227.3
159.135.227.4
159.135.227.7

4. Leave the following set message header 'X-MS-Exchange-Organization-SkipSafeLinksProcessing' with a value of 1.
5. Select a low severity level to audit this rule.
6. Click Save.

7. Verify that your email authentication settings (such as SPF and DKIM) are correctly configured for your xMatters sending domains so security systems can reliably identify and trust xMatters messages.

8. Where appropriate, consider using alternative response channels (such as the xMatters mobile app, SMS responses, or the web user interface inbox) for critical workflows that are especially sensitive to false or duplicate email responses.

Alternatively, consult with your malware protection software vendor about how to configure your settings to avoid incorrect responses to xMatters notifications.

xMatters reference

DTN-4735 Originally by Denis Sodol