This article explains how to fix one of the most common causes of the following Microsoft 365 mail loop / bounce error:

There are multiple circumstances in which this error can occur, each with its own solution. Regardless, this article is usually the best place to start.

If you're getting this "mail loop" error and your situation matches, it most likely indicates that your service was configured before December 2022, using incorrect Microsoft 365 setup instructions. Our old instructions for configuring Office 365 to "always accept clean mail" were based on widely accepted practices. As of this writing, there are still other prominent anti-spam service providers that are using the same faulty approach.

What is causing this error?

The underlying problem is that Microsoft 365 sometimes accepts an inbound message and then instead of delivering to the local recipient, treats it as an outbound message. As a result, the message is relayed back to SpamHero, where it is processed and re-delivered to Microsoft (causing a loop until the message bounces).

For more details and alternate solutions, see:

• The "Hop Count Exceeded", mail loop error analysis

Sender-based Solution

1. Go to the Connectors page in the Exchange admin center: https://admin.exchange.microsoft.com/#/connectors
   If preferred, you can navigate there on your own
   1. Login to your Exchange admin center (https://admin.exchange.microsoft.com/)
   2. Click Mail flow > Connectors in the side navigation menu.
2. Click on the Inbound Connector that was originally created to ensure smooth delivery of clean mail from SpamHero. It is critically important that you identify the right connector. How can I confirm that I found the right connector?
   • Verify that the Mail flow scenario is To Office 365
   • The name should hopefully indicate what the connector was created for
   • The section for identifying the "partner organization" should contain these IP addresses (possibly in a different order):
     208.53.48.64,208.53.48.71,208.53.48.191,208.53.48.218,108.60.195.222,108.60.195.213,108.60.195.218‎
   • The Security restrictions section should not contain any IP addresses
   • If you're still unsure, take a screenshot of the connector details and send it to our support department to get confirmation.

   Here's an example of what to look for:

   
   

3. Click on the Disable button, which looks like a "pause" button and sits to the left of the "trash" button and then click on the Confirm button that appears in the bottom-left corner. example

   
   

   
   

   To avoid major mail flow disruptions, do not delete the connector. Instead, disable it for at least a few days to confirm that you have identified the right connector. Just in case it gets permanently left behind, it might be smart to prefix the connector name with: DO NOT ENABLE

4. After confirming that this resolved the mail loop, continue on to our updated instructions for configuring Microsoft 365 for fast, reliable deliveries.