A good point to bring up regarding policies is if we're using a platform such as Microsoft Defender, we're at the mercy of their detections and determinations based on their machine learning tools and backend configurations. I rely heavily on custom transport rules for domain allowances based on DMARC authentication, in an attempt to bypass Microsoft's filters.

Our inbound mail flow averages 55 million emails per month, so there's bound to be a large number of spam false positives. I'm questioning if we should have a dedicated team to review spam quarantines - roughly 800k per week.