Security and deliverability incidents, closed at the root

Problem

Two incidents in the same month. First, prospects booking sales calls got the confirmation email but the calendar invite arrived about 30 minutes late or in spam, and leadership wanted it fixed that day. Second, a team member's mailbox kept failing in both directions after a phishing incident, and the team suspected something was still wrong inside it.

What I did

• Invites: traced the delay to an outbound email relay that intermittently deferred everything. Rather than a workaround (resending invites from another system), I fixed the delivery path at the mail-routing layer. Verified on a live booking to a domain with strict authentication: delivered in seconds, all three authentication checks passing, tenant-wide so every rep was covered.
• Mailbox: treated it as a security case first. Audited inbox rules and forwarding, traced inbound and outbound delivery, tested the calendar sync, and closed the tickets only after the user confirmed both directions working.
• Kept the domain's email authentication healthy: postmaster verification, DMARC posture, and a clear record of the email architecture so the next incident starts from facts.

Result

Invites land in seconds. The mailbox case closed with the user's confirmation. Both are documented with root cause and fix, not just "resolved".

What it shows

Root cause before workaround, and security first when the symptoms could be an intrusion.