Microsoft Graph ICS routing bug
Microsoft was sending my emails to the wrong person, every single time.
I had just finished building spam protection for my self-hosted scheduling system. Everything looked perfect in the logs. Emails were being sent to the right addresses. But when I checked my inbox, nothing. Every organiser notification meant for me was landing in the attendee's mailbox instead.
This was identical to an issue with my WordPress calendar plugin where my clients were receiving two emails for the same meeting and the support team dismissed it as the email headers were ok.
I spent hours debugging. The SMTP envelope, the To header, and the email relay logs all showed the right recipient. Yet Microsoft 365 delivered both emails to the same person.
Then this morning I had an idea, my proxy wasn't set up to change the headers or reroute email, and the raw headers looked ok going to it, so how was it routing to the client email twice and not mine? I downloaded the raw email, manually removed the calendar attachment and the MIME component from the body, and resent it. It arrived in my inbox.
The ICS information was the culprit (not just the attachment). Inside every calendar invitation is an ATTENDEE field with a mailto address. Microsoft Graph API parses this field and routes the email there, completely ignoring who the email was actually addressed to. In all my years of setting up, managing and troubleshooting email systems I have never seen this one before.
Once I had identified the root cause I searched for answers and found others hitting the same problem. A Microsoft Q&A thread from July 2025 confirmed it with no fix and no workaround. Microsoft's suggestion? Use a different authentication method. No, I am not going to use a legacy auth method, and considering Exchange Online will be permanently removing support for basic authentication with client submission on the 1st March this year I didn't entertain it.
So I built my own fix. I had already extended my SMTP proxy with a validator built in Go that already validated email domains. To address the bug, I further extended it to strip ICS content from emails destined for my inbox. The calendar attachment still goes to attendees who need it. My notifications arrive without the problematic attachment that confuses Microsoft's routing.
Two bugs later, including learning that MIME boundaries are case-sensitive, it works. Organiser emails go to the organiser and attendee emails go to attendees, as it should have been from the start.
The irony is not lost on me. I built infrastructure to avoid paying for SaaS, and ended up working around a bug in the biggest SaaS provider of them all.
I'm Andy, I may suck at many things but that doesn't stop me from trying.
Read more: Email relay architecture