Gmail Suspicious link problem

(0) Share

Report

Posted on by gstit

Hi Friends,

we are using flow to implement a approval processing. Our Client are using gmail as their email service provider.

Recently, it was reported that whenever the end user choose to "approve" or "deny" the application, Gmail will popup an alert window. This is pretty annoying and unfriendly,

Indeed, the links to the "approve" or "deny" button are something like this,

https://flow-apim-msmanaged-na-westus2-01.azure-apim.net/apim/office365/RecordResponse?state=eyJOb3RpZmljYXRpb25VcmwiOiJodHRwczovL3Byb2QtMzMud2VzdHVzLmxvZ2ljLmF6dXJlLmNvbS93b3JrZmxvd3MvYzE2MmEyYWUyYTY0NDNhMzk3NWU4MmM1ZGE4ZjZkZTcvcnVucy8wODU4NjQxNDA4OTQ5MzU4ODczOTA0NzExNTA0NkNVMTAvYWN0aW9ucy9TZW5kX2VtYWlsX3dpdGhfb3B0aW9ucy9ydW4%2fYXBpLXZlcnNpb249MjAxNi0wNi0wMSZzcD0lMkZydW5zJTJGMDg1ODY0MTQwODk0OTM1ODg3MzkwNDcxMTUwNDZDVTEwJTJGYWN0aW9ucyUyRlNlbmRfZW1haWxfd2l0aF9vcHRpb25zJTJGcnVuJTJDJTJGcnVucyUyRjA4NTg2NDE0MDg5NDkzNTg4NzM5MDQ3MTE1MDQ2Q1UxMCUyRmFjdGlvbnMlMkZTZW5kX2VtYWlsX3dpdGhfb3B0aW9ucyUyRnJlYWQmc3Y9MS4wJnNpZz1lX3puZ3MwOGtRX1VsYXVZeU1SQlQwV3BkeERGcXpDVHNUb1VSTEJjdmxRIiwiT3B0aW9uIjoiQXBwcm92ZSIsIlJlc

Did you guys meet the same problem and have any idea how to do without this popup?

We found on stackoverflow, there is a suggestion to contact postermaster.google.com

https://stackoverflow.com/questions/51947523/on-click-suspicious-link-error-in-gmaillaravel

But it seemed that we need to prove theownership of the domain by adding a DNS TXT or a DNS CNAME record, which we don't have.

Thanks,

Categories:

General topics

All responses (9)

Answers (1)

Sort by

Ed Gonzales 4,531 Most Valuable Professional on at

Like
a
(0)

Report
Copy link

Link copied!

@gstit Hi there -
It sounds like they are using Google's GSuite product, right? (Kind of like gmail, but for enterprise).

If that's the case, they should be able to whitelist the domain and that may resolve the issue. Here's a link on how to do that.

Keep us posted.
-Ed-
gstit 85 on at

Like
a
(0)

Report
Copy link

Link copied!

>>>>>>>>>It sounds like they are using Google's GSuite product, right? (Kind of like gmail, but for enterprise).
Yes.
So it is controlled by the Gsuite admin?
I thought it should be Microsoft's responsibility to whitelist the domain.
Ed Gonzales 4,531 Most Valuable Professional on at

Like
a
(1)

Report
Copy link

Link copied!

The pop up in your screenshot looks like it's coming up in their eMail client, but yes...the GSuite admin should be able to whitelist the MS tenant domain. I'm not certain if that will resolve the issue, but it seems like that's what's at the root.
There's also a setting in GSuite that turns off the url protection, but they probably want to keep that on. Have them try it out, and if it doesn't work, we'll chase down another path.
-Ed-
gstit 85 on at

Like
a
(0)

Report
Copy link

Link copied!

Sure. We will contact the admin and keep you posted.
gstit 85 on at

Like
a
(0)

Report
Copy link

Link copied!

Hi edgonzales ,

I just read the instruction in your link. And I noticed that,
"Whitelisted domains must be G Suite domains. If you add non-G Suite domains to the Whitelisted Domains list, they're still not trusted."

Since here we are working with a site from Microsoft. It seems that we cannot make the link trustable in this way?

I am not sure.

Thanks,
Ed Gonzales 4,531 Most Valuable Professional on at

Like
a
(1)

Report
Copy link

Link copied!

That's what it sounds like

Is the Flow App on their mobile device an option? Just trying to think outside of the immediate problem.
gstit 85 on at

Like
a
(0)

Report
Copy link

Link copied!

Yes. There is no problem when they try to approve it on smartphones.
gstit 85 on at

Like
a
(0)

Report
Copy link

Link copied!

And I found this link here,
Link2
Base on the report, she solved the problem by contacting google. Google reviewed the site and it takes about 30 hours for google made the site trustable. And the warning of “suspicious link” never appear after this operation.

From her description, one need to be the owner of the domain if one want to request Google to put the domain into the whitelist.
Link3
Verified answer

gstit 85 on at

Like
a
(0)

Report
Copy link

Link copied!

We finally avoided the "suspicious link" warning by removing any link in the email body.
Once the link is removed, the suspicious link warning to all links in the email disappear.

We are now certain that this warning should not be triggered by the azure api server. No need to put the link into the whitelist of the G Suite.

Thanks,