WordPress WAF blocking IPs due to 404 errors of autodiscover/autodiscover.xml

Problem:

Our client is using Microsoft 365 and Outlook 365 (similar Microsoft e-mail clients) will try to access the following URL during configuration:

https://domain.com/autodiscover/autodiscover.xml

This has created a large amount of 404 errors and may result WordPress WAF (such as iThemes Security) to block the IPs.

Diagnosis:

The root cause for this is the standard behavior of Microsoft e-mail clients trying to look for the correct server.

Here's an explanation of the process, provided by Microsoft support technician Martin Xu:

The reason is you create CNAME in your host provider and re-point your Autodiscover service to xxx.outlook.com. The testing tool will follow the default process to test the connection. First it will find the original domain to test whether autodiscover can pass, and then will test autodiscover.yourdomain.com. Finally it will check whether there are some CNAME setting for you domain to re-point autodiscover.

If you are using xyz@yourdomain.com, the primary SMTP domain is yourdomain.com. It will first check the primary SMTP domain, then check the secondary Autodiscover service URL https://autodiscover.yourdomain.com/autodiscover/autodiscover.xml. For more information about how the Autodiscover Service Work you can refer to: http://technet.microsoft.com/en-us/library/bb124251.aspx#works.

Solution:

Under the webserver (NginX for example), add a 204 no content response instead of generating 404 error

location ~* ^/autodiscover/autodiscover.xml$ {

return 204;

}