What is amsprd0311.outlook.com?

Question

This morning when I opened my mail client I got a message saying that the identity of amsprd0311.outlook.com could not be verified.

I tried searching for information about this but I haven't found any. Any idea what this could be?

Answer 1

That server name is the one that is hosting your mailbox on Microsoft's servers (this is part of their Office 365 platform, which I believe also powers Hotmail and Outlook.com email). The message you're receiving indicates that the server you connected to (ostensibly amsprd0311.outlook.com) presented a certificate that doesn't match its domain name, or presented a certificate that isn't trusted by your computer.

I believe that message box has a "Show certificate" option. Inspect the domain name on the certificate, that could give you a hint as to what is happening.

This could be caused by a number of things:

1. If you connect to a public wi-fi network that requires you to click "I agree" in the browser before accessing any other web pages, then Mail.app may have been redirected to the wi-fi provider's server before you had a chance to do that. Since that server isn't a Microsoft server, it can't present the right certificate.

2. Your DNS names aren't resolving properly for a benign reason. Perhaps try using a well-known public DNS server such as Google Public DNS (8.8.8.8 and 8.8.4.4) or OpenDNS (208.67.222.222 and 208.67.220.220). If you allow the connection, your mail program could send your email password to the wrong server, where it will probably just be ignored.

3. An attacker is redirecting your connection to their own server. Since they don't have a valid certificate, you get a warning message. If you allow the connection anyway, your mail program will send your password to the attacker's server where he could save it for malicious use.

4. Microsoft's server isn't presenting a valid certificate. I think this is fairly unlikely.