Hello Pipefy customers
Summary
Between August 15 and August 31, 2026, some emails sent by Pipefy may have been rejected, blocked, quarantined, or routed to spam folders by certain email providers after a Pipefy domain was listed as malicious by Spamhaus.
Impact
Pipefy’s platform remained available throughout the event. The impact was limited to a portion of outbound communications, including notifications, alerts, and confirmation emails. The impact varied depending on the recipient's environment and affected a portion of outgoing emails; customers whose users rely on Outlook/Microsoft 365 were impacted. The Pipefy platform itself remained available.
The impact period
Started at 14 /08/2026 07:30 (BRT, America/Sao_Paulo
Ended at 31 /08/2026 06:00 (BRT, America/Sao_Paulo
Root Cause
The issue was caused by a temporary reputation restriction associated with the domain used for our outgoing emails. The provider confirmed the restriction was removed on August 31. Subsequent validation showed normal delivery behavior, and we have not received new reports related to this event.
Preventive Measures Performed
We worked with the reputation service provider Spamhaus and implemented the recommended measures to unblock the Pipefy domain. Following implementation, we observed improved email delivery to major providers such as Outlook and Gmail, and confirmed that the domain had been unblocked by Spamhaus on the 21st, leading to the closure of the incident.
Subsequently, some clients reported new delivery issues and blocks. We identified that the domain had been blocked again by Spamhaus, prompting us to reopen the incident. We immediately initiated an escalation process with the provider to request the domain's release. However, removal from blocklists follows an independent and gradual process managed by the reputation provider, which results in a longer timeframe for full resolution.
Next steps
To reduce the likelihood and impact of a similar issue, we are improving email-delivery monitoring and strengthening our support guidance for recipient-side allowlisting.
We have already implemented additional safeguards in our email-sending configuration and monitored delivery performance after the restriction was lifted. We continue to improve our product to be resilient and prevent this from happening again.
We apologize for any inconvenience and appreciate your understanding.