@JeffSchaller It appears to be
this. I don't recall coming across this before, but it appears SD caught the other reasons, and reported it, so MS didn't have that domain as a detection reason. (A search on MS for that domain would yield it though). Anyway, I've added the domain manually to that MS record now.