Agreed that whitelisting fixes it, but there are multiple IP blocks that they send from.  So far I've had to whitelist 5 blocks in the last 8 hours.  Isn't there another way around it?  I'm not sure where Cluebringer fits into the flow of things, maybe a way to skip greylisting altogether for that domain before it gets to Cluebringer?

OK, let's look at this a different way. 

Whitelisting the IP blocks is NOT the answer.  It will be a constant fight to whitelist all these IP blocks every time one gets blacklisted (as many as 10 per day).  What I want to do is exclude these servers from greylisting without having to know the IP address.  I may have fixed it somewhat by raising the threshold from 100 messages in 60 seconds to 200 messages in 60 seconds, thinking that maybe the auto-whitelist quota will catch these before they get blacklisted.  I admittedly am not sure how Cluebringer applies all of these rules and which rule has priority over other rules, so this is just a guess.

For a long term solution, I've been looking through the database and documentation and I think what I really need is to isolate the sender at the HELO check (because that's the identifier in this case, the HELO returns outbound.protection.outlook.com).  So, is there a way to bypass greylisting once the HELO check completes?  I assume that happens before the greylisting check.

For what it's worth, I am now having the same issue with gmail.com and domains hosted with Google Apps.