HN

Need help?
<- Back
Outlook.com Is Quietly Rejecting Email from Domains Without DMARC

Outlook.com Is Quietly Rejecting Email from Domains Without DMARC

xmddmx

Comments (100)

  • Neikius
    Outlook.com is also rejecting mail based on blocklists that are not public and you essentialy cannot get yourself out. My VPS provider is pretty much entirely blocked and their regular blocklist process says we are golden so nothing to unblock.Outlook.com and similar are an anathema to email. This is why they tell you not to run a mail server .On the other hand rejecting domains without dmarc is fine. Just not happy it is silent.
  • stephbook
    Sounds like something every mail sender should have done already.Good for Microsoft customers and I don't care one bit for the lazy people who have to late-patch now.
  • physhster
    Tangentially-related: Gmail has started sending completely legitimate emails to spam. DMARC/SPF/DKIM (2048 bits) all properly configured of course so there has to be something else that isn't documented.
  • klodolph
    I set up DMARC on my personal domain so long ago I can't even remember when I did it. 10 years+?I had kinda assumed that a lot of providers would start rejecting domains without DMARC support. I'm surprised it's happening this late.
  • verandaguy
    This is interesting. At some point, I think it'll be desirable to give increasing positive weight to emails with the DPF/DKIM/DMARC trifecta configured, since those are least likely to be problem emails (spam or phishing), but I wonder what the best avenue is to actually make that the default. It's almost certainly not this kind of unannounced cutoff.Email is, I think, among the most distributed popular online services, and there's a ton of stuff that's legacy, self-managed, or otherwise janky. Supporting SPF, DKIM, and DMARC does put a burden on independent operators, but is it an undue or unreasonable one in the current landscape? Or is it just the new cost of doing business?
  • green-salt
    I thought they've been doing this for years, along with gmail/etc. I basically just added setting up the correct DNS records as part of business when sending emails externally.
  • ofcrpls
    I have the opposite problem. I have a 3-letter email address, so for ease of giving out the email address, I use it, while having it forwarded to my Gmail. Somewhere around 2019, emails from legitimate services, especially password reset/OTP codes, stopped landing in my inbox or even junk because my address is so high up the chain of spammers. Nebula was the first to confirm this for me and work out of band to re-enable access to my account - their emails to me were bouncing. But ever since that happened, I’ve slowly moved back to giving my Gmail.
  • himata4113
    I actually totally agree with this. There's too much risk involved with scams disguised as legitimate services because the developers of said service couldn't be bothered to add 1 or 2 dns records.Although there seems that there hasn't been any communication which is the bad thing here. However, nobody looks at those and sending detailed emails back seems like a good enough solution.
  • aetherspawn
    If BIMI was in any way scalable it would actually provide a way for an external signer to say “yeah we trust these guys, you should deliver this”.I haven’t really seen BIMI for less than practically $1000/year and most clients still don’t check it.
  • netik
    This has been going on for much longer than stated here - we had domain mismatch issues with outlook going back years and our policy was p=none. They’re very sensitive and mailing lists with forwarding are heavily impacted.
  • tjwds
    > Quietly Rejecting Email> The sender gets a bounce?
  • saagarjha
    Mail security non-expert here, is this going to affect people who use alternative addresses for their Gmail account?
  • cloudie78
    DMARC has been around for a while now. I know it’s fashionable to bash on Micro$oft and they rightfully deserve it.Just not for this.
  • BatchJob
    Its not "one header" to fix. SPF and DKIM must be implemented.
  • esikich
    As they should. You should have done this 5 years ago. Takes like 10 minutes. Gmail has been rejecting them for years at this point.
  • 27bstroke6
    I’ve been anticipating something like this for a while; the number of folks who don’t have their email-related DNS settings in order is remarkably high.
  • ranger_danger
  • dzink
    Yahoo is too.
  • stavros
    I was hit by this twenty minutes ago. I don't disagree with the policy, but I wish my provider had warned me so I could add the headers. I already had DKIM and SPF, but not DMARC.
  • almost
    Yeah thanks Microsoft. Really appreciate having to mitigate this for hundreds of customers on a weekend. Nice one!
  • davisr
    I noticed this when it happened, but I do have a valid DMARC entry (albeit p=quarantine).https://mastodon.social/@davisr/117570496362439342
  • daneel_w
    It's possibly yet another issue relating to the long streak of problems seen the recent months by primarily self-hosters trying to reach people and businesses behind Outlook servers. The past few weeks a lot of my e-mails to friends and family using Hotmail have gone missing. All envelopes were OKd by Outlook servers, nothing bounced, e-mails just gone. My setup is clean, my network is clean.
  • xmddmx
    "Since November 5, 2026, Microsoft's consumer mail service has been turning away some of the email from domains that don't publish a DMARC record. If your company emails customers, vendors or applicants with outlook.com, hotmail.com, live.com or msn.com addresses, some of that mail may be bouncing right now. Nobody announced it. The fix is one DNS record."I'm personally seeing this with some email systems I manage - email sent from a domain that has proper SPF and DKIM signatures, but had no DMARC record started bouncing this weekend.