Outlook.com is also rejecting mail based on blocklists that are not public and you essentialy cannot get yourself out. My VPS provider is pretty much entirely blocked and their regular blocklist process says we are golden so nothing to unblock.
Outlook.com and similar are an anathema to email. This is why they tell you not to run a mail server .
I have the opposite problem. I have a 3-letter email address, so for ease of giving out the email address, I use it, while having it forwarded to my Gmail. Somewhere around 2019, emails from legitimate services, especially password reset/OTP codes, stopped landing in my inbox or even junk because my address is so high up the chain of spammers. Nebula was the first to confirm this for me and work out of band to re-enable access to my account - their emails to me were bouncing. But ever since that happened, I’ve slowly moved back to giving my Gmail.
"Lazy people"? I only heard about this because a customer complained. Am I supposed to go around the Internet, checking what each mail server will allow or deny?
To be fair, DMARC has been required for a very long time. IIRC Google warned about 2 years ago circa that non-compliant emails would land to spam or be null-routed. And the DMARC noise started even before that.
As a company we realised about 12 months ago that email can no longer be considered a reliable method of communication. I understand the reasoning but the result is the result. Many new clients we deal with have whitelists on and we have to pester our clients to add us to their lists. Not a great experience for anyone. I think we should consider email pretty much moribund at this point.
It is literally one of the last free and open channels on the Internet – I suggest you work on supporting its use and keeping it that way rather than moving to something controlled for profit or data harvesting.
Strengthen your contracts / terms of service. Make it their responsibility to configure their email systems properly so they receive emails sent from your domains.
If reliable means the message gets through no matter what, then it's good that no channel is reliable. Such a channel will inevitably be used for spam and attention grabbing.
DMARC is a DNS record that says "send emails about spoofed messages here", or optionally "I don't need you to tell me that scammers exist on the internet".
It doesn't prevent spoofing, it doesn't say which IPs are authorized to send on behalf of a domain, it doesn't sign messages. Spoofed messages are still sendable.
Can you explain the benefit of only accepting email if Microsoft knows that you may or may not accept emails about scammers unsuccessfully spoofing your email domain? (Note, there's nothing you can do if they do tell you.)
Don't confuse DMARC with DKIM or SPF; DMARC doesn't actually do anything for email security.
I have MCP servers for the creation of domains, DNS records with DNSSEC, and email accounts with SPF, DKIM and DMARC. I'm sure if someone wants to be a professional spammer today, DMARC is not a differentiator.
It's an interesting argument. The fact this article exists is somewhat proof that it is a differentiator. The flipside, however, is that spammers very specifically require their emails to get to add many mailboxes as possible, so their motivation is greater to make their emails service compatible.
Company sys admins have likely got all sorts of other issues to worry about, and the occasional report of an email not getting through is likely low on their to-investigate list.
Having said that, I self host a mail server, and have all those things setup correctly, and my workplace uses Outlook, and I've not had issues with delivery, so it's not a particularly difficult bar to jump.
This is interesting. At some point, I think it'll be desirable to give increasing positive weight to emails with the DPF/DKIM/DMARC trifecta configured, since those are least likely to be problem emails (spam or phishing), but I wonder what the best avenue is to actually make that the default. It's almost certainly not this kind of unannounced cutoff.
Email is, I think, among the most distributed popular online services, and there's a ton of stuff that's legacy, self-managed, or otherwise janky. Supporting SPF, DKIM, and DMARC does put a burden on independent operators, but is it an undue or unreasonable one in the current landscape? Or is it just the new cost of doing business?
It seems like 90% of the spam I receive (on my google account) is sent from google addresses, so it will have valid SPF/DKIM/DMARC setup.
That said checking for these things is a good idea, the only problem I see is dropping the mail on the floor, rather than rejecting it at SMTP time - at least that lets the self-hosting users who haven't got things configured know their email is being rejected, and to pick up the phone instead.
There's nothing worse than sending an email, it being accepted, and then later discarded with no clue to either sender or recipient.
> but is it an undue or unreasonable one in the current landscape
Yes. In the first place, this should not even be a thing. Two corporations should not be in control of who can send e-mail. If they want to mark not having DMARC as spam, mark it as spam, or better yet flag it with a specific warning about the domain, but these games with refusing to deliver are just bullshit and essentially force a monopoly where other e-mail providers cannot compete because their e-mails aren't delivered.
> I wonder what the best avenue is to actually make that the default. It's almost certainly not this kind of unannounced cutoff.
En contraire, I think not delivering mail is the fastest way to adoption. People will use an old system for as long as it works. It now does not anymore.
Most spam I get is from Google, Microsoft and Amazon. We should pressure those to start dealing with the problem. Right now they are conveniently ignoring it.
I thought they've been doing this for years, along with gmail/etc. I basically just added setting up the correct DNS records as part of business when sending emails externally.
This was my second hackernews submit [0]! So, not even https in 2014 :)
When I ran that server, outlook.com was also the only one that would blackhole my email for no known reason. Support was unhelpful and also could not point to any reason. I've since given up, but for a short time it was glorious, email to family would not leave the lan and we could send attachments of arbitrary size.
I actually totally agree with this. There's too much risk involved with scams disguised as legitimate services because the developers of said service couldn't be bothered to add 1 or 2 dns records.
Although there seems that there hasn't been any communication which is the bad thing here. However, nobody looks at those and sending detailed emails back seems like a good enough solution.
Unfortunately, the people abusing these are very persistent and adding more checks will just increase the sophistication of such attacks which works against the interests of the target.
This stops disgusting yourself as a legitimate service.
I don't know what "v=DMARC1; p=none;" is proving to anyone when DKIM and SPF are already aligned but sure whatever. Just wish they'd given some warning!
Agreed. There's no additional verity provided by adding a DNS record with a static line of text. Reminds me of airport security theater: meaningless hoops for citizens to jump thru under the guise of stopping bad actors.
This has been going on for much longer than stated here - we had domain mismatch issues with outlook going back years and our policy was p=none. They’re very sensitive and mailing lists with forwarding are heavily impacted.
Do you know if it’ll affect my (personal) account? I run everything through a normal Gmail account and have forwarding for incoming email and an alias for outgoing stuff
I’ve been anticipating something like this for a while; the number of folks who don’t have their email-related DNS settings in order is remarkably high.
I was hit by this twenty minutes ago. I don't disagree with the policy, but I wish my provider had warned me so I could add the headers. I already had DKIM and SPF, but not DMARC.
I suspect that he/she means they runs a mail server and it was up to his customers to comply, but now they’ve had to deal with the fallout from their customers not complying.
It's possibly yet another issue relating to the long streak of problems seen the recent months by primarily self-hosters trying to reach people and businesses behind Outlook servers. The past few weeks a lot of my e-mails to friends and family using Hotmail have gone missing. All envelopes were OKd by Outlook servers, nothing bounced, e-mails just gone. My setup is clean, my network is clean.
I'm fine with providers imposing some default level of spam protection but as a user I'd like the option to disable it, even better if I can disable it per domain or sender. The old technique of adding the sender to your contacts doesn't work reliably anymore.
"The old technique of adding the sender to your contacts doesn't work reliably anymore."
An Outlook user first reaching out to you, and you replying and including the unique message-ID of their original envelope in your headers, doesn't affect anything either. Absurd. The whole situation is complete dog shit.
"Since November 5, 2026, Microsoft's consumer mail service has been turning away some of the email from domains that don't publish a DMARC record. If your company emails customers, vendors or applicants with outlook.com, hotmail.com, live.com or msn.com addresses, some of that mail may be bouncing right now. Nobody announced it. The fix is one DNS record."
I'm personally seeing this with some email systems I manage - email sent from a domain that has proper SPF and DKIM signatures, but had no DMARC record started bouncing this weekend.
Outlook.com is also rejecting mail based on blocklists that are not public and you essentialy cannot get yourself out. My VPS provider is pretty much entirely blocked and their regular blocklist process says we are golden so nothing to unblock.
Outlook.com and similar are an anathema to email. This is why they tell you not to run a mail server .
I have the opposite problem. I have a 3-letter email address, so for ease of giving out the email address, I use it, while having it forwarded to my Gmail. Somewhere around 2019, emails from legitimate services, especially password reset/OTP codes, stopped landing in my inbox or even junk because my address is so high up the chain of spammers. Nebula was the first to confirm this for me and work out of band to re-enable access to my account - their emails to me were bouncing. But ever since that happened, I’ve slowly moved back to giving my Gmail.
Sounds like something every mail sender should have done already.
Good for Microsoft customers and I don't care one bit for the lazy people who have to late-patch now.
"Lazy people"? I only heard about this because a customer complained. Am I supposed to go around the Internet, checking what each mail server will allow or deny?
To be fair, DMARC has been required for a very long time. IIRC Google warned about 2 years ago circa that non-compliant emails would land to spam or be null-routed. And the DMARC noise started even before that.
As a company we realised about 12 months ago that email can no longer be considered a reliable method of communication. I understand the reasoning but the result is the result. Many new clients we deal with have whitelists on and we have to pester our clients to add us to their lists. Not a great experience for anyone. I think we should consider email pretty much moribund at this point.
It is literally one of the last free and open channels on the Internet – I suggest you work on supporting its use and keeping it that way rather than moving to something controlled for profit or data harvesting.
Strengthen your contracts / terms of service. Make it their responsibility to configure their email systems properly so they receive emails sent from your domains.
So what have you switched to instead?
Spoiler alert: no method of communication is reliable anymore. All of them are controlled by companies that will route your messages to spam.
If reliable means the message gets through no matter what, then it's good that no channel is reliable. Such a channel will inevitably be used for spam and attention grabbing.
DMARC is a DNS record that says "send emails about spoofed messages here", or optionally "I don't need you to tell me that scammers exist on the internet".
It doesn't prevent spoofing, it doesn't say which IPs are authorized to send on behalf of a domain, it doesn't sign messages. Spoofed messages are still sendable.
Can you explain the benefit of only accepting email if Microsoft knows that you may or may not accept emails about scammers unsuccessfully spoofing your email domain? (Note, there's nothing you can do if they do tell you.)
Don't confuse DMARC with DKIM or SPF; DMARC doesn't actually do anything for email security.
Yeah, and people who don't switch to Dvorak are lazy, too!
https://ciphercue.com/blog/dmarc-enforcement-gap-rua-fragmen...
https://news.ycombinator.com/item?id=49081783
I have MCP servers for the creation of domains, DNS records with DNSSEC, and email accounts with SPF, DKIM and DMARC. I'm sure if someone wants to be a professional spammer today, DMARC is not a differentiator.
It's an interesting argument. The fact this article exists is somewhat proof that it is a differentiator. The flipside, however, is that spammers very specifically require their emails to get to add many mailboxes as possible, so their motivation is greater to make their emails service compatible.
Company sys admins have likely got all sorts of other issues to worry about, and the occasional report of an email not getting through is likely low on their to-investigate list.
Having said that, I self host a mail server, and have all those things setup correctly, and my workplace uses Outlook, and I've not had issues with delivery, so it's not a particularly difficult bar to jump.
This is interesting. At some point, I think it'll be desirable to give increasing positive weight to emails with the DPF/DKIM/DMARC trifecta configured, since those are least likely to be problem emails (spam or phishing), but I wonder what the best avenue is to actually make that the default. It's almost certainly not this kind of unannounced cutoff.
Email is, I think, among the most distributed popular online services, and there's a ton of stuff that's legacy, self-managed, or otherwise janky. Supporting SPF, DKIM, and DMARC does put a burden on independent operators, but is it an undue or unreasonable one in the current landscape? Or is it just the new cost of doing business?
It seems like 90% of the spam I receive (on my google account) is sent from google addresses, so it will have valid SPF/DKIM/DMARC setup.
That said checking for these things is a good idea, the only problem I see is dropping the mail on the floor, rather than rejecting it at SMTP time - at least that lets the self-hosting users who haven't got things configured know their email is being rejected, and to pick up the phone instead.
There's nothing worse than sending an email, it being accepted, and then later discarded with no clue to either sender or recipient.
Selection bias: you don’t see the spam that get rejected at HELO.
> but is it an undue or unreasonable one in the current landscape
Yes. In the first place, this should not even be a thing. Two corporations should not be in control of who can send e-mail. If they want to mark not having DMARC as spam, mark it as spam, or better yet flag it with a specific warning about the domain, but these games with refusing to deliver are just bullshit and essentially force a monopoly where other e-mail providers cannot compete because their e-mails aren't delivered.
There's no burden whatsoever. It's a one time setup that takes like 15 minutes.
> I wonder what the best avenue is to actually make that the default. It's almost certainly not this kind of unannounced cutoff.
En contraire, I think not delivering mail is the fastest way to adoption. People will use an old system for as long as it works. It now does not anymore.
Most spam I get is from Google, Microsoft and Amazon. We should pressure those to start dealing with the problem. Right now they are conveniently ignoring it.
I thought they've been doing this for years, along with gmail/etc. I basically just added setting up the correct DNS records as part of business when sending emails externally.
You can send an email through mail-tester to see what you might be missing. https://mail-tester.com/
I set up DMARC on my personal domain so long ago I can't even remember when I did it. 10 years+?
I had kinda assumed that a lot of providers would start rejecting domains without DMARC support. I'm surprised it's happening this late.
This was my second hackernews submit [0]! So, not even https in 2014 :)
When I ran that server, outlook.com was also the only one that would blackhole my email for no known reason. Support was unhelpful and also could not point to any reason. I've since given up, but for a short time it was glorious, email to family would not leave the lan and we could send attachments of arbitrary size.
[0] https://news.ycombinator.com/item?id=7708882
I actually totally agree with this. There's too much risk involved with scams disguised as legitimate services because the developers of said service couldn't be bothered to add 1 or 2 dns records.
Although there seems that there hasn't been any communication which is the bad thing here. However, nobody looks at those and sending detailed emails back seems like a good enough solution.
Maybe they should also work on what their users are sending as well.
Unfortunately, the people abusing these are very persistent and adding more checks will just increase the sophistication of such attacks which works against the interests of the target.
This stops disgusting yourself as a legitimate service.
If they did that you’d decry censorship.
Allowing basically ~whatever, but proving the sender address is an obviously good approach to me.
I don't know what "v=DMARC1; p=none;" is proving to anyone when DKIM and SPF are already aligned but sure whatever. Just wish they'd given some warning!
email is weird, without this it doesn't perform the checks at all
Agreed. There's no additional verity provided by adding a DNS record with a static line of text. Reminds me of airport security theater: meaningless hoops for citizens to jump thru under the guise of stopping bad actors.
This has been going on for much longer than stated here - we had domain mismatch issues with outlook going back years and our policy was p=none. They’re very sensitive and mailing lists with forwarding are heavily impacted.
Mail security non-expert here, is this going to affect people who use alternative addresses for their Gmail account?
It affected my google workspace account
Do you know if it’ll affect my (personal) account? I run everything through a normal Gmail account and have forwarding for incoming email and an alias for outgoing stuff
As they should. You should have done this 5 years ago. Takes like 10 minutes. Gmail has been rejecting them for years at this point.
DMARC has been around for a while now. I know it’s fashionable to bash on Micro$oft and they rightfully deserve it.
Just not for this.
I’ve been anticipating something like this for a while; the number of folks who don’t have their email-related DNS settings in order is remarkably high.
> Nobody announced it
They did: https://techcommunity.microsoft.com/blog/microsoftdefenderfo...
And it appears to be further documented here:
https://learn.microsoft.com/en-us/defender-office-365/anti-p...
https://learn.microsoft.com/en-us/defender-office-365/email-...
And other sites were reporting about it for at least a year and a half:
https://powerdmarc.com/dmarc-outlook-email-authentication/ (see #4)
https://www.mailreach.co/blog/outlook-dmarc-requirements
That says for "high volume senders" but they now apply the rules regardless of volume.
Is there any actual evidence of this outside of this one company's AI-generated article?
I got a bounce on a mail from my personal Fastmail account (with my own domain) the day before yesterday.
I had SPF/DKIM set up, just not DMARC. Did that yesterday and don‘t see the point. My policy is "none".
I was hit by this twenty minutes ago. I don't disagree with the policy, but I wish my provider had warned me so I could add the headers. I already had DKIM and SPF, but not DMARC.
Yahoo is too.
Yahoo has randomly rejected emails for decades. In my experience it's probably the worst among the mainstream providers.
Yeah thanks Microsoft. Really appreciate having to mitigate this for hundreds of customers on a weekend. Nice one!
You should have done this for your customers years ago, yikes.
I suspect that he/she means they runs a mail server and it was up to his customers to comply, but now they’ve had to deal with the fallout from their customers not complying.
I noticed this when it happened, but I do have a valid DMARC entry (albeit p=quarantine).
https://mastodon.social/@davisr/117570496362439342
It's possibly yet another issue relating to the long streak of problems seen the recent months by primarily self-hosters trying to reach people and businesses behind Outlook servers. The past few weeks a lot of my e-mails to friends and family using Hotmail have gone missing. All envelopes were OKd by Outlook servers, nothing bounced, e-mails just gone. My setup is clean, my network is clean.
I'm fine with providers imposing some default level of spam protection but as a user I'd like the option to disable it, even better if I can disable it per domain or sender. The old technique of adding the sender to your contacts doesn't work reliably anymore.
"The old technique of adding the sender to your contacts doesn't work reliably anymore."
An Outlook user first reaching out to you, and you replying and including the unique message-ID of their original envelope in your headers, doesn't affect anything either. Absurd. The whole situation is complete dog shit.
"Since November 5, 2026, Microsoft's consumer mail service has been turning away some of the email from domains that don't publish a DMARC record. If your company emails customers, vendors or applicants with outlook.com, hotmail.com, live.com or msn.com addresses, some of that mail may be bouncing right now. Nobody announced it. The fix is one DNS record."
I'm personally seeing this with some email systems I manage - email sent from a domain that has proper SPF and DKIM signatures, but had no DMARC record started bouncing this weekend.