Outlook.com is also rejecting mail based on blocklists that are not public and you essentialy cannot get yourself out. My VPS provider is pretty much entirely blocked and their regular blocklist process says we are golden so nothing to unblock.
Outlook.com and similar are an anathema to email. This is why they tell you not to run a mail server .
On the other hand rejecting domains without dmarc is fine. Just not happy it is silent.
show comments
stephbook
Sounds like something every mail sender should have done already.
Good for Microsoft customers and I don't care one bit for the lazy people who have to late-patch now.
show comments
klodolph
I set up DMARC on my personal domain so long ago I can't even remember when I did it. 10 years+?
I had kinda assumed that a lot of providers would start rejecting domains without DMARC support. I'm surprised it's happening this late.
show comments
codethief
Outlook.com has quietly dropped[0] emails from certain domains/IPs for years, even with SPF/DKIM/DMARC all properly set up and no history of spam. As someone who's administering their own mail server, Outlook has been the bane of my existence.
[0]: As in: They accepted the email just fine (according to the logs) but it still didn't end up in the recipient's mailbox.
show comments
dwm
They're not rejecting them quietly. They're sending 5xx permanent delivery failures.
show comments
tzury
the problem is Gmail accepting emails from domains that have no MX records!
Even lazy spammers, who didn't even bother to create MX records for their fake, auto-generated domain, are getting into Gmail (Spam folder mostly, yet, why not reject it entirely?)
himata4113
I actually totally agree with this. There's too much risk involved with scams disguised as legitimate services because the developers of said service couldn't be bothered to add 1 or 2 dns records.
Although there seems that there hasn't been any communication which is the bad thing here. However, nobody looks at those and sending detailed emails back seems like a good enough solution.
show comments
green-salt
I thought they've been doing this for years, along with gmail/etc. I basically just added setting up the correct DNS records as part of business when sending emails externally.
show comments
stevefan1999
Well, if we can get a more relaxed email self hosting experience with the DMARC enforcement, I'd say it is a good trade-off in exchange with freedom of speech, rather than accepting the risk of spamming.
These days, hosting a proper mail server isn't really that hard, thanks to Stalwart https://stalw.art/. I did it to my Talos Linux cluster located on LA and utilizing idle resources. It is pretty great
verandaguy
This is interesting. At some point, I think it'll be desirable to give increasing positive weight to emails with the DPF/DKIM/DMARC trifecta configured, since those are least likely to be problem emails (spam or phishing), but I wonder what the best avenue is to actually make that the default. It's almost certainly not this kind of unannounced cutoff.
Email is, I think, among the most distributed popular online services, and there's a ton of stuff that's legacy, self-managed, or otherwise janky. Supporting SPF, DKIM, and DMARC does put a burden on independent operators, but is it an undue or unreasonable one in the current landscape? Or is it just the new cost of doing business?
show comments
Tree1993
I self-host my email system and rarely send any outbound email. Occasionally I receive emails from individual users. Users on Microsoft’s email service can send emails to me, but my replies are rejected outright. This doesn’t happen with Gmail or other email providers.
cyrusmg
Since yesterday my email started getting blocked. Does anyone know what's going on ?
5.4.1 smtp; 550 5.4.1 Recipient address rejected: Access denied.
For more information see https://aka.ms/…ors
<redacted>.eurprd02.prod.outlook.com 2026-11-08T19:48:58.651Z <redacted>]
show comments
Grimeton
The only mistake people make here is to accept that the problem is on their end even after Microsoft has accepted the e-mail but silently discarded it. This leads to the customer impression that the mistake happens on their end and not on Microsoft's.
When I see in my logs that the e-mail has been successfully delivered to their MTA then I don't have a problem.
show comments
origini
I don't get the Email thing anyway.
I had an email server and configured everything by the book. Still some scammer were able to send emails which looked like they came from me, so i got responds back.
If not even this was fixed...
show comments
subset
On an unrelated but frustrating "silent behaviour" note, I hate how Outlook rewrites URLs to add their "safe links" domain indirection. Just show me the damn raw URL!
tjwds
> Quietly Rejecting Email
> The sender gets a bounce
?
show comments
ofcrpls
I have the opposite problem. I have a 3-letter email address, so for ease of giving out the email address, I use it, while having it forwarded to my Gmail. Somewhere around 2019, emails from legitimate services, especially password reset/OTP codes, stopped landing in my inbox or even junk because my address is so high up the chain of spammers. Nebula was the first to confirm this for me and work out of band to re-enable access to my account - their emails to me were bouncing. But ever since that happened, I’ve slowly moved back to giving my Gmail.
show comments
esikich
As they should. You should have done this 5 years ago. Takes like 10 minutes. Gmail has been rejecting them for years at this point.
show comments
nottorp
I gave up last month and set up the outgoing email for my personal domain to go through the free tier of smtp2go.
Receiving is still self hosted.
alrtd82
Mail admins had 20+ years to fix config.
Not saying that outlook is properly config, but it’s well overdue using solutions designed to reduce spam.
show comments
wbkang
This is a good thing for the actual email users. The volume of really obvious “spam” emails were through the roof that it became quite tedious to rescue legit emails. It’s not like setting up DMARC is hard either.
show comments
physhster
Tangentially-related: Gmail has started sending completely legitimate emails to spam. DMARC/SPF/DKIM (2048 bits) all properly configured of course so there has to be something else that isn't documented.
show comments
netik
This has been going on for much longer than stated here - we had domain mismatch issues with outlook going back years and our policy was p=none. They’re very sensitive and mailing lists with forwarding are heavily impacted.
saagarjha
Mail security non-expert here, is this going to affect people who use alternative addresses for their Gmail account?
Email was invented in 1965. It needs to be replaced with something that doesn't try to bolt security on as a lazy afterthought 30-40 years later.
show comments
jonah
I had an email kicked back to me from Hotmail this past week complaining about missing DMARC. I fixed that and subsequent messages went through fine.
alrtd82
Rejecting emails from some domains. Why would emails “to” these domains also bounce back?
27bstroke6
I’ve been anticipating something like this for a while; the number of folks who don’t have their email-related DNS settings in order is remarkably high.
KwanEsq
And have Microsoft started checking DMARC correctly yet?
We discovered when we set up a third-party to send via Amazon SES with one of our domains at the start of 2025 that Microsoft didn't correctly check DKIM alignment, and would incorrectly fail valid emails. The issue, so far as I could tell at the time, was that if an email had multiple (in our case 2) DKIM signatures, Microsoft's handling seemed to be non-deterministic, sometimes checking one signature, sometimes the other, and sometimes both. Of course, those times when it only checked one signature and that wasn't the one for the sending domain, it would then fail the alignment check, even though there was a perfectly valid and aligned signature right there it had just decided to ignore.
I raised it with Microsoft support at the time, but they were unsurprisingly useless, I think the most constructive thing they said was "just add the Amazon SES IPs to your SPF record", which, uh, no.
In the end, IIRC, we ended up setting up the third party to sign into a 365 email account on our domain we created for them so they could send through MS's infrastructure and avoid all that. So no idea what their DMARC checking is like these days, but I'd assume the same, if not worse.
cloudie78
DMARC has been around for a while now. I know it’s fashionable to bash on Micro$oft and they rightfully deserve it.
Just not for this.
ourmandave
What if I include the header string, "DMARC and Jalad at Tanagra."
show comments
Krei-se
You can hate on outlook.com for a couple of reasons.
But this is not one of them.
Beijinger
Stop bitching guys, you have never dealt with t-online.de (T-Mobile)
I was hit by this twenty minutes ago. I don't disagree with the policy, but I wish my provider had warned me so I could add the headers. I already had DKIM and SPF, but not DMARC.
schappim
Didn't gmail already roll the same thing out in 2024?
shevy-java
> That rule is aimed at marketers and bulk senders, and most small businesses rightly assumed it didn't apply to them.
This would be naive. It currently means that Microsoft censors and
decides what you can see in the first place. I do not recall having
given Microsoft such a permission. On the other hand I don't use
Microsoft for email anyway (though, unfortunately, one local university
here does, which is super-annoying. Europe is unable to think strategically
here).
aetherspawn
If BIMI was in any way scalable it would actually provide a way for an external signer to say “yeah we trust these guys, you should deliver this”.
I haven’t really seen BIMI for less than practically $1000/year and most clients still don’t check it.
alfiedotwtf
It’s 2026.. having been at a few email companies for years, this time I would agree with Outlook on this one
globular-toast
I've got the DMARC record on my domain, but it does seem very silly. Why couldn't the spec just make `p=None` the default?
dzink
Yahoo is too.
show comments
TwoNineFive
For anyone running their own mail server, Microsoft has an authorization system to let you "authorize" your mail server IPs to talk with Microsoft's mail servers.
It's stupid, but not terribly difficult to set up and authorize.
Like most people who run their own mail, I have had repeated problems with Microsoft in particular, who treats small mail server operators like crap.
This post reminded me that I had gotten some email requesting me to "Re-attest Your Network Access". I went in, clicked a few things, and I'm good for another year or whatever.
Email is dead. Unfortunately any replacement for it would be owned by Meta or MS or whatever.
show comments
octoberfranklin
> The fix is one DNS record.
Oh god the slop.
Only an LLM would describe DMARC as just "one DNS record".
show comments
daneel_w
It's possibly yet another issue relating to the long streak of problems seen the recent months by primarily self-hosters trying to reach people and businesses behind Outlook servers. The past few weeks a lot of my e-mails to friends and family using Hotmail have gone missing. All envelopes were OKd by Outlook servers, nothing bounced, e-mails just gone. My setup is clean, my network is clean.
show comments
xmddmx
"Since November 5, 2026, Microsoft's consumer mail service has been turning away some of the email from domains that don't publish a DMARC record. If your company emails customers, vendors or applicants with outlook.com, hotmail.com, live.com or msn.com addresses, some of that mail may be bouncing right now. Nobody announced it. The fix is one DNS record."
I'm personally seeing this with some email systems I manage - email sent from a domain that has proper SPF and DKIM signatures, but had no DMARC record started bouncing this weekend.
Outlook.com is also rejecting mail based on blocklists that are not public and you essentialy cannot get yourself out. My VPS provider is pretty much entirely blocked and their regular blocklist process says we are golden so nothing to unblock.
Outlook.com and similar are an anathema to email. This is why they tell you not to run a mail server .
On the other hand rejecting domains without dmarc is fine. Just not happy it is silent.
Sounds like something every mail sender should have done already.
Good for Microsoft customers and I don't care one bit for the lazy people who have to late-patch now.
I set up DMARC on my personal domain so long ago I can't even remember when I did it. 10 years+?
I had kinda assumed that a lot of providers would start rejecting domains without DMARC support. I'm surprised it's happening this late.
Outlook.com has quietly dropped[0] emails from certain domains/IPs for years, even with SPF/DKIM/DMARC all properly set up and no history of spam. As someone who's administering their own mail server, Outlook has been the bane of my existence.
[0]: As in: They accepted the email just fine (according to the logs) but it still didn't end up in the recipient's mailbox.
They're not rejecting them quietly. They're sending 5xx permanent delivery failures.
the problem is Gmail accepting emails from domains that have no MX records!
Even lazy spammers, who didn't even bother to create MX records for their fake, auto-generated domain, are getting into Gmail (Spam folder mostly, yet, why not reject it entirely?)
I actually totally agree with this. There's too much risk involved with scams disguised as legitimate services because the developers of said service couldn't be bothered to add 1 or 2 dns records.
Although there seems that there hasn't been any communication which is the bad thing here. However, nobody looks at those and sending detailed emails back seems like a good enough solution.
I thought they've been doing this for years, along with gmail/etc. I basically just added setting up the correct DNS records as part of business when sending emails externally.
Well, if we can get a more relaxed email self hosting experience with the DMARC enforcement, I'd say it is a good trade-off in exchange with freedom of speech, rather than accepting the risk of spamming.
These days, hosting a proper mail server isn't really that hard, thanks to Stalwart https://stalw.art/. I did it to my Talos Linux cluster located on LA and utilizing idle resources. It is pretty great
This is interesting. At some point, I think it'll be desirable to give increasing positive weight to emails with the DPF/DKIM/DMARC trifecta configured, since those are least likely to be problem emails (spam or phishing), but I wonder what the best avenue is to actually make that the default. It's almost certainly not this kind of unannounced cutoff.
Email is, I think, among the most distributed popular online services, and there's a ton of stuff that's legacy, self-managed, or otherwise janky. Supporting SPF, DKIM, and DMARC does put a burden on independent operators, but is it an undue or unreasonable one in the current landscape? Or is it just the new cost of doing business?
I self-host my email system and rarely send any outbound email. Occasionally I receive emails from individual users. Users on Microsoft’s email service can send emails to me, but my replies are rejected outright. This doesn’t happen with Gmail or other email providers.
Since yesterday my email started getting blocked. Does anyone know what's going on ?
The only mistake people make here is to accept that the problem is on their end even after Microsoft has accepted the e-mail but silently discarded it. This leads to the customer impression that the mistake happens on their end and not on Microsoft's.
When I see in my logs that the e-mail has been successfully delivered to their MTA then I don't have a problem.
I don't get the Email thing anyway.
I had an email server and configured everything by the book. Still some scammer were able to send emails which looked like they came from me, so i got responds back.
If not even this was fixed...
On an unrelated but frustrating "silent behaviour" note, I hate how Outlook rewrites URLs to add their "safe links" domain indirection. Just show me the damn raw URL!
> Quietly Rejecting Email
> The sender gets a bounce
?
I have the opposite problem. I have a 3-letter email address, so for ease of giving out the email address, I use it, while having it forwarded to my Gmail. Somewhere around 2019, emails from legitimate services, especially password reset/OTP codes, stopped landing in my inbox or even junk because my address is so high up the chain of spammers. Nebula was the first to confirm this for me and work out of band to re-enable access to my account - their emails to me were bouncing. But ever since that happened, I’ve slowly moved back to giving my Gmail.
As they should. You should have done this 5 years ago. Takes like 10 minutes. Gmail has been rejecting them for years at this point.
I gave up last month and set up the outgoing email for my personal domain to go through the free tier of smtp2go.
Receiving is still self hosted.
Mail admins had 20+ years to fix config. Not saying that outlook is properly config, but it’s well overdue using solutions designed to reduce spam.
This is a good thing for the actual email users. The volume of really obvious “spam” emails were through the roof that it became quite tedious to rescue legit emails. It’s not like setting up DMARC is hard either.
Tangentially-related: Gmail has started sending completely legitimate emails to spam. DMARC/SPF/DKIM (2048 bits) all properly configured of course so there has to be something else that isn't documented.
This has been going on for much longer than stated here - we had domain mismatch issues with outlook going back years and our policy was p=none. They’re very sensitive and mailing lists with forwarding are heavily impacted.
Mail security non-expert here, is this going to affect people who use alternative addresses for their Gmail account?
> Nobody announced it
They did: https://techcommunity.microsoft.com/blog/microsoftdefenderfo...
And it appears to be further documented here:
https://learn.microsoft.com/en-us/defender-office-365/anti-p...
https://learn.microsoft.com/en-us/defender-office-365/email-...
And other sites were reporting about it for at least a year and a half:
https://powerdmarc.com/dmarc-outlook-email-authentication/ (see #4)
https://www.mailreach.co/blog/outlook-dmarc-requirements
Email was invented in 1965. It needs to be replaced with something that doesn't try to bolt security on as a lazy afterthought 30-40 years later.
I had an email kicked back to me from Hotmail this past week complaining about missing DMARC. I fixed that and subsequent messages went through fine.
Rejecting emails from some domains. Why would emails “to” these domains also bounce back?
I’ve been anticipating something like this for a while; the number of folks who don’t have their email-related DNS settings in order is remarkably high.
And have Microsoft started checking DMARC correctly yet?
We discovered when we set up a third-party to send via Amazon SES with one of our domains at the start of 2025 that Microsoft didn't correctly check DKIM alignment, and would incorrectly fail valid emails. The issue, so far as I could tell at the time, was that if an email had multiple (in our case 2) DKIM signatures, Microsoft's handling seemed to be non-deterministic, sometimes checking one signature, sometimes the other, and sometimes both. Of course, those times when it only checked one signature and that wasn't the one for the sending domain, it would then fail the alignment check, even though there was a perfectly valid and aligned signature right there it had just decided to ignore.
I raised it with Microsoft support at the time, but they were unsurprisingly useless, I think the most constructive thing they said was "just add the Amazon SES IPs to your SPF record", which, uh, no.
In the end, IIRC, we ended up setting up the third party to sign into a 365 email account on our domain we created for them so they could send through MS's infrastructure and avoid all that. So no idea what their DMARC checking is like these days, but I'd assume the same, if not worse.
DMARC has been around for a while now. I know it’s fashionable to bash on Micro$oft and they rightfully deserve it.
Just not for this.
What if I include the header string, "DMARC and Jalad at Tanagra."
You can hate on outlook.com for a couple of reasons.
But this is not one of them.
Stop bitching guys, you have never dealt with t-online.de (T-Mobile)
https://telekomhilft-telekom-de.translate.goog/conversations...
I was hit by this twenty minutes ago. I don't disagree with the policy, but I wish my provider had warned me so I could add the headers. I already had DKIM and SPF, but not DMARC.
Didn't gmail already roll the same thing out in 2024?
> That rule is aimed at marketers and bulk senders, and most small businesses rightly assumed it didn't apply to them.
This would be naive. It currently means that Microsoft censors and decides what you can see in the first place. I do not recall having given Microsoft such a permission. On the other hand I don't use Microsoft for email anyway (though, unfortunately, one local university here does, which is super-annoying. Europe is unable to think strategically here).
If BIMI was in any way scalable it would actually provide a way for an external signer to say “yeah we trust these guys, you should deliver this”.
I haven’t really seen BIMI for less than practically $1000/year and most clients still don’t check it.
It’s 2026.. having been at a few email companies for years, this time I would agree with Outlook on this one
I've got the DMARC record on my domain, but it does seem very silly. Why couldn't the spec just make `p=None` the default?
Yahoo is too.
For anyone running their own mail server, Microsoft has an authorization system to let you "authorize" your mail server IPs to talk with Microsoft's mail servers.
It's stupid, but not terribly difficult to set up and authorize.
Like most people who run their own mail, I have had repeated problems with Microsoft in particular, who treats small mail server operators like crap.
This post reminded me that I had gotten some email requesting me to "Re-attest Your Network Access". I went in, clicked a few things, and I'm good for another year or whatever.
https://substrate.office.com/ip-domain-management-snds/snds
https://www.litmus.com/blog/what-is-microsoft-snds-why-your-...
Its not "one header" to fix. SPF and DKIM must be implemented.
Yeah thanks Microsoft. Really appreciate having to mitigate this for hundreds of customers on a weekend. Nice one!
I noticed this when it happened, but I do have a valid DMARC entry (albeit p=quarantine).
https://mastodon.social/@davisr/117570496362439342
Email is dead. Unfortunately any replacement for it would be owned by Meta or MS or whatever.
> The fix is one DNS record.
Oh god the slop.
Only an LLM would describe DMARC as just "one DNS record".
It's possibly yet another issue relating to the long streak of problems seen the recent months by primarily self-hosters trying to reach people and businesses behind Outlook servers. The past few weeks a lot of my e-mails to friends and family using Hotmail have gone missing. All envelopes were OKd by Outlook servers, nothing bounced, e-mails just gone. My setup is clean, my network is clean.
"Since November 5, 2026, Microsoft's consumer mail service has been turning away some of the email from domains that don't publish a DMARC record. If your company emails customers, vendors or applicants with outlook.com, hotmail.com, live.com or msn.com addresses, some of that mail may be bouncing right now. Nobody announced it. The fix is one DNS record."
I'm personally seeing this with some email systems I manage - email sent from a domain that has proper SPF and DKIM signatures, but had no DMARC record started bouncing this weekend.