Microsoft are rejecting your mail
68 points by robalex
68 points by robalex
Microsoft is notoriously difficult to get legitimate emails delivered to. Some would say a dark art.
With that said, if you plan to send any quantity of email in 2026 from your own domain or a customer domain -- do expect to configure the trinity of DKIM, SPF, and DMARC. You're allowed to disagree on the philosophy of any one or all of them, but just know that your objections will be unheard by all the major email providers. And until you have all three, you simply can't expect emails to be delivered reliably, and this has been the case for roughly the last 10 years.
Is there any reliable data on this? As the article notes, even Microsoft, notoriously finnicky, was accepting mail without DMARC records just fine up until recently. Google definitely accepts mail without either DMARC or SPF records.
And while I agree with the philosophy of DKIM, SPF was a bad design that only makes sense in the rare cases where
It should not be used for new deployments.
Mail server administration is made worse by the fact that most advice and bad practices are cargo culted scare stories about the strange rituals necessary to appease the mail server gods.
And yes, undoubtedly there are mail server admins somewhere who will drop your mail if your server doesn't have a SPF record, just as there are admins who block and drop on a variety of questionable reasons, such as spam content filters, long-dead RBLs, lack of reverse DNS, etc.
If you make your "best practices" the intersection of the most strict and stupid practices of all mail server administrators in the world, you're obviously better off sending a post card.
Essentially, all three are required, because:
From header from being spoofed. However, the DKIM signature does not have to be from the domain in the From header.FROM in the SMTP session.FROM and the MIME From header has the same domain (roughly, depending on if strict or relaxed) and that the DKIM signature is also in the same domain.Without DMARC, people can still spoof mail from your domain, they just need to provide their own DKIM keys on a domain they control. Without SPF, they can also claim that it was sent from your mail server.
Email runs on ancient protocols, and we keep finding "new" ways they are broken, and kinda paper it over with extensions.
First of all, that requires a mechanistic interpretation of the standards that I don't think any of the large providers abide by.
But even if this were the case, this argues for DMARC, not SPF. SPF does not prevent a spammer from impersonating anyone, it's not applied during the HELO handshake. It's a historical artifact that used to have a limited application in preventing backscatter spam.
Not having an SPF record present actually removes an impersonation vector, as only DKIM records will be used as proof of alignment.
Since requiring the envelope sender and the MIME From to be identical is extremely brittle anyway, we would all be much better off without it.
While SPF was always useless and potentially harmful, it's still a little ritual you have to do because some people expect you to.
It should not be used for new deployments.
I consider this bad advice for anyone hoping to get mail delivered.
Mail server administration is made worse by the fact that most advice and bad practices are cargo culted scare stories about the strange rituals necessary to appease the mail server gods.
What I'm saying is experience, not dogma.
And yes, undoubtedly there are mail server admins somewhere who will drop your mail if your server doesn't have a SPF record
Yes, they are named Google (https://knowledge.workspace.google.com/admin/security/set-up-spf), and many others.
Email senders: If you send email to personal Gmail accounts, you must set up email authentication to ensure your email is delivered as expected. All senders must Set up SPF or Set up DKIM. Bulk senders (more than 5,000 messages daily) must Set up SPF, Set up DKIM, and Set up DMARC. Learn more at Email sender guidelines.
Granted, they only require SPF for senders sending more than 5k messages per day. For many companies, this threshold is trivial to hit.
If you're running email for other people it's doubly important to add the trinity of records, because you don't know where your users will be sending mail, and you don't know every provider's esoteric rules for SPF, DKIM, and DMARC.
Microsoft has always been difficult to deal with with regard to email delivery. Not sure it’s still the case but some time ago (when I was still dealing with outbound SMTP) you had to submit a form to the Junk Mail Reporting Program to have any chance of not having your emails screened out (not even sent to Junk!) even if you had SPF, DKIM and DMARC all correctly configured.
What's great is that they have like three different forms for getting removed from different lists, but then they also seem to have some ban lists there are no forms for. :s
Last time I had trouble with them, I couldn't even get to the right forms. Just gave up in the end and told my users (family) to blame Microsoft because I have everything set up correctly and there's not a lot I can do if dickheads are going to dickhead.
They've been blocking my emails for over a decade, from two IPv4 and two IPv6 addresses at Scaleway. The Junk Mail Reporting Program says my IP address is clean, so I have no recourse. SPF, DKIM and DMARC all correctly configured, of course.
They don't have any issue sending me spam, though.
As the post notes, Microsoft mention this was a mistake. A pretty big one!
Microsoft are now rejecting mail without a DMARC policy, but accepting mail with a policy of none. This is a massive and pointless change in their policy for incoming mail
I don't think this would be pointless. Email providers are likely fighting a bunch of decent spam, and keen to raise the baseline for email auth.
Forcing email operators to set a DMARC policy (even "none"):
It is, if anything, the most gradual step to raising the bar with DMARC.
Even DMARC set to "none" starts enforcing that the MIME headers, SMTP From, and DKIM domain are aligned. Without DMARC spoofing is still possible.
Which makes one wonder if it was, in fact, actually a mistake and not simply a trial balloon.
Classic problem of:
A setup that works most of the time requires at least two accounts (and the Reply-To header)... atlhough big-tech providers can't even get along with themselves so you really need an account on each one...
Every big mail provider is absolutely IMPOSSIBLE to get mail to. I got sick of setting up my own mail server and eventually went to a split IMAP/SMTP setup using third party providers. It works, I guess. I'm using Cloudflare Mail Routing to route to my Gmail account, and then using SMTP2GO to send mail.
Modern mail is such a centralized mess.
Microsoft isn't the only one. DMARC even if sat to none has been a requirement of some large providers for years. Don't want to point at any cause I didn't write it down, but yes set your DMARC record to anything valid. I always guessed it was a bit of a hack to require it (can't imagine this makes such a difference for actual spam compared to dkim and SPF) but yeah that's what some providers did for a pretty long time now.