Outlook.com is rejecting email from domains without DMARC

"Since November 5, 2026, Microsoft's consumer mail service has been turning away some of the email from domains that don't publish a DMARC record. If your company emails customers, vendors or applicants with outlook.com, hotmail.com, live.com or msn.com addresses, some of that mail may be bouncing right now. Nobody announced it. The fix is one DNS record." I'm personally seeing this with some email systems I manage - email sent from a domain that has proper SPF and DKIM signatures, but had no DMARC record started bouncing this weekend.

I actually totally agree with this. There's too much risk involved with scams disguised as legitimate services because the developers of said service couldn't be bothered to add 1 or 2 dns records. Although there seems that there hasn't been any communication which is the bad thing here. However, nobody looks at those and sending detailed emails back seems like a good enough solution.

• itopaloglu83 · 10 hours ago

  Maybe they should also work on what their users are sending as well.

  • himata4113 · 10 hours ago

    Unfortunately, the people abusing these are very persistent and adding more checks will just increase the sophistication of such attacks which works against the interests of the target. This stops disguising yourself as a legitimate service.

    • SoftTalker · 9 hours ago

      Charge for the service. How much spam do you get from Fastmail?

  • paulddraper · 10 hours ago

    If they did that you’d decry censorship. Allowing basically ~whatever, but proving the sender address is an obviously good approach to me.

• almost · 10 hours ago

  I don't know what "v=DMARC1; p=none;" is proving to anyone when DKIM and SPF are already aligned but sure whatever. Just wish they'd given some warning!

  • himata4113 · 10 hours ago

    email is weird, without this it doesn't perform the checks at all

  • semolino · 10 hours ago

    Agreed. There's no additional verity provided by adding a DNS record with a static line of text. Reminds me of airport security theater: meaningless hoops for citizens to jump thru under the guise of stopping bad actors.

This is interesting. At some point, I think it'll be desirable to give increasing positive weight to emails with the DPF/DKIM/DMARC trifecta configured, since those are least likely to be problem emails (spam or phishing), but I wonder what the best avenue is to actually make that the default. It's almost certainly not this kind of unannounced cutoff. Email is, I think, among the most distributed popular online services, and there's a ton of stuff that's legacy, self-managed, or otherwise janky. Supporting SPF, DKIM, and DMARC does put a burden on independent operators, but is it an undue or unreasonable one in the current landscape? Or is it just the new cost of doing business?

• anonymous908213 · 10 hours ago

  > but is it an undue or unreasonable one in the current landscape Yes. In the first place, this should not even be a thing. Two corporations should not be in control of who can send e-mail. If they want to mark not having DMARC as spam, mark it as spam, or better yet flag it with a specific warning about the domain, but these games with refusing to deliver are just bullshit and essentially force a monopoly where other e-mail providers cannot compete because their e-mails aren't delivered.

  • mike_hearn · 9 hours ago

    No, not delivering is much better. You get a clean error message that tells you exactly what to do, it can be fixed in minutes. Spamfoldering email for not having DMARC would be a mistake, it might be years before low volume senders notice and figure out what's wrong (if they ever do).

    • anonymous908213 · 9 hours ago

      > You get a clean error message that tells you exactly what to do We are literally talking about a situation where this is not happening! And the problem is that it's not just this. Once you give them a license to police e-mail, they start policing e-mail for all kinds of arbitrary and inscrutable reasons. If this were going to be done, it should really be formalized as an industry standard by an independent consortium, not up to the whims of Microsoogle.

      • mike_hearn · 9 hours ago

        Are we? Microsoft is bouncing emails with instructions on what to do. DMARC, DKIM and the rest are industry standards set through an independent consortium (it's called the MAAWG iirc)

• stevekemp · 10 hours ago

  It seems like 90% of the spam I receive (on my google account) is sent from google addresses, so it will have valid SPF/DKIM/DMARC setup. That said checking for these things is a good idea, the only problem I see is dropping the mail on the floor, rather than rejecting it at SMTP time - at least that lets the self-hosting users who haven't got things configured know their email is being rejected, and to pick up the phone instead. There's nothing worse than sending an email, it being accepted, and then later discarded with no clue to either sender or recipient.

  • shye · 10 hours ago

    Selection bias: you don’t see the spam that get rejected at HELO.

    • cowlevel · 37 minutes ago

      My server doesn't reject anyone, but does greylisting. That's a default setting in Postfix. It means the first time an IP address connects it gets a temporary error. If it retries later the message is accepted. That's the only anti-spam measure I have. Maybe 1 in 5 emails I get is spam, and because I use a different address with every sender I know who sold "my" address to a spam list.

• stephbook · 10 hours ago

  > I wonder what the best avenue is to actually make that the default. It's almost certainly not this kind of unannounced cutoff. En contraire, I think not delivering mail is the fastest way to adoption. People will use an old system for as long as it works. It now does not anymore.

  • verandaguy · 7 hours ago

    I don't know. I think this disenfranchises a lot of independent operators, and the blow of that could at least be softened by making a highly-visible public announcement about it a few months ahead of time. Maybe you're right that just enforcing it is the way, but I don't agree with doing that with no heads up.

• jwr · 10 hours ago

  Most spam I get is from Google, Microsoft and Amazon. We should pressure those to start dealing with the problem. Right now they are conveniently ignoring it.

• esikich · 9 hours ago

  There's no burden whatsoever. It's a one time setup that takes like 15 minutes.

  • verandaguy · 7 hours ago

    That is a burden definitionally, though; and that's to say nothing of the effort required to understand the technology and its impacts on operations.

    • esikich · 6 hours ago

      You can literally just Google a 3 step guide for any provider. What are you even arguing? That security for infra shouldn't be a thing? Should grandma be able to run a mail server? What's your point?

      • verandaguy · 6 hours ago

        I'm arguing that with a system as distributed as email, there will certainly be people who won't do this upgrade; I'm highlighting the contrast between the need for this set of technologies (SPF, DKIM, DMARC) and the utility of an old-school open web where the barrier to entry is low and anyone can participate. We have seen a massive erosion of the latter aspect of the web in the past few years, and I think it's useful to frame conversations in terms of that loss. The web used to be fun, and now it's become, more than ever, a professional enterprise. You often can't stand up a website without having to buy into Cloudflare's DDoS protection or something equivalent. I think this is absurd, and it's not the only such case, though these changes are obviously reactions to how usage of the web's evolved over the years. I wonder if we can get the old web back in some way, shape, or form, cause I think we've lost something with the corporatization of the internet. And for what it's worth, yeah, I think grandma should be able to run a mail server. Why not?

• 9029 · 7 hours ago

  I could be naive, but I don't see how this would be any more unreasonable than requiring HTTPS

  • cowlevel · 35 minutes ago

    Requiring HTTPS was very unreasonable. You have so many more moving parts that can go wrong, and a business relationship with a CA (even if it's Let's Encrypt). We only tolerate this because the alternative is worse.

• rcxdude · 7 hours ago

  None of them are a good 'Is this spam?' heuristic, though. All they do is ensure the sending domain isn't forged, but most spam, even phishing emails, doesn't really rely on that. Spammers are much more motivated than average to jump through the hoops necessary to set it up, as well. Any anti-spam signal needs to be much more expensive for spammers than regular senders.

I noticed this when it happened, but I do have a valid DMARC entry (albeit p=quarantine). https://mastodon.social/@davisr/117570496362439342

Yeah thanks Microsoft. Really appreciate having to mitigate this for hundreds of customers on a weekend. Nice one!

• esikich · 9 hours ago

  You should have done this for your customers years ago, yikes.

  • urbandw311er · 9 hours ago

    I suspect that he/she means they runs a mail server and it was up to his customers to comply, but now they’ve had to deal with the fallout from their customers not complying.

    • esikich · 7 hours ago

      Cool, charge them for it. That's what IT support is.

  • almost · 8 hours ago

    The customers have to do it themselves since they control their domains. I recommend doing everything correctly but also understand that this stuff is pretty hard for people just trying to run a small business. But if it makes you happy to feel smug you can carry on assuming.

    • esikich · 7 hours ago

      My assumption is that they were in control of the domains. If not, it isn't their problem and if anything it's billable hours, aka their job.

It's possibly yet another issue relating to the long streak of problems seen the recent months by primarily self-hosters trying to reach people and businesses behind Outlook servers. The past few weeks a lot of my e-mails to friends and family using Hotmail have gone missing. All envelopes were OKd by Outlook servers, nothing bounced, e-mails just gone. My setup is clean, my network is clean.

• SoftTalker · 9 hours ago

  I'm fine with providers imposing some default level of spam protection but as a user I'd like the option to disable it, even better if I can disable it per domain or sender. The old technique of adding the sender to your contacts doesn't work reliably anymore.

  • daneel_w · 9 hours ago

    "The old technique of adding the sender to your contacts doesn't work reliably anymore." An Outlook user first reaching out to you, and you replying and including the unique message-ID of their original envelope in your headers, doesn't affect anything either. Absurd. The whole situation is complete dog shit.

• pamcake · 8 hours ago

  "First time?" It's not months it's years.

  • daneel_w · 7 hours ago

    Anecdotal. I've self-hosted for many years but didn't run into these issues with O365 until this year. But not surprised to hear it.

    • cowlevel · 22 minutes ago

      They used to just drop all messages from domains not on their whitelist and to get whitelisted you needed to have a Microsoft account and open a support ticket.

I thought they've been doing this for years, along with gmail/etc. I basically just added setting up the correct DNS records as part of business when sending emails externally.

• jmathai · 9 hours ago

  You can send an email through mail-tester to see what you might be missing. https://mail-tester.com/

I’ve been anticipating something like this for a while; the number of folks who don’t have their email-related DNS settings in order is remarkably high.

Sounds like something every mail sender should have done already. Good for Microsoft customers and I don't care one bit for the lazy people who have to late-patch now.

• sshine · 10 hours ago

  Yeah, and people who don't switch to Dvorak are lazy, too! https://ciphercue.com/blog/dmarc-enforcement-gap-rua-fragmen... https://news.ycombinator.com/item?id=49081783 I have MCP servers for the creation of domains, DNS records with DNSSEC, and email accounts with SPF, DKIM and DMARC. I'm sure if someone wants to be a professional spammer today, DMARC is not a differentiator.

  • BLKNSLVR · 9 hours ago

    It's an interesting argument. The fact this article exists is somewhat proof that it is a differentiator. The flipside, however, is that spammers very specifically require their emails to get to add many mailboxes as possible, so their motivation is greater to make their emails service compatible. Company sys admins have likely got all sorts of other issues to worry about, and the occasional report of an email not getting through is likely low on their to-investigate list. Having said that, I self host a mail server, and have all those things setup correctly, and my workplace uses Outlook, and I've not had issues with delivery, so it's not a particularly difficult bar to jump.

    • saghm · 9 hours ago

      What? How does it prove it's a differentiator for someone who wants to be a spammer, which is what the comment you replied to made a claim about? As far as I can tell, it's evidence (not proof) that Microsoft thinks that they will reduce spam by requiring it, which in turn is circumstantial evidence (definitely not proof) that spammers might have to spend some amount of effort to start using DMARC. I don't understand how you can conclude that it would be onerous for them to do so indefinitely; it seems equally plausible that they might have just not bothered to do it before now but will be able to start doing it without much cost.

• stavros · 10 hours ago

  "Lazy people"? I only heard about this because a customer complained. Am I supposed to go around the Internet, checking what each mail server will allow or deny?

  • reynard_le_faux · 9 hours ago

    As a company we realised about 12 months ago that email can no longer be considered a reliable method of communication. I understand the reasoning but the result is the result. Many new clients we deal with have whitelists on and we have to pester our clients to add us to their lists. Not a great experience for anyone. I think we should consider email pretty much moribund at this point.

    • saagarjha · 9 hours ago

      So what have you switched to instead?

      • EGreg · 9 hours ago

        Spoiler alert: no method of communication is reliable anymore. All of them are controlled by companies that will route your messages to spam.

        • threatofrain · 9 hours ago

          If reliable means the message gets through no matter what, then it's good that no channel is reliable. Such a channel will inevitably be used for spam and attention grabbing.

      • SoftTalker · 9 hours ago

        Postal mail still works.

    • rednb · 9 hours ago

      Strengthen your contracts / terms of service. Make it their responsibility to configure their email systems properly so they receive emails sent from your domains.

    • urbandw311er · 9 hours ago

      It is literally one of the last free and open channels on the Internet – I suggest you work on supporting its use and keeping it that way rather than moving to something controlled for profit or data harvesting.

      • SoftTalker · 9 hours ago

        It being free and open is exactly what the big providers can't stand and why they are coming up with ever more "standards" that are complex to configure as well as "reputation" scores that are hard for small senders to clear. Also why they do non-standard stuff like accepting mail but then simply not delivering it, rather than bouncing it.

        • nine_k · 7 hours ago

          DMARC is not hard. "Reputation scores" and blacklists / greylists started in late 1990s / early 2000s as multiple grassroots efforts when spam started to overwhelm systems. Gmail did not exist, outlook.com did not exist, it was easy and expected to run your own SMTP (which I did). And it was very unpleasant. DMARC appeared 10 if not 15 years ago. There's no reason for a sane MTA configuration not to have it.

          • jonathanlydall · 1 hour ago

            Outlook.com is a rebranding of Hotmail.com which absolutely did exist in the 90’s.

        • expedition32 · 7 hours ago

          Microsoft has provided free email addresses to the public for decades.

      • anonymous908213 · 9 hours ago

        Calling it a "free and open channel" when 80% of consumers are on Microsoft/Google addresses that control who can deliver e-mail is laughable. It's dead, Jim.

        • urbandw311er · 8 hours ago

          Fair point - I meant free in the sense that the protocol is open. I didn’t mean that it’s not under threat.

        • stephbook · 8 hours ago

          You seem to miss the point WHY customers go there. I, for one, switched when I realized Google filters spam effectively.

          • theK · 6 hours ago

            That WHY seems to only address a very small slice of the market. Some other WHYs I've encountered - it was a way to outsource the mail server administration and already free in our corporate package Which is pretty much all I have from the corporate side. On the personal or small business side its most often - I don't really care that much about running my own stuff - I needed a personal email address All these are valid reasons/motivations but none explicitly argue that email messaging should become proprietary.

      • pixl97 · 7 hours ago

        There is no such thing as a free and open channel on the internet that will not suffer the tragedy of the commons.

    • cowlevel · 39 minutes ago

      It can be reliable, but requires an explicit agreement between the two parties. When my server connects to your server and sends a message, that part is reliable enough. If your server decides to delete the message after receiving it, that's entirely on you. You could configure it to never delete messages from me and then it's fine. The problem is that in reality nobody does this, so your vendors and customers get treated identically to random spammers.

  • rednb · 9 hours ago

    To be fair, DMARC has been required for a very long time. IIRC Google warned about 2 years ago circa that non-compliant emails would land in spam or be null-routed. And the DMARC noise started even before that.

    • mike_hearn · 9 hours ago

      Gmail only requires DMARC for senders that send >5000 emails per day. Below that it's not required. That rule only appeared in 2024 so I wouldn't say it's been required for a very long time. Perhaps you're thinking of DKIM, which is different.

  • caymanjim · 9 hours ago

    No. You're supposed to understand how mail works on the Internet, and configure it correctly so that everyone else accepts it. Go to https://mail-tester.com . Send a test email. If you don't get 10/10, fix your shit.

    • datfrojo · 9 hours ago

      This seems overly dismissive especially for individuals who send emails from custom domains at low volumes. DMARC has previously been seen to only be really needed for high-volume senders. The mail testing service linked still gives 10/10 for emails received without DMARC (but with SPF and DKIK). My email is setup via Fastmail and I followed all the recommendations they provided (which didn’t include DMARC)

    • saghm · 8 hours ago

      I just tried this out now with an email from my personal domain that I have configured to send via my gmail account. I got a 10/10, but DMARC does not seem to be required for this. It shows a yellow checkbox for me on this, the same as it shows for me not having an unsubscribe button, which hardly gives the impression of it being necessary, given that I would not expect an unsubscribe button to make sense for most people manually sending emails to their customers from corporate email accounts.

    • daneel_w · 7 hours ago

      Not enough. O365 still discard/lose e-mails.

    • svdr · 7 hours ago

      This service is not accurate, it cannot handle multiple dkim keys.

  • dofm · 9 hours ago

    Delivery to Microsoft's products has been patchy for several years. I am not remotely an email deliverability expert but I have made different SMTP service choices based on how companies approach shared-IP sending plans. Some can affordably deliver to Microsoft because they aggressively police what they are actually sending on their customers' behalf; others don't get involved and you end up having to spend a fortune on a dedicated IP. The DMARC thing is just another part of this; one of my clients discovered this silent failure themselves a few weeks back and addressed this.

  • stephbook · 8 hours ago

    If running a mail server is central to your business, you should keep up with best practices. If not, 2 days of non-delivery aren't important, just resend.

  • jared_stewart · 8 hours ago

    You don't have to, this is the key reason to have a DMARC monitoring service. It will tell you when there's a deliverability issue with some particular receiver. DMARC applies not on your mail server, inbound or outbound, but on the server that is receiving your mail (which may in fact be your mail server). That server will look at how the mail authenticates and decide if it should allow the mail to proceed, it (for the most part) will then tell you whether or not it allowed the mail. This is how you will know you might have a deliverability problem before your customers do. If you're wanting to know about deliverability (particularly for this Microsoft case), my company (Alesian Security) has a free check at https://alesiansecurity.com/try?tab=deliverability

    • toast0 · 7 hours ago

      > You don't have to, this is the key reason to have a DMARC monitoring service. It will tell you when there's a deliverability issue with some particular receiver. It's been a while, but monitoring DMARC seemed pointless once you got things started. If my outbound mail fails to validate, I've asked the receivers to bounce it, and I should be able to see that on my own system. Otherwise, I'm just getting reports about spoofed spam or people who need to adjust their mail forwarding, but I can't do anything about either.

      • jared_stewart · 7 hours ago

        right, if you're at a reject status DMARC monitoring is (and should be) boring. But it provides a safe guard against accidentally broken mail flows as your email stack evolves over time which is where it pays dividends. I would love to say that it would have alerted you ahead of time to this particular event, but given that it's the fix here you would never have seen it.

• 0c3ca83 · 9 hours ago

  DMARC is a DNS record that says "send emails about spoofed messages here", or optionally "I don't need you to tell me that scammers exist on the internet". It doesn't prevent spoofing, it doesn't say which IPs are authorized to send on behalf of a domain, it doesn't sign messages. Spoofed messages are still sendable. Can you explain the benefit of only accepting email if Microsoft knows that you may or may not accept emails about scammers unsuccessfully spoofing your email domain? (Note, there's nothing you can do if they do tell you.) Don't confuse DMARC with DKIM or SPF; DMARC doesn't actually do anything for email security.

  • basilikum · 9 hours ago

    That is not true. Reports are just one of the features of DMARC. The policy which allows you to instruct senders what to do with unauthenticated emails is the much more relevant part an when the receiver follows it, it very much does prevent spoofing.

    • 0c3ca83 · 9 hours ago

      And what should a provider do if the dmarc policy says that none of the dkim or dmarc records should matter? What was the point of spf saying what servers could send, or dkim specifying signing keys? "Oh, please, don't ignore the other two ways I told you to ignore unauthorized messages" shouldn't need a knob.

      • basilikum · 7 hours ago

        You are a mail server. You get an email without a DKIM signature from me. Is that because I do not use DKIM and do not sign my emails or because the message is forged and not from me at all? You cannot tell. There is a single SPF record that you can look up to see if SPF is configured. It's just a TXT record on the domain. But there is no standard DKIM record. A DKIM signed email tells you what key identifier it used and you have to use that to look up the DKIM key at <key identifier>._domainkey.<sender domain>. When the email has no DKIM signature you cannot tell if that's because the sender domain does not use DKIM or if it does have a DKIM key record but it was not used, potentially because the email is forged.

        • 0c3ca83 · 7 hours ago

          Right. And if you mandate dkim, as seems to be the case with servers that demand dmarc, what's the issue? You reject the emails where dkim isn't set. Or do you think it's critical to support mail that doesn't have dkim?

          • basilikum · 6 hours ago

            You'll have a bad time if you just drop all emails without DKIM. There are many large senders that do not care about well established email standards and you will drop important emails.

            • 0c3ca83 · 6 hours ago

              These are the same senders that are correctly configuring DMARC?

  • rjsw · 6 hours ago

    DMARC gives you 20 reminders that you have sent an email, just incase you had forgotten.

• gtech1 · 9 hours ago

  lol, what a bunch of bs. gmail runs with p=none so tell me what benefits that has over having no dmarc record at all ?

• ramijames · 7 hours ago

  I kind of have to agree. DMARC is not new. It's useful and helps make email safer. It's not even hard to set up. There's just no reason for any legitimate mail provider not to use it. Same for people who are technical enough to run their own mail servers.

Yahoo is too.

• SoftTalker · 9 hours ago

  Yahoo has randomly rejected emails for decades. In my experience it's probably the worst among the mainstream providers.

I was hit by this twenty minutes ago. I don't disagree with the policy, but I wish my provider had warned me so I could add the headers. I already had DKIM and SPF, but not DMARC.

> Nobody announced it They did: https://techcommunity.microsoft.com/blog/microsoftdefenderfo... And it appears to be further documented here: https://learn.microsoft.com/en-us/defender-office-365/anti-p... https://learn.microsoft.com/en-us/defender-office-365/email-... And other sites were reporting about it for at least a year and a half: https://powerdmarc.com/dmarc-outlook-email-authentication/ (see #4) https://www.mailreach.co/blog/outlook-dmarc-requirements

• hedgehog · 9 hours ago

  That says for "high volume senders" but they now apply the rules regardless of volume.

  • ranger_danger · 9 hours ago

    Is there any actual evidence of this outside of this one company's AI-generated article?

    • Tomte · 9 hours ago

      I got a bounce on a mail from my personal Fastmail account (with my own domain) the day before yesterday. I had SPF/DKIM set up, just not DMARC. Did that yesterday and don‘t see the point. My policy is "none".

      • jared_stewart · 8 hours ago

        The point is to have a DMARC record, setting it to none doesn't really do much of anything for you though. If you really wanted to take advantage of it you will need a DMARC monitoring solution - the market seems to typically price these around $10/month for small-ish domains (though there are a lot of caveats). I'm trying to build a reasonable free option that maybe isn't enough to get a domain to a reject policy, but should be enough for you to maintain a reject policy. The truth is that there are amply "non-sending" domains out there which ignore DMARC and allow abuse. Stopping the assumption of no policy mean p=none prevents this abuse from persisting.

        • cowlevel · 26 minutes ago

          How does having a record with no policy make the internet safer?

    • jared_stewart · 8 hours ago

      There's been ample evidence of this, many different blogs, notification emails etc. This thread duplicates the first observations of this which showed up here yesterday at https://news.ycombinator.com/item?id=50404161 My mail provider, MXroute, sent me a notification of the issue early yesterday. There is commentary from various DMARC providers (Suped and PowerDMARC). This is a real thing. It does not matter which host you are using, this has nothing to do with the hosting provider. It has everything to do with having your domain correctly set up on DNS so that anybody receiving mail will know how to authenticate it. Microsoft has apparently advanced a policy that if you don't even try you don't get to send. IMO this is the right call, I've seen plenty of spoofing attacks where the attacker took advantage of nonexistent policy on non-sending domains. You might think that if you don't have an MX record the domain can't be used to send mail, that is wrong. The MX record only tells others where to send your mail, it says nothing about whether the domain can send mail itself.

      • majorchord · 7 hours ago

        Ample evidence that the policy now extends to low-volume senders? Could you provide even one example?

  • jared_stewart · 8 hours ago

    Yes, this is an older announcement from last year. Yahoo and Google did the same at that time. The failure associated with that announcement is different. It is 5.7.515. This new failure mode is "5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records (AS9031519)", I haven't seen any formal announcement on my end. The important thing to know about 5.7.1 is that it represents a few different failure modes, the AS9031519 is the important bit and it indicates that the domain lacks a DMARC record.

• donmcronald · 3 hours ago

  > For domains sending over 5,000 emails per day That's an old announcement about a different change. As far as I can tell this one is completely out of the blue. I'm shocked by the number of people in this thread advocating for spontaneous changes without any warning.

Mail security non-expert here, is this going to affect people who use alternative addresses for their Gmail account?

• gushie · 9 hours ago

  It affected my google workspace account

  • saagarjha · 9 hours ago

    Do you know if it’ll affect my (personal) account? I run everything through a normal Gmail account and have forwarding for incoming email and an alias for outgoing stuff

    • mike_hearn · 9 hours ago

      It shouldn't affect you. DMARC policies apply to the authenticated domain, which is Gmail.

This has been going on for much longer than stated here - we had domain mismatch issues with outlook going back years and our policy was p=none. They’re very sensitive and mailing lists with forwarding are heavily impacted.

As they should. You should have done this 5 years ago. Takes like 10 minutes. Gmail has been rejecting them for years at this point.

• xmddmx · 9 hours ago

  "Google has been rejecting them for years..." Not true, at least in my experiences. I have a bunch of email accounts which have SPF and DKIM, but are missing the DMARC line - I've had no deliverability problems at all, until this weekend, and now only with Outlook. Emails to Gmail accounts go through just fine. The combination of: √ Valid SPF √ Valid DKIM signature X Missing DMARC policy Is clearly ambiguous. Since a DMARC of "p=none" (in the context of valid SPF and DKIM) really adds no information, so interpreting "missing DMARC" as "p=none" seems reasonable. Sounds like Microsoft was taking that approach until this weekend. I wonder if there's an actual written standard?

  • jared_stewart · 8 hours ago

    Under RFC 7489 [1], a domain with no DMARC record simply has no DMARC policy, the receiver is able to enforce whatever policy it likes. Most receivers have chosen to treat this as p=none for the last decade (Microsoft included). This is changing to now so that mail with no record is simply refused. Nothing in the standard prohibits this. a DMARC of p=none might be seen as ambiguous - SPF and DKIM have their own jobs and they work. However, the point of DMARC is not a new way of enforcing mail authentication. Instead it is a way of making certain that the mail is internally consistent and furthermore provides two additional things. 1. it indicates if the domain owner has thoroughly gotten their mail to authenticate (in which case they adopt a p=reject), and 2. it provides a feedback mechanism that allows the domain owner to know if they are seeing authentication and deliverability problems in such a way that they can fix those broken mail flows. [1] https://www.rfc-editor.org/info/rfc7489/

  • esikich · 7 hours ago

    Googling around this started at least a year ago, but I worked at an MSP 3 years ago when it was first announced and we started getting customers into compliance. This wasn't something out of the blue.

DMARC has been around for a while now. I know it’s fashionable to bash on Micro$oft and they rightfully deserve it. Just not for this.

I set up DMARC on my personal domain so long ago I can't even remember when I did it. 10 years+? I had kinda assumed that a lot of providers would start rejecting domains without DMARC support. I'm surprised it's happening this late.

• teekert · 9 hours ago

  This was my second hackernews submit [0]! So, not even https in 2014 :) When I ran that server, outlook.com was also the only one that would blackhole my email for no known reason. Support was unhelpful and also could not point to any reason. I've since given up, but for a short time it was glorious, email to family would not leave the lan and we could send attachments of arbitrary size. [0] https://news.ycombinator.com/item?id=7708882

• mike_hearn · 9 hours ago

  You adopted it the moment it was announced? Really? Is there a risk some people on this thread are mixing up DKIM and DMARC? DKIM = proving that an email was sent from a specific domain using cryptography. Good for spam fighting and deliverability. DMARC = telling receivers how to handle mail that fails authentication. DMARC is primarily useful for large, complex organizations where email admins may not be aware of everyone inside the org who is sending mail that advertises the domain in the From header, or organizations that might be targeted by impersonation attacks (e.g. phishing). Being able to tell recipients "yes we absolutely have our act together so feel free to reject or spamfolder unauthenticated email" is great for killing phishing campaigns, and being able to request reports is great for finding that one sales org that signed up for a guerrilla marketing SaaS that's impersonating them. But for small personal domains the value isn't that high.

  • bawolff · 4 hours ago

    > DMARC = telling receivers how to handle mail that fails authentication. No. DMARC is about if the from address has to match the address used in dkim/spf

    • gnabgib · 4 hours ago

      No DMARC is about telling receivers which of SPF/DKIM are valid, what to do with it when it fails, and where to send a report to. Oh look.. like Mike said.

      • bawolff · 3 hours ago

        To be clear, I am saying this is incorrect. DMARC is primarily about "alignment" (switching SPF from caring about the envelope sender to instead using the from header). Yes, it does also tangentially address those other points, but the primary reason it was adopted was to prevent spoofing of from headers (where in original spf that was a non-goal)

  • drdexebtjl · 4 hours ago

    > You adopted it the moment it was announced? Really? A specification exists since 2012, 14 years ago. 10 years ago it was already old.

  • klodolph · 2 hours ago

    I added DMARC and DKIM together, around the same time as some particular life events 10 years ago. Just now, I cross-checked the information against the commits in my Git repos. Back then, I didn’t use Terraform or anything like that, but I had text files with logs that described the DNS setup in detail so I could fix things. By grepping through the logs, I’m able to put a definitive bound on when I added DMARC—it was no later than June 2016, over 10 years ago. At the time I thought, “Obviously, we should all be setting this up, because recipients will start rejecting mail from insecure domains, if they don’t already.” This was also back when I self-hosted email. I eventually stopped doing that because I thought it was too time-consuming.

  • waste_monk · 13 minutes ago

    >DMARC is primarily useful for large, complex organizations >But for small personal domains the value isn't that high. I don't understand the resistance. It benefits the entire mail ecosystem, not just mass senders. SPF used to be niche thing, then everyone realised it's a good idea and it became more-or-less mandatory. Same with DKIM. Now it has happened to DMARC as well.

• pembrook · 5 hours ago

  Email is the largest social network on earth (8.3 Billion addresses) 10 years is nothing. I'm sure there's still millions of companies globally who still aren't properly signing mail with DMARC.

I have the opposite problem. I have a 3-letter email address, so for ease of giving out the email address, I use it, while having it forwarded to my Gmail. Somewhere around 2019, emails from legitimate services, especially password reset/OTP codes, stopped landing in my inbox or even junk because my address is so high up the chain of spammers. Nebula was the first to confirm this for me and work out of band to re-enable access to my account - their emails to me were bouncing. But ever since that happened, I’ve slowly moved back to giving my Gmail.

• NooneAtAll5 · 9 hours ago

  huh maybe someone was too lazy to set up "inbound block list" and just did a total blackout instead?

  • cowlevel · 31 minutes ago

    It sounds like Gmail is seeing 3000 emails a day coming from foo@bar.com, some of which are different kinds of spam, and reasonably concludes they are a spammer.

• xmddmx · 9 hours ago

  There's something called ARC https://en.wikipedia.org/wiki/Authenticated_Received_Chain which is supposed to handle forwarded emails, but no idea how it works in practice. Sounds like kind of a hack: "ARC was devised to solve this problem by giving intermediate servers a way to sign the original message's validation results. Even if the SPF and DKIM validation fail, the receiving service can choose to validate the ARC chain. If it indicates that the original message passed the SPF and DKIM checks, and the only modifications were made by intermediaries trusted by the receiving service, the receiving service may choose to accept the email."

• cowlevel · 32 minutes ago

  Sounds like Gmail is the one blocking it. Stop forwarding it to Gmail and set up email directly on the address.

Outlook.com is also rejecting mail based on blocklists that are not public and you essentialy cannot get yourself out. My VPS provider is pretty much entirely blocked and their regular blocklist process says we are golden so nothing to unblock. Outlook.com and similar are an anathema to email. This is why they tell you not to run a mail server . On the other hand rejecting domains without dmarc is fine. Just not happy it is silent.

• system2 · 9 hours ago

  Using self hosted email service is a big mistake in 2026.

  • SoftTalker · 9 hours ago

    Why are we so willingly ceding one of the few widely used free and open protocols to a handful of $mega-billion providers? Experience shows that the walls will get taller and the moats will get deeper.

    • cheschire · 9 hours ago

      Because the noise is so loud now that people are basically just coping with the stresses of work life by taking the easy path in the home life.

    • idiotsecant · 8 hours ago

      Because the protocol is flawed at its foundation - there is no good way to make sure that the person sending you something is a person and sending content you'd want to interact with. If the big providers weren't doing this stuff, we'd whine about the enormous amount of spam. The solution is allow only communications that are demonstrably not spam and not unwanted. There have been lots of proposals to this effect but maybe you have to put up two cents in a crypto wallet, which the other person can claim if the mail is unwanted. If someone takes your two cents, you remove them from your lists ASAP. The receiver doesn't benefit meaningfully from the 2c so they are unlikely to claim it. The sender is only damaged if a lot of different people claim the 2 cents. Maybe a few domains are default whitelisted even if they don't put up 2 cents, to protect against entities that are important but would be frequently spite-claimed (IRS, courts, and other similar). If you use a provider that doesn't whitelist, fine, but you're going to miss those emails. Maybe the top 'spite claim' users are published and it becomes difficult to get people to agree to put up money to talk to you. This reduces spam to the level of junk mail, which is still not totally trivial but is orders of magnitude more manageable.

      • croes · 8 hours ago

        Nearly all the spam I get has an email address from those providers. Seems they are the disease not the cure

        • anonreplier · 7 hours ago

          Mine isn't from those email hosts, but it from google cloud or Azure typically (not AWS for whatever reason). Related, the gmail spam filter is terrible.

          • Frotag · 5 hours ago

            >Related, the gmail spam filter is terrible. It seems insane that gmail doesnt provide a way to automatically send a mail (eg based on domain, keywords, etc) to spam. I know theres block sender but for example aliexpress uses a different name for every email so that's useless.

          • SoftTalker · 2 hours ago

            Most of my spam is from gmail addresses. Why Google hasn't figured out how to stop the fake Norton renewal notices is just mind-boggling. Lately I've also been getting a lot from compromised MS365 accounts.

        • pixl97 · 7 hours ago

          I think you misunderstand the disease. What this is called is survivorship bias. The question I would ask is how much mail are you not seeing at all because it's dropped at the edge first thing because it's IP block listed? Next, how much spam are you seeing from them because they and Google are the largest providers on Earth? Kind of like selecting a random person from the population in the US and going "look, it's a white guy". Yea, that's how statistics works. Lastly, because the are good at blocking spam at the edge, then that's the last bastion of attack for spammers to put their efforts in if they want any return at all.

          • unpleasurable · 1 hour ago

            Sorry but bastions are defensive.

          • cowlevel · 53 minutes ago

            I self-host and don't have a spam filter. Spam makes up about 1 in 5 messages I receive. It's always the same spam campaigns that would be easily filtered with a few regexes. Self-hosting allows me to use a different receiving address for each entity I contact, so I know exactly who put me on spam lists and if it gets bad I can route that address to the garbage bin.

      • what · 7 hours ago

        > frequently spite-claimed (IRS, courts, and other similar) These entities communicate via plain old mail, that costs more than 2 cents already.

      • timcobb · 3 hours ago

        Spam is a super solved problem though and I'd rather have false negative spam than email oligarchy.

      • cowlevel · 56 minutes ago

        > the protocol is flawed at its foundation - there is no good way to make sure that the person sending you something is a person and sending content you'd want to interact with. There is and it's the same as other protocols including proprietary ones - a sender address whitelist. There's no proprietary protocol that solved spam either.

    • lakeviewterrace · 3 hours ago

      A web forum's users, who love nothing more than using the "flag" button to stomp out comments they don't like, are indignant upon discovering the world's third largest email provider has a "flag" button of their own.

      • cowlevel · 52 minutes ago

        Third? What's second, Yahoo? I know Gmail is first.

  • nbernard · 9 hours ago

    Alt take: Using a Microsoft-hosted email service is a big mistake in 2026...

    • bigstrat2003 · 8 hours ago

      That may be so, but you can't control what mail service your recipients use. So whether or not it's a bad idea, it can be your problem. That said I don't agree with OP that self-hosting mail is a bad idea.

      • nekusar · 7 hours ago

        Yes you can. User signs up, uses @outlook. Your app declines it and explains that they block with no way to remedy, and explain they are a bad vendor.

        • Scharkenberg · 6 hours ago

          Deeply unserious take.

          • nekusar · 5 hours ago

            As unserious as you claim, we had this exact problem. Emails would be accepted by Outlook.com, but would never deliver. We had SPF/DKIM/DMARC and full reporting. They RBL'ed us with no remedy. We told the customer to not use outlook.com BECAUSE we told them we could not guarantee any delivery of messages.

          • cowlevel · 50 minutes ago

            Seems to work for many websites. But only if your users aren't giving you money, because it's 50/50 whether they'll use a different email address or give up entirely.

        • ethin · 2 hours ago

          Lol if you do that, your service is just going to have a small minority of people and most people will just not bother using your app/service entirely

          • cowlevel · 48 minutes ago

            Most people aren't using Outlook. If your users mostly are, then this solution doesn't work for you. But it does work for many people.

  • graemep · 9 hours ago

    Why? At the most you need to use an external service for delivery (usually because you have problems with MS) but you can still run your own server with no difficulties once you do that. That said, DMARC is required by a lot of people now, so I do not think this particular issue is a problem. I have been self hosting my my personal email (and for family). Few problems so far other than delivery to MS and I have recently moved a domain I use for work email over. Oddly enough the MS problems come from hotmail, but not other services. If that is a problem, then pay a bit to have email delivered.

    • BadBadJellyBean · 8 hours ago

      It's not enough. I have a domain that I had a very long time but it is on an undesirable tld. I got it long before it was problematic. Outlook always puts my mail in the SPAM folder even though I have done everything I could. I even deliver through a trusted provider. Not on any spam list. DMARC, DKIM, SPF all set up. No dice.

    • singpolyma3 · 8 hours ago

      I've never had a problem not having dmarc. DMARC doesn't really mean anything. The security comes from DKIM (or SPF, but that's garbage)

  • glum64 · 8 hours ago

    Proudly self-hosting since 2001. My mail server is in my basement. Do not know what you are talking about.

    • mgkimsal · 8 hours ago

      How often would you be able to detect acceptance-but-non-delivery of your emails to office.com-hosted emails?

      • geek_at · 8 hours ago

        Always? If emails are not answered you'll usually notice unless you're a Spammer

        • anonreplier · 7 hours ago

          MS live/hotmail/outlook would silently drop - although not for this DMARC, that gets a straight bounce.

        • aboardRat4 · 1 hour ago

          >Always? If emails are not answered you'll usually notice unless you're a Spammer Means you're not using your email seriously. For example, to send CVs in response to job postings. I send up to 20 email per day to people who have issues with their package build scripts, and I have no idea whether they ignore me because they stopped using the distro or because mail got dropped.

      • TuringNYC · 3 hours ago

        > How often would you be able to detect acceptance-but-non-delivery of your emails to office.com-hosted emails? You should be able to see this on your DMARC dashboard

  • ulrikrasmussen · 7 hours ago

    Sounds more like using outlook.com is a mistake. I've been running my own mail server for over 20 years and outlook.com is literally the only domain I have had problems with, and this is the only reason that I now send via Scaleway's free transactional email service. The people working on outlook.com are just talentless amateurs - the rest knows how to do it right. It's a shame it's so widely used.

    • stdatomic · 7 hours ago

      I don't disagree, but what are your options when a giant portion of the population uses O365 and outlook.com? How are you going to get them to stop using it, so that legit emails from user-owned servers are not silently rejected? Most of them wouldn't even care probably...

      • ulrikrasmussen · 7 hours ago

        I use a sending service. I would prefer not having to, but at least all inbound email goes directly to my server.

        • raegis · 2 hours ago

          I've also been running my own server for over 20 years, but do note that the big players may block their senders from delivering mail to your server. This happened to me with GMail around 6-7 years ago, until I configured DMARC and/or DKIM and/or SPF to their liking. As far as I know, they don't do a press release when they update their rules.

          • capitainenemo · 1 hour ago

            I have a perfect score in google postmaster tools on dkim, spf and 0 spam reports. They still send all emails to spam. They will even do this if you are replying to the user who contacted you. Same experience for my friend running an indie festival. These days you pretty much have to alert gmail users by some other means (like if signing up on a website) that they have to check spam and whitelist you since it appears gmail would rather block legit emails than allow a single possible spam through.

      • cowlevel · 51 minutes ago

        It depends on the nature of the transaction. If the user needs the email more than you do, you just remind them Outlook deletes your messages, and they'll find a way, and in the long term usage of Outlook will decrease.

    • aboardRat4 · 1 hour ago

      >I've been running my own mail server for over 20 years and outlook.com is literally the only domain I have had problems with What about tencent.com, foxmail.com, or qq.com?

  • riedel · 7 hours ago

    This is what google and microsoft want the make you think for obvious reasons. Fortunate for those running their own servers is that they actually still get all the cool emails from people not complying.

  • drnick1 · 7 hours ago

    You can take my email server from my cold, dead hands.

• Ungh · 9 hours ago

  outlook.com and O365 are horrible to deliver to. We regularly get issues where we sent an email it was accepted by O365 but was never delivered to the mailbox. We have one person working at least half the time on resolving stuff like that. And that's from a respectably maintained SES egress with good reputation, DMARC, DKIM configured.

  • drdaeman · 6 hours ago

    There is a trick. Sign up with them, configure custom domain, but don’t set your MX records. On your MTA, route mail that goes to Outlook/Hotmail to go through their MSA with your Outlook credentials and headers stripped as if submitted directly by user. Outlook gets mail through their own MSA it trusts, rest of the world talks to your mail system directly. Replies still go to your MXes. I haven’t productionized this setup (I send maybe a dozen emails a year) but it worked for me ad hoc a couple years back, when I had to send a mail to an Outlook-hosted address and they blackholed everything I tried to send while 250 OKing me.

    • unixhero · 13 minutes ago

      Great idea

    • litoE · 5 minutes ago

      The problem with this setup is that if I want to send email to fred@example.com and example.com is actually handled by Outlook, I need to somehow know beforehand that email to example.com needs that special routing. Or do you just route ALL your outbound email through Outlooks MSA?

  • lakeviewterrace · 6 hours ago

    Funny, they have no problem handling mail for essentially every Fortune 500 company and others large and small. It's always people self-hosting mail on a shared server in Moldova (because they think it makes them cool) that are complaining.

    • pacija · 6 hours ago

      Nope, people self-hosting mail on their own hardware from their own basement in Serbia ;) https://www.mimar.rs/blog/a-journey-of-my-mx-server-to-new-r... And yes, it's cool not to have to let scum read your private communications :D

    • pembrook · 5 hours ago

      Self hosting mail on a shared server in Moldova is basically the entire idea behind email (and the internet). Which with cheap models like Jev as spam classifiers, this can now become a reality. The problem is, Google and Microsoft have monopolized the entire email market, so their esoteric deliverability mysticism from 2007 still persists (basically blanket bans on entire IP spaces, locking out anybody trying to send emails on their own).

      • lakeviewterrace · 5 hours ago

        People used to have party lines and leave their doors unlocked too, but it turns out the world is filled with bad actors and other assorted shitty people. Email naturally followed this evolution.

        • qup · 3 hours ago

          Some of us still leave our doors unlocked, too. I've never even had the key to mine. I've lived here over a decade.

        • dualvariable · 2 hours ago

          So naturally everyone should just leave e-mail to be run by all the corporations. You shouldn't own your car or your house, give them to all the corporations as well.

          • lakeviewterrace · 1 hour ago

            Nothing is stopping you and your three friends from running your own SMTP servers and emailing each other. As soon as you want to do business with Outlook's customers, you play by their rules.

            • sirtaj · 53 minutes ago

              This is one thing I find more on Hacker News than most other discussion sites. Any topic about annoying or bad behaviour by corporations eventually devolves to "they're allowed to do it". "They're allowed to do it" is one of those things that doesn't really bear saying so much because that's already been implicitly established. Nobody is claiming what they're doing is illegal, so how does this add anything of value? Who is still unaware that corporations will use their size and market control to their benefit?

      • ShinyLeftPad · 1 hour ago

        > Which with cheap models like Jev as spam classifiers, this can now become a reality. With LLMs on the other side trying to make spam less detectable by cheap models like Jev? It's funny when people assume benefits from some tech go one way and baddies will surely never use it...

    • jaza · 1 hour ago

      Maybe because every Fortune 500 company (and 99% of all large companies / orgs worldwide) uses O365 / Exchange / GSuite?

  • cowlevel · 57 minutes ago

    What's the nature of your operation? If they're not giving you money then you're within your rights to say "sorry, don't use outlook"

• gatlin · 9 hours ago

  I was viciously mean in my communication with the Outlook team when they said they “couldn’t” remove me from the blocklist. I pointed out that, as the operator of a perfectly compliant secure server their inability to deliver my mail is a technical failure on their end and one which I will be contacting their supervisor about and they somehow managed to scrabble together the heroic ability to delete my row from a table. Never back down from these bastards.

• functionmouse · 8 hours ago

  > Outlook.com and similar are an anathema to email. This is why they tell you not to run a mail server . It turns out that whoever has the most power is the most powerful. This is why distributed/decentralized systems cannot singlehandedly free us from tyranny, and why I find people who spend all their time preaching decentralized systems to be quite silly. We don't need better systems (well maybe we do but,,,), we need better education and awareness of how billionaires manipulate us; this goes beyond software.

  • nashashmi · 6 hours ago

    Decentralization is not a bulletproof solution. It is a mitigation. Until someone gets 50 percent of market share. Then they can run havoc on the ecosystem with their own customized system.

  • BobaFloutist · 6 hours ago

    Complain all you want about the monopolists, and I do think you're right to do so, but a lot of their power comes from and is aimed at defeating the overwhelming flood of spam. Mail, then emails, then home phones, then cell phones, then texts, then social media have been gradually rendered less and less usable by bad actors systematically abusing every single tool we try to use to communicate with one another to steal from us, lie to us, and manipulate our beliefs, and we'll just keep inventing and discarding new ways of communicating until we reckon with this.

    • pembrook · 5 hours ago

      With cheaper AI classification models coming out every day now, the spam problem is on the cusp of basically being solved in every communication channel. The only question is how many years the lazy network-effects monopolies (like Google, Microsoft, Verizon, etc) will hold this back from happening. The optimist in me says this will unlock pathways to true decentralization of push communication protocols (like SMTP) instead of only have decentralization of pull-oriented protocols (like HTTP).

      • Arainach · 5 hours ago

        On the contrary, with cheaper AI generation the spam problem becomes harder by the day.

        • Natfan · 3 hours ago

          classification != generation

          • Arainach · 2 hours ago

            Generation is, and always will be, cheaper and easier to do well than classification. AI becoming faster empowers attackers far more than it empowers defenders. We're seeing this in every discipline and every corner of the software industry.

      • djray · 2 hours ago

        "Two years from now, spam will be solved." - Bill Gates at the World Economic Forum, in 2004

  • myaccountonhn · 4 hours ago

    I don't think anyone believes it will "singlehandedly free us from tyranny", it's one component for a healthy ecosystem.

  • dualvariable · 2 hours ago

    We could tax billionaires and use the money for a Manhattan Project to stamp out fraud, abuse, and corruption. But we won't.

  • aboardRat4 · 1 hour ago

    >we need better education and awareness of how billionaires manipulate us So that people would vote for the government to manipulate them instead? Honestly, I hate outlook as much as you do, but I'd still prefer it to Max https://en.wikipedia.org/wiki/Max_(app)

• generalizations · 7 hours ago

  Just put codex in a continuous goal loop to keep you off the blacklists...give it whatever email / creds it needs to make the appropriate requests and make the needed changes (ofc tell it the guardrails it should follow). Selfhosted email is likely easier now than it ever was before.

• lakeviewterrace · 6 hours ago

  Maybe don't self-host mail on a shitty $1/month VPS where 99% of the tenants are spammer scum? This is not Microsoft's fault. The building's on fire and they're locking out the arsonists.

  • Arainach · 6 hours ago

    Requiring DMARC may be good, but Outlook's approach is awful. I was working for Microsoft when outlook.com launched and got a good email address that was my primary for more than a decade. I had so many issues with things getting silently dropped with no recourse (2FA codes, account recovery mails, etc.) on so many sites that I finally gave up, reversed the stream, and had Outlook forward to GMail instead of vice versa. A few months after that, I realized that all my Outlook got was an enormous volume (hundreds of day) a spam and that all legitimate mail was going to my other accounts, so I turned it off entirely and haven't read that mailbox in over a year.

    • lakeviewterrace · 5 hours ago

      > I had so many issues with things getting silently dropped with no recourse (2FA codes, account recovery mails, etc.) on so many sites This is not unique to Microsoft and really the source's problem — they did something to get blocked in the first place. Add in the fact that you're almost certainly not the only one impacted, and that they have no interest in fixing it, it screams incompetence on the source's part. Been there, done that, good luck explaining the problem to the app's first-level support in the Philippines because it's not in their script. > and had Outlook forward to GMail Till the day GMail hits you with the "We couldn't verify it's you" bullshit and locks you out of your account forever. Good luck getting support from Google, the word is not in their lexicon.

      • Arainach · 5 hours ago

        > This is not unique to Microsoft and really the source's problem — they did something to get blocked in the first place. I've never encountered this issue with GMail. Delivery just works. I'm trying to think of the last false-positive spam flag I've had with GMail, and I've definitely never had mail be entirely dropped.