Outlook.com is also rejecting mail based on blocklists that are not public and you essentialy cannot get yourself out. My VPS provider is pretty much entirely blocked and their regular blocklist process says we are golden so nothing to unblock.<p>Outlook.com and similar are an anathema to email. This is why they tell you not to run a mail server .<p>On the other hand rejecting domains without dmarc is fine. Just not happy it is silent.
Everybody I know who still runs their email server (you can get Europeans out of Europe, but you can't get Europe out of the Europeans) complains about Microsoft.<p>I bet Microsoft is single-handedly responsible for 80+% of complaints about email being impossible to host.<p>In a federated / pseudo-decentralized network, any provider with 10+% of captive users has an outsized leverage on the entire ecosystem. You don't need a monopoly; as long as you have a monopoly on just a few users that others absolutely need to be able to interact with, you can dictate terms to everybody.
> I bet Microsoft is single-handedly responsible for 80+% of complaints about email being impossible to host.<p>They are the reason I dropped self-hosting my mails. They were silently dropping some of my mails depending on the day I sent them. If they were at least sent to the spam folder, it would be easier to communicate with their users. And since a lot of their users are not technical at all, it's complicated to explain them the issue.
Not just email - their identity / SSO system is just as fucked
Same experience here. We have multiple customers whose servers are in large blocked IP ranges, with seemingly no way to get them delisted. The strange thing is that Microsoft only seems to reject their emails on Hotmail/Outlook.com accounts (free accounts), while accepting them just fine on business accounts. Meanwhile, their “support” tools tell you there’s nothing wrong.<p>Based on my broad experience, I’d comfortably rank Microsoft as the worst of the major email providers. (I am owner poste.io)
I work at a big company that sends alot of emails. And even we have been put in the "bad bad books of o365 bad list", it's an absolute pain to get yourself out of the office 365 defender (I think it's what they call it now?) meanwhile your customers are complaining they arent receiving emails from you.
Email delivery for enterprise accounts has always been more lenient, the assumption being that enterprises do have their own mail filtering software.
outlook.com and O365 are horrible to deliver to. We regularly get issues where we sent an email it was accepted by O365 but was never delivered to the mailbox. We have one person working at least half the time on resolving stuff like that. And that's from a respectably maintained SES egress with good reputation, DMARC, DKIM configured.
There is a trick. Sign up with them, configure custom domain, but don’t set your MX records. On your MTA, route mail that goes to Outlook/Hotmail to go through their MSA with your Outlook credentials and headers stripped as if submitted directly by user. Outlook gets mail through their own MSA it trusts, rest of the world talks to your mail system directly. Replies still go to your MXes.<p>I haven’t productionized this setup (I send maybe a dozen emails a year) but it worked for me ad hoc a couple years back, when I had to send a mail to an Outlook-hosted address and they blackholed everything I tried to send while 250 OKing me.
I have a small client with a large email list who wants to switch from once a month constant contact newsletters to sending them through SES with a self-hosted Sendy instance. This seemed like a reasonable way to save $10k a year or so. I haven't used SES before for anything. I have run an email server for 30 years and had occasional blacklist headaches, but it's not used for mass mailing of that sort... it's usually several years between problems. Is this a terrible idea to switch, even if it's off a "managed" SES dedicated IP? I don't want to switch them and find out no one on Outlook is getting their mail.
What's the nature of your operation? If they're not giving you money then you're within your rights to say "sorry, don't use outlook"
Our customers are giving us lots of money. And the nature of the emails are account reminders, activation and internal message notifications.
Usually they are giving you money...<p>I ran a SaaS up until recently. Emailing users notifications for events was just a normal part of the app. Users got upset when the emails didn't come through. So then I had to be email tech support for something I had no control over. Lovely.
Funny, they have no problem handling mail for essentially every Fortune 500 company and others large and small.<p>It's always people self-hosting mail on a shared server in Moldova (because they think it makes them cool) that are complaining.
Self hosting mail on a shared server in Moldova is basically the entire idea behind email (and the internet).<p>Which with cheap models like Jev as spam classifiers, this can now become a reality.<p>The problem is, Google and Microsoft have monopolized the entire email market, so their esoteric deliverability mysticism from 2007 still persists (basically blanket bans on entire IP spaces, locking out anybody trying to send emails on their own).
People used to have party lines and leave their doors unlocked too, but it turns out the world is filled with bad actors and other assorted shitty people.<p>Email naturally followed this evolution.
So naturally everyone should just leave e-mail to be run by all the corporations.<p>You shouldn't own your car or your house, give them to all the corporations as well.
Some of us still leave our doors unlocked, too.<p>I've never even had the key to mine. I've lived here over a decade.
> Which with cheap models like Jev as spam classifiers, this can now become a reality.<p>With LLMs on the other side trying to make spam less detectable by cheap models like Jev?<p>It's funny when people assume benefits from some tech go one way and baddies will surely never use it...
Err we are part of a Fortune 500 and we can't even deliver to ourselves sometimes.
Nope, people self-hosting mail on their own hardware from their own basement in Serbia ;)<p><a href="https://www.mimar.rs/blog/a-journey-of-my-mx-server-to-new-residential-ipv4-address" rel="nofollow">https://www.mimar.rs/blog/a-journey-of-my-mx-server-to-new-r...</a><p>And yes, it's cool not to have to let scum read your private communications :D
Maybe because every Fortune 500 company (and 99% of all large companies / orgs worldwide) uses O365 / Exchange / GSuite?
I've had several times where mail from custom domains associated with a business were delivered hours late by Outlook. Time sensitive emails. A guy coming to my office for a meeting called me and said he was downstairs and having an issue with security. Went down and swiped him in.<p>Four hours later, I got the same message by email. I thought he was back - nope. An email sent at 10am that was delivered at 4pm showed it was from 2pm until I looked at the header and saw sent at 10am and just... chilling out for 4 hours. DMARC was set up for them just fine.<p>I've had the same issue with my own custom domain, with DMARC set up. A year later, it finally got bumped up to some sort of "trusted" domain for that one place and my emails get delivered the same day now.
Is it SNDS (<a href="https://substrate.office.com/ip-domain-management-snds/snds" rel="nofollow">https://substrate.office.com/ip-domain-management-snds/snds</a>) you refer to as their regular blocklist process?
yeah I see it for them being a problem too if they are not accepting legitimate email. I might be a bit stubborn here but I refuse to give them the monopoly and self host our email anyway. I just wish more people would join this fight
Which VPS provider out of curiosity?
Pretty sure this or part of this just burned me. Icing on the cake is Nintendo will also ban hammer your email if it rejects some or all of their emails - including their dumptruck of marketing junk. The only and I mean only resolution to this is to basically move your Nintendo account to a different email completely. Absolutely unreal on both sides.<p>Yes, no one should not have DKIM or DMARC but holy yikes when neither side wants to actually give in to help the customer.
I was viciously mean in my communication with the Outlook team when they said they “couldn’t” remove me from the blocklist. I pointed out that, as the operator of a perfectly compliant secure server their inability to deliver my mail is a technical failure on their end and one which I will be contacting their supervisor about and they somehow managed to scrabble together the heroic ability to delete my row from a table. Never back down from these bastards.
Maybe don't self-host mail on a shitty $1/month VPS where 99% of the tenants are spammer scum?<p>This is not Microsoft's fault. The building's on fire and they're locking out the arsonists.
Requiring DMARC may be good, but Outlook's approach is awful.<p>I was working for Microsoft when outlook.com launched and got a good email address that was my primary for more than a decade.<p>I had so many issues with things getting silently dropped with no recourse (2FA codes, account recovery mails, etc.) on so many sites that I finally gave up, reversed the stream, and had Outlook forward to GMail instead of vice versa. A few months after that, I realized that all my Outlook got was an enormous volume (hundreds of day) a spam and that all legitimate mail was going to my other accounts, so I turned it off entirely and haven't read that mailbox in over a year.
> I had so many issues with things getting silently dropped with no recourse (2FA codes, account recovery mails, etc.) on so many sites<p>This is not unique to Microsoft and really the source's problem — they did something to get blocked in the first place.<p>Add in the fact that you're almost certainly not the only one impacted, and that they have no interest in fixing it, it screams incompetence on the source's part.<p>Been there, done that, good luck explaining the problem to the app's first-level support in the Philippines because it's not in their script.<p>> and had Outlook forward to GMail<p>Till the day GMail hits you with the "We couldn't verify it's you" bullshit and locks you out of your account forever. Good luck getting support from Google, the word is not in their lexicon.
> This is not unique to Microsoft and really the source's problem — they did something to get blocked in the first place.<p>I've never encountered this issue with GMail. Delivery just works. I'm trying to think of the last false-positive spam flag I've had with GMail, and I've definitely never had mail be entirely dropped.
Some hosting providers are known for not caring about the activities of their customers, but in general, how would I know that the other tenants are scum?<p>I have access to a fairly large dataset of known bad hosting providers, but most people don't. So how do you tell the difference between getting a good deal and "this is cheap because it's sketchy as all hell".<p>We also don't block all of Vietnam, or all Jio customers in India, even if we know that 20% of bot traffic is from those two alone.
> Outlook.com and similar are an anathema to email. This is why they tell you not to run a mail server .<p>It turns out that whoever has the most power is the most powerful. This is why distributed/decentralized systems cannot singlehandedly free us from tyranny, and why I find people who spend all their time preaching decentralized systems to be quite silly. We don't need better systems (well maybe we do but,,,), we need better education and awareness of how billionaires manipulate us; this goes beyond software.
Complain all you want about the monopolists, and I <i>do</i> think you're right to do so, but a lot of their power comes from and is aimed at defeating the overwhelming flood of spam.<p>Mail, then emails, then home phones, then cell phones, then texts, then social media have been gradually rendered less and less usable by bad actors systematically abusing every single tool we try to use to communicate with one another to steal from us, lie to us, and manipulate our beliefs, and we'll just keep inventing and discarding new ways of communicating until we reckon with this.
With cheaper AI classification models coming out every day now, the spam problem is on the cusp of basically being solved in every communication channel.<p>The only question is how many years the lazy network-effects monopolies (like Google, Microsoft, Verizon, etc) will hold this back from happening.<p>The optimist in me says this will unlock pathways to true decentralization of push communication protocols (like SMTP) instead of only have decentralization of pull-oriented protocols (like HTTP).
On the contrary, with cheaper AI generation the spam problem becomes harder by the day.
The power of defenders is greater than attackers here, because the defenders have more knowledge about what is "normal" for you the user.
classification != generation
Generation is, and always will be, cheaper and easier to do well than classification.<p>AI becoming faster empowers attackers far more than it empowers defenders. We're seeing this in every discipline and every corner of the software industry.
"Two years from now, spam will be solved."
- Bill Gates at the World Economic Forum, in 2004
I don't think anyone believes it will "singlehandedly free us from tyranny", it's one component for a healthy ecosystem.
Decentralization is not a bulletproof solution. It is a mitigation. Until someone gets 50 percent of market share. Then they can run havoc on the ecosystem with their own customized system.
We could tax billionaires and use the money for a Manhattan Project to stamp out fraud, abuse, and corruption.<p>But we won't.
>we need better education and awareness of how billionaires manipulate us<p>So that people would vote for the government to manipulate them instead?<p>Honestly, I hate outlook as much as you do, but I'd still prefer it to Max<p><a href="https://en.wikipedia.org/wiki/Max_(app)" rel="nofollow">https://en.wikipedia.org/wiki/Max_(app)</a>
[flagged]
Just put codex in a continuous goal loop to keep you off the blacklists...give it whatever email / creds it needs to make the appropriate requests and make the needed changes (ofc tell it the guardrails it should follow).<p>Selfhosted email is likely easier now than it ever was before.
Using self hosted email service is a big mistake in 2026.
Why are we so willingly ceding one of the few widely used free and open protocols to a handful of $mega-billion providers?<p>Experience shows that the walls will get taller and the moats will get deeper.
The irony is that if more people started to self host again, especially jogger companies, the problem like one exemplified by this post would be solved quickly.
Because the noise is so loud now that people are basically just coping with the stresses of work life by taking the easy path in the home life.
why do we cling on to the email protocol at all?<p>We have dozens of different ways to send E2EE messages to each other, with realtime publish-subscribe, and yet billions of dollars are spent trying to duct tape email. Who cares if Outlook/Gmail/Icloud use IMAP or Websocket? If the interface looks the same to the end user will they really care?
Because the protocol is flawed at its foundation - there is no good way to make sure that the person sending you something is a person and sending content you'd want to interact with. If the big providers weren't doing this stuff, we'd whine about the enormous amount of spam.<p>The solution is allow only communications that are demonstrably not spam and not unwanted.<p>There have been lots of proposals to this effect but maybe you have to put up two cents in a crypto wallet, which the other person can claim if the mail is unwanted. If someone takes your two cents, you remove them from your lists ASAP. The receiver doesn't benefit meaningfully from the 2c so they are unlikely to claim it. The sender is only damaged if a <i>lot</i> of different people claim the 2 cents. Maybe a few domains are default whitelisted even if they don't put up 2 cents, to protect against entities that are important but would be frequently spite-claimed (IRS, courts, and other similar). If you use a provider that doesn't whitelist, fine, but you're going to miss those emails.<p>Maybe the top 'spite claim' users are published and it becomes difficult to get people to agree to put up money to talk to you.<p>This reduces spam to the level of junk mail, which is still not totally trivial but is orders of magnitude more manageable.
> the protocol is flawed at its foundation - there is no good way to make sure that the person sending you something is a person and sending content you'd want to interact with.<p>There is and it's the same as other protocols including proprietary ones - a sender address whitelist.<p>There's no proprietary protocol that solved spam either.
Nearly all the spam I get has an email address from those providers.<p>Seems they are the disease not the cure
Mine isn't from those email hosts, but it from google cloud or Azure typically (not AWS for whatever reason). Related, the gmail spam filter is terrible.
Most of my spam is from gmail addresses. Why Google hasn't figured out how to stop the fake Norton renewal notices is just mind-boggling.<p>Lately I've also been getting a lot from compromised MS365 accounts.
>Related, the gmail spam filter is terrible.<p>It seems insane that gmail doesnt provide a way to automatically send a mail (eg based on domain, keywords, etc) to spam. I know theres block sender but for example aliexpress uses a different name for every email so that's useless.
I think you misunderstand the disease.<p>What this is called is survivorship bias. The question I would ask is how much mail are you not seeing at all because it's dropped at the edge first thing because it's IP block listed?<p>Next, how much spam are you seeing from them because they and Google are the largest providers on Earth? Kind of like selecting a random person from the population in the US and going "look, it's a white guy". Yea, that's how statistics works.<p>Lastly, because the are good at blocking spam at the edge, then that's the last bastion of attack for spammers to put their efforts in if they want any return at all.
I self-host and don't have a spam filter. Spam makes up about 1 in 5 messages I receive. It's always the same spam campaigns that would be easily filtered with a few regexes.<p>Self-hosting allows me to use a different receiving address for each entity I contact, so I know exactly who put me on spam lists and if it gets bad I can route that address to the garbage bin.
Sorry but bastions are defensive.
Spam is a super solved problem though and I'd rather have false negative spam than email oligarchy.
> frequently spite-claimed (IRS, courts, and other similar)<p>These entities communicate via plain old mail, that costs more than 2 cents already.
A web forum's users, who love nothing more than using the "flag" button to stomp out comments they don't like, are indignant upon discovering the world's third largest email provider has a "flag" button of their own.
Sounds more like using outlook.com is a mistake. I've been running my own mail server for over 20 years and outlook.com is literally the only domain I have had problems with, and this is the only reason that I now send via Scaleway's free transactional email service.<p>The people working on outlook.com are just talentless amateurs - the rest knows how to do it right. It's a shame it's so widely used.
>I've been running my own mail server for over 20 years and outlook.com is literally the only domain I have had problems with<p>What about tencent.com, foxmail.com, or qq.com?
I don't disagree, but what are your options when a giant portion of the population uses O365 and outlook.com? How are you going to get them to stop using it, so that legit emails from user-owned servers are not silently rejected?<p>Most of them wouldn't even care probably...
It depends on the nature of the transaction. If the user needs the email more than you do, you just remind them Outlook deletes your messages, and they'll find a way, and in the long term usage of Outlook will decrease.
I use a sending service. I would prefer not having to, but at least all inbound email goes directly to my server.
I've also been running my own server for over 20 years, but do note that the big players may block their senders from delivering mail to your server. This happened to me with GMail around 6-7 years ago, until I configured DMARC and/or DKIM and/or SPF to their liking. As far as I know, they don't do a press release when they update their rules.
I have a perfect score in google postmaster tools on dkim, spf and 0 spam reports. They still send all emails to spam. They will even do this if you are <i>replying</i> to the user who contacted you. Same experience for my friend running an indie festival. These days you pretty much have to alert gmail users by some other means (like if signing up on a website) that they have to check spam and whitelist you since it appears gmail would rather block legit emails than allow a single possible spam through.
Alt take: Using a Microsoft-hosted email service is a big mistake in 2026...
That may be so, but you can't control what mail service your recipients use. So whether or not it's a bad idea, it can be your problem. That said I don't agree with OP that self-hosting mail is a bad idea.
You can take my email server from my cold, dead hands.
Proudly self-hosting since 2001. My mail server is in my basement. Do not know what you are talking about.
How often would you be able to detect acceptance-but-non-delivery of your emails to office.com-hosted emails?
Always? If emails are not answered you'll usually notice unless you're a Spammer
>Always? If emails are not answered you'll usually notice unless you're a Spammer<p>Means you're not using your email seriously. For example, to send CVs in response to job postings.<p>I send up to 20 email per day to people who have issues with their package build scripts, and I have no idea whether they ignore me because they stopped using the distro or because mail got dropped.
MS live/hotmail/outlook would silently drop - although not for this DMARC, that gets a straight bounce.
> How often would you be able to detect acceptance-but-non-delivery of your emails to office.com-hosted emails?<p>You should be able to see this on your DMARC dashboard
Now watch the goal post moving at light speed. This site is by business for business. They can't stand self hosting. Saas or bust. No matter how much time you spend demonstrating the opposite the next time someone mentions email they'll get a backlash. It's mind boggling how it plays out the same every single time. But give them a saas that returns the next integer for $19.99/month and that "creator" will be praised for their hard work. :)
This is what google and microsoft want the make you think for obvious reasons.<p>Fortunate for those running their own servers is that they actually still get all the cool emails from people not complying.
Why?<p>At the most you need to use an external service for delivery (usually because you have problems with MS) but you can still run your own server with no difficulties once you do that.<p>That said, DMARC is required by a lot of people now, so I do not think this particular issue is a problem.<p>I have been self hosting my my personal email (and for family). Few problems so far other than delivery to MS and I have recently moved a domain I use for work email over.<p>Oddly enough the MS problems come from hotmail, but not other services. If that is a problem, then pay a bit to have email delivered.
It's not enough. I have a domain that I had a very long time but it is on an undesirable tld. I got it long before it was problematic. Outlook always puts my mail in the SPAM folder even though I have done everything I could. I even deliver through a trusted provider. Not on any spam list. DMARC, DKIM, SPF all set up. No dice.
I've never had a problem not having dmarc. DMARC doesn't really mean anything. The security comes from DKIM (or SPF, but that's garbage)
[flagged]
Outlook.com has quietly dropped[0] emails from certain domains/IPs for years, even with SPF/DKIM/DMARC all properly set up and no history of spam. As someone who's administering their own mail server, Outlook has been the bane of my existence.<p>[0]: As in: They accepted the email just fine (according to the logs) but it still didn't end up in the recipient's mailbox.
Sounds like something every mail sender should have done already.<p>Good for Microsoft customers and I don't care one bit for the lazy people who have to late-patch now.
I kind of have to agree. DMARC is not new. It's useful and helps make email safer. It's not even hard to set up. There's just no reason for any legitimate mail provider not to use it. Same for people who are technical enough to run their own mail servers.
"Lazy people"? I only heard about this because a customer complained. Am I supposed to go around the Internet, checking what each mail server will allow or deny?
No. You're supposed to understand how mail works on the Internet, and configure it correctly so that everyone else accepts it.<p>Go to <a href="https://mail-tester.com" rel="nofollow">https://mail-tester.com</a>. Send a test email. If you don't get 10/10, fix your shit.
This seems overly dismissive especially for individuals who send emails from custom domains at low volumes. DMARC has previously been seen to only be really needed for high-volume senders. The mail testing service linked still gives 10/10 for emails received without DMARC (but with SPF and DKIK). My email is setup via Fastmail and I followed all the recommendations they provided (which didn’t include DMARC)
[flagged]
Imagine that I deploy a site in HTTP-only, without TLS, and then complain "hey, why are browsers claiming that my site is insecure and showing some red padlock shenanigan, scaring my users away? Am I supposed to go around the Internet, checking what each browser considers 'secure' or not?"
I just tried this out now with an email from my personal domain that I have configured to send via my gmail account. I got a 10/10, but DMARC does not seem to be required for this. It shows a yellow checkbox for me on this, the same as it shows for me not having an unsubscribe button, which hardly gives the impression of it being necessary, given that I would not expect an unsubscribe button to make sense for most people manually sending emails to their customers from corporate email accounts.
This service is not accurate, it cannot handle multiple dkim keys.
Not enough. O365 still discard/lose e-mails.
The funny thing is, my domain with Fastmail gets 10/10 and I didn't have a DMARC policy configured. So you're being dismissive when you don't even know what you're talking about.
How about you read other testimonials in this thread and dial down your patronizing mouth?
To be fair, DMARC has been required for a very long time. IIRC Google warned about 2 years ago circa that non-compliant emails would land in spam or be null-routed. And the DMARC noise started even before that.
You don't have to, this is the key reason to have a DMARC monitoring service. It will tell you when there's a deliverability issue with some particular receiver.<p>DMARC applies not on your mail server, inbound or outbound, but on the server that is receiving your mail (which may in fact be your mail server).<p>That server will look at how the mail authenticates and decide if it should allow the mail to proceed, it (for the most part) will then tell you whether or not it allowed the mail. This is how you will know you might have a deliverability problem before your customers do.<p>If you're wanting to know about deliverability (particularly for this Microsoft case), my company (Alesian Security) has a free check at <a href="https://alesiansecurity.com/try?tab=deliverability" rel="nofollow">https://alesiansecurity.com/try?tab=deliverability</a>
> You don't have to, this is the key reason to have a DMARC monitoring service. It will tell you when there's a deliverability issue with some particular receiver.<p>It's been a while, but monitoring DMARC seemed pointless once you got things started. If my outbound mail fails to validate, I've asked the receivers to bounce it, and I should be able to see that on my own system.<p>Otherwise, I'm just getting reports about spoofed spam or people who need to adjust their mail forwarding, but I can't do anything about either.
right, if you're at a reject status DMARC monitoring is (and should be) boring.<p>But it provides a safe guard against accidentally broken mail flows as your email stack evolves over time which is where it pays dividends.<p>I would love to say that it would have alerted you ahead of time to this particular event, but given that it's the fix here you would never have seen it.
If running a mail server is central to your business, you should keep up with best practices. If not, 2 days of non-delivery aren't important, just resend.
As a company we realised about 12 months ago that email can no longer be considered a reliable method of communication. I understand the reasoning but the result is the result. Many new clients we deal with have whitelists on and we have to pester our clients to add us to their lists. Not a great experience for anyone. I think we should consider email pretty much moribund at this point.
It is literally one of the last free and open channels on the Internet – I suggest you work on supporting its use and keeping it that way rather than moving to something controlled for profit or data harvesting.
It being free and open is exactly what the big providers can't stand and why they are coming up with ever more "standards" that are complex to configure as well as "reputation" scores that are hard for small senders to clear.<p>Also why they do non-standard stuff like accepting mail but then simply not delivering it, rather than bouncing it.
DMARC is not hard.<p>"Reputation scores" and blacklists / greylists started in late 1990s / early 2000s as multiple grassroots efforts when spam started to overwhelm systems. Gmail did not exist, outlook.com did not exist, it was easy and expected to run your own SMTP (which I did). And it was very unpleasant.<p>DMARC appeared 10 if not 15 years ago. There's no reason for a sane MTA configuration not to have it.
Microsoft has provided free email addresses to the public for decades.
There is no such thing as a free and open channel on the internet that will not suffer the tragedy of the commons.
Calling it a "free and open channel" when 80% of consumers are on Microsoft/Google addresses that control who can deliver e-mail is laughable. It's dead, Jim.
Fair point - I meant free in the sense that the protocol is open. I didn’t mean that it’s not under threat.
You seem to miss the point WHY customers go there. I, for one, switched when I realized Google filters spam effectively.
It can be reliable, but requires an explicit agreement between the two parties. When my server connects to your server and sends a message, that part is reliable enough. If your server decides to delete the message after receiving it, that's entirely on you. You could configure it to never delete messages from me and then it's fine. The problem is that in reality nobody does this, so your vendors and customers get treated identically to random spammers.
Strengthen your contracts / terms of service. Make it their responsibility to configure their email systems properly so they receive emails sent from your domains.
So what have you switched to instead?
Delivery to Microsoft's products has been patchy for several years. I am not remotely an email deliverability expert but I have made different SMTP service choices based on how companies approach shared-IP sending plans.<p>Some can affordably deliver to Microsoft because they aggressively police what they are actually sending on their customers' behalf; others don't get involved and you end up having to spend a fortune on a dedicated IP.<p>The DMARC thing is just another part of this; one of my clients discovered this silent failure themselves a few weeks back and addressed this.
DMARC is a DNS record that says "send emails about spoofed messages here", or optionally "I don't need you to tell me that scammers exist on the internet".<p>It doesn't prevent spoofing, it doesn't say which IPs are authorized to send on behalf of a domain, it doesn't sign messages. Spoofed messages are still sendable.<p>Can you explain the benefit of only accepting email if Microsoft knows that you may or may not accept emails about scammers unsuccessfully spoofing your email domain? (Note, there's nothing you can do if they do tell you.)<p>Don't confuse DMARC with DKIM or SPF; DMARC doesn't actually do anything for email security.
> Don't confuse DMARC with DKIM or SPF; DMARC doesn't actually do anything for email security.<p>DMARC doesn't introduce a new security mechanism by itself, but it fixed a few bad security flaws in SPF and DKIM. Without DMARC, SPF and DKIM do not add meaningful security.<p>DMARC updated and formalized how receivers should handle authorization and authentication of inbound email by adding the alignment requirement. Alignment ties the SPF and/or DKIM domain to the rfc5322.From domain. This also allows receivers to use domain reputation rather than IP-reputation.<p>SPF by itself has a bad design flaw that completely breaks any security that SPF was supposed to provide. By adding DMARC this security hole is fixed. (Although SPF is still horribly unreliable, it should be considered legacy at this point, don't rely on SPF).<p>DKIM benefits from DMARC alignment requirement too. DMARC ties the rfc5322.From domain to the DKIM signing domain, which makes DKIM practical for sender authorization, not just authentication.
That is not true. Reports are just one of the features of DMARC. The policy which allows you to instruct senders what to do with unauthenticated emails is the much more relevant part an when the receiver follows it, it very much does prevent spoofing.
And what should a provider do if the dmarc policy says that none of the dkim or dmarc records should matter? What was the point of spf saying what servers could send, or dkim specifying signing keys?<p>"Oh, please, don't ignore the other two ways I told you to ignore unauthorized messages" shouldn't need a knob.
You are a mail server.<p>You get an email without a DKIM signature from me.<p>Is that because I do not use DKIM and do not sign my emails or because the message is forged and not from me at all?<p>You cannot tell. There is a single SPF record that you can look up to see if SPF is configured. It's just a TXT record on the domain. But there is no standard DKIM record. A DKIM signed email tells you what key identifier it used and you have to use that to look up the DKIM key at <key identifier>._domainkey.<sender domain>. When the email has no DKIM signature you cannot tell if that's because the sender domain does not use DKIM or if it does have a DKIM key record but it was not used, potentially because the email is forged.
Right. And if you mandate dkim, as seems to be the case with servers that demand dmarc, what's the issue? You reject the emails where dkim isn't set.<p>Or do you think it's critical to support mail that doesn't have dkim?
DMARC gives you 20 reminders that you have sent an email, just incase you had forgotten.
lol, what a bunch of bs.<p>gmail runs with p=none<p>so tell me what benefits that has over having no dmarc record at all ?
Yeah, and people who don't switch to Dvorak are lazy, too!<p><a href="https://ciphercue.com/blog/dmarc-enforcement-gap-rua-fragmentation-2026" rel="nofollow">https://ciphercue.com/blog/dmarc-enforcement-gap-rua-fragmen...</a><p><a href="https://news.ycombinator.com/item?id=49081783">https://news.ycombinator.com/item?id=49081783</a><p>I have MCP servers for the creation of domains, DNS records with DNSSEC, and email accounts with SPF, DKIM and DMARC. I'm sure if someone wants to be a professional spammer today, DMARC is not a differentiator.
It's an interesting argument. The fact this article exists is somewhat proof that it is a differentiator. The flipside, however, is that spammers very specifically require their emails to get to add many mailboxes as possible, so their motivation is greater to make their emails service compatible.<p>Company sys admins have likely got all sorts of other issues to worry about, and the occasional report of an email not getting through is likely low on their to-investigate list.<p>Having said that, I self host a mail server, and have all those things setup correctly, and my workplace uses Outlook, and I've not had issues with delivery, so it's not a particularly difficult bar to jump.
What? How does it prove it's a differentiator for someone who wants to be a spammer, which is what the comment you replied to made a claim about? As far as I can tell, it's evidence (not proof) that Microsoft thinks that they will reduce spam by requiring it, which in turn is circumstantial evidence (definitely not proof) that spammers might have to spend some amount of effort to start using DMARC. I don't understand how you can conclude that it would be onerous for them to do so indefinitely; it seems equally plausible that they might have just not bothered to do it before now but will be able to start doing it without much cost.
I set up DMARC on my personal domain so long ago I can't even remember when I did it. 10 years+?<p>I had kinda assumed that a lot of providers would start rejecting domains without DMARC support. I'm surprised it's happening this late.
This was my second hackernews submit [0]! So, not even https in 2014 :)<p>When I ran that server, outlook.com was also the only one that would blackhole my email for no known reason. Support was unhelpful and also could not point to any reason. I've since given up, but for a short time it was glorious, email to family would not leave the lan and we could send attachments of arbitrary size.<p>[0] <a href="https://news.ycombinator.com/item?id=7708882">https://news.ycombinator.com/item?id=7708882</a>
You adopted it the moment it was announced? Really?<p>Is there a risk some people on this thread are mixing up DKIM and DMARC?<p>DKIM = proving that an email was sent from a specific domain using cryptography. Good for spam fighting and deliverability.<p>DMARC = telling receivers how to handle mail that fails authentication.<p>DMARC is primarily useful for large, complex organizations where email admins may not be aware of everyone inside the org who is sending mail that advertises the domain in the From header, or organizations that might be targeted by impersonation attacks (e.g. phishing). Being able to tell recipients "yes we absolutely have our act together so feel free to reject or spamfolder unauthenticated email" is great for killing phishing campaigns, and being able to request reports is great for finding that one sales org that signed up for a guerrilla marketing SaaS that's impersonating them.<p>But for small personal domains the value isn't that high.
I added DMARC and DKIM together, around the same time as some particular life events 10 years ago. Just now, I cross-checked the information against the commits in my Git repos.<p>Back then, I didn’t use Terraform or anything like that, but I had text files with logs that described the DNS setup in detail so I could fix things. By grepping through the logs, I’m able to put a definitive bound on when I added DMARC—it was no later than June 2016, over 10 years ago.<p>At the time I thought, “Obviously, we should all be setting this up, because recipients will start rejecting mail from insecure domains, if they don’t already.” This was also back when I self-hosted email. I eventually stopped doing that because I thought it was too time-consuming.
>DMARC is primarily useful for large, complex organizations<p>>But for small personal domains the value isn't that high.<p>I don't understand the resistance. It benefits the entire mail ecosystem, not just mass senders.<p>SPF used to be niche thing, then everyone realised it's a good idea and it became more-or-less mandatory. Same with DKIM. Now it has happened to DMARC as well.
> DMARC = telling receivers how to handle mail that fails authentication.<p>No. DMARC is about if the from address has to match the address used in dkim/spf
> You adopted it the moment it was announced? Really?<p>A specification exists since 2012, 14 years ago. 10 years ago it was already old.
Email is the largest social network on earth (8.3 Billion addresses)<p>10 years is nothing. I'm sure there's still millions of companies globally who still aren't properly signing mail with DMARC.
They're not rejecting them quietly. They're sending 5xx permanent delivery failures.
Well, if we can get a more relaxed email self hosting experience with the DMARC enforcement, I'd say it is a good trade-off in exchange with freedom of speech, rather than accepting the risk of spamming.<p>These days, hosting a proper mail server isn't really that hard, thanks to Stalwart <a href="https://stalw.art/" rel="nofollow">https://stalw.art/</a>. I did it to my Talos Linux cluster located on LA and utilizing idle resources. It is pretty great
I gave up last month and set up the outgoing email for my personal domain to go through the free tier of smtp2go.<p>Receiving is still self hosted.
This is interesting. At some point, I think it'll be desirable to give increasing positive weight to emails with the DPF/DKIM/DMARC trifecta configured, since those are least likely to be problem emails (spam or phishing), but I wonder what the best avenue is to actually make that the default. It's almost certainly not this kind of unannounced cutoff.<p>Email is, I think, among the <i>most</i> distributed popular online services, and there's a ton of stuff that's legacy, self-managed, or otherwise janky. Supporting SPF, DKIM, and DMARC does put a burden on independent operators, but is it an <i>undue</i> or <i>unreasonable</i> one in the current landscape? Or is it just the new cost of doing business?
It seems like 90% of the spam I receive (on my google account) is sent from google addresses, so it will have valid SPF/DKIM/DMARC setup.<p>That said checking for these things is a good idea, the only problem I see is dropping the mail on the floor, rather than rejecting it at SMTP time - at least that lets the self-hosting users who haven't got things configured know their email is being rejected, and to pick up the phone instead.<p>There's nothing worse than sending an email, it being accepted, and then later discarded with no clue to either sender or recipient.
> but is it an undue or unreasonable one in the current landscape<p>Yes. In the first place, this should not even be a thing. Two corporations should not be in control of who can send e-mail. If they want to mark not having DMARC as spam, mark it as spam, or better yet flag it with a specific warning about the domain, but these games with refusing to deliver are just bullshit and essentially force a monopoly where other e-mail providers cannot compete because their e-mails aren't delivered.
No, not delivering is much better. You get a clean error message that tells you exactly what to do, it can be fixed in minutes. Spamfoldering email for not having DMARC would be a mistake, it might be years before low volume senders notice and figure out what's wrong (if they ever do).
> You get a clean error message that tells you exactly what to do<p>We are literally talking about a situation where this is not happening! And the problem is that it's not just this. Once you give them a license to police e-mail, they start policing e-mail for all kinds of arbitrary and inscrutable reasons. <i>If</i> this were going to be done, it should really be formalized as an industry standard by an independent consortium, not up to the whims of Microsoogle.
> I wonder what the best avenue is to actually make that the default. It's almost certainly not this kind of unannounced cutoff.<p>En contraire, I think not delivering mail is the fastest way to adoption. People will use an old system for as long as it works. It now does not anymore.
I don't know. I think this disenfranchises a lot of independent operators, and the blow of that could at least be softened by making a highly-visible public announcement about it a few months ahead of time.<p>Maybe you're right that <i>just enforcing it</i> is the way, but I don't agree with doing that with no heads up.
Most spam I get is from Google, Microsoft and Amazon. We should pressure those to start dealing with the problem. Right now they are conveniently ignoring it.
None of them are a good 'Is this spam?' heuristic, though. All they do is ensure the sending domain isn't forged, but most spam, even phishing emails, doesn't really rely on that. Spammers are much more motivated than average to jump through the hoops necessary to set it up, as well. Any anti-spam signal needs to be much more expensive for spammers than regular senders.
I could be naive, but I don't see how this would be any more unreasonable than requiring HTTPS
There's no burden whatsoever. It's a one time setup that takes like 15 minutes.
I actually totally agree with this. There's too much risk involved with scams disguised as legitimate services because the developers of said service couldn't be bothered to add 1 or 2 dns records.<p>Although there seems that there hasn't been any communication which is the bad thing here. However, nobody looks at those and sending detailed emails back seems like a good enough solution.
Maybe they should also work on what their users are sending as well.
Unfortunately, the people abusing these are very persistent and adding more checks will just increase the sophistication of such attacks which works against the interests of the target.<p>This stops disguising yourself as a legitimate service.
If they did that you’d decry censorship.<p>Allowing basically ~whatever, but proving the sender address is an obviously good approach to me.
I don't know what "v=DMARC1; p=none;" is proving to anyone when DKIM and SPF are already aligned but sure whatever. Just wish they'd given some warning!
email is weird, without this it doesn't perform the checks at all
Agreed. There's no additional verity provided by adding a DNS record with a static line of text. Reminds me of airport security theater: meaningless hoops for citizens to jump thru under the guise of stopping bad actors.
I thought they've been doing this for years, along with gmail/etc. I basically just added setting up the correct DNS records as part of business when sending emails externally.
The only mistake people make here is to accept that the problem is on their end even after Microsoft has accepted the e-mail but silently discarded it. This leads to the customer impression that the mistake happens on their end and not on Microsoft's.<p>When I see in my logs that the e-mail has been successfully delivered to their MTA then I don't have a problem.
Yep. Let's say for example you were sending a legally important email saying you did something, and your customer tried to sue you over not sending the email. If you sent it and the customer's agent (Microsoft) dropped it, that's a problem between the customer and their agent, and you are not liable.<p>(If this happens to you, <i>don't</i> admit that you know Microsoft drops your emails, or you'll be liable again!)
I have the opposite problem. I have a 3-letter email address, so for ease of giving out the email address, I use it, while having it forwarded to my Gmail. Somewhere around 2019, emails from legitimate services, especially password reset/OTP codes, stopped landing in my inbox or even junk because my address is so high up the chain of spammers. Nebula was the first to confirm this for me and work out of band to re-enable access to my account - their emails to me were bouncing. But ever since that happened, I’ve slowly moved back to giving my Gmail.
There's something called ARC <a href="https://en.wikipedia.org/wiki/Authenticated_Received_Chain" rel="nofollow">https://en.wikipedia.org/wiki/Authenticated_Received_Chain</a> which is supposed to handle forwarded emails, but no idea how it works in practice.<p>Sounds like kind of a hack:<p>"ARC was devised to solve this problem by giving intermediate servers a way to sign the original message's validation results. Even if the SPF and DKIM validation fail, the receiving service can choose to validate the ARC chain. If it indicates that the original message passed the SPF and DKIM checks, and the only modifications were made by intermediaries trusted by the receiving service, the receiving service may choose to accept the email."
Sounds like Gmail is the one blocking it. Stop forwarding it to Gmail and set up email directly on the address.
huh<p>maybe someone was too lazy to set up "inbound block list" and just did a total blackout instead?
> Quietly Rejecting Email<p>> The sender gets a bounce<p>?
"quietly" is a sign that an LLM wrote it
My first thought as well: how does one <i>quietly</i> reject email? Skimmed the comments and clearly it's not quietly. Saved a click...<p>It's quiet only if the server accepts it and then deletes it on their end without notifying the sender, but if your mail provider shreds your mail that's then also your provider's responsibility and not the sender's
I self-host my email system and rarely send any outbound email. Occasionally I receive emails from individual users. Users on Microsoft’s email service can send emails to me, but my replies are rejected outright. This doesn’t happen with Gmail or other email providers.
As they should. You should have done this 5 years ago. Takes like 10 minutes. Gmail has been rejecting them for years at this point.
"Google has been rejecting them for years..."<p>Not true, at least in my experiences.<p>I have a bunch of email accounts which have SPF and DKIM, but are missing the DMARC line - I've had no deliverability problems at all, until this weekend, and now only with Outlook. Emails to Gmail accounts go through just fine.<p>The combination of:
√ Valid SPF
√ Valid DKIM signature
X Missing DMARC policy<p>Is clearly ambiguous. Since a DMARC of "p=none" (in the context of valid SPF and DKIM) really adds no information, so interpreting "missing DMARC" as "p=none" seems reasonable. Sounds like Microsoft was taking that approach until this weekend.<p>I wonder if there's an actual written standard?
Under RFC 7489 [1], a domain with no DMARC record simply has no DMARC policy, the receiver is able to enforce whatever policy it likes.<p>Most receivers have chosen to treat this as p=none for the last decade (Microsoft included). This is changing to now so that mail with no record is simply refused. Nothing in the standard prohibits this.<p>a DMARC of p=none might be seen as ambiguous - SPF and DKIM have their own jobs and they work. However, the point of DMARC is not a new way of enforcing mail authentication. Instead it is a way of making certain that the mail is internally consistent and furthermore provides two additional things.<p>1. it indicates if the domain owner has thoroughly gotten their mail to authenticate (in which case they adopt a p=reject), and<p>2. it provides a feedback mechanism that allows the domain owner to know if they are seeing authentication and deliverability problems in such a way that they can fix those broken mail flows.<p>[1] <a href="https://www.rfc-editor.org/info/rfc7489/" rel="nofollow">https://www.rfc-editor.org/info/rfc7489/</a>
Googling around this started at least a year ago, but I worked at an MSP 3 years ago when it was first announced and we started getting customers into compliance. This wasn't something out of the blue.
On an unrelated but frustrating "silent behaviour" note, I hate how Outlook rewrites URLs to add their "safe links" domain indirection. Just show me the damn raw URL!
This is a good thing for the actual email users. The volume of really obvious “spam” emails were through the roof that it became quite tedious to rescue legit emails. It’s not like setting up DMARC is hard either.
Tangentially-related: Gmail has started sending completely legitimate emails to spam. DMARC/SPF/DKIM (2048 bits) all properly configured of course so there has to be something else that isn't documented.
They have been doing that for years. A long time ago there was a submission here on HN about some Ivy League college urging college applicants to provide something other than a Gmail address because application-related emails (including acceptances!) would frequently not get through.
Started? My Gmail spam filter has been broken for several years now. Extremely obvious spam regularly ends up in the primary inbox and critical, fully legitimate messages get buried in spam. It’s a major reason why I left for another provider.
Gmail send <i>their own service notifications</i> to spam.
This has been going on for much longer than stated here - we had domain mismatch issues with outlook going back years and our policy was p=none. They’re very sensitive and mailing lists with forwarding are heavily impacted.
Mail admins had 20+ years to fix config.
Not saying that outlook is properly config, but it’s well overdue using solutions designed to reduce spam.
Mail security non-expert here, is this going to affect people who use alternative addresses for their Gmail account?
It’s 2026.. having been at a few email companies for years, this time I would agree with Outlook on this one
Email was invented in 1965. It needs to be replaced with something that doesn't try to bolt security on as a lazy afterthought 30-40 years later.
We have everything we need to define email 2.0 with mandatory security, the problem is all the older installations that support 1.0 <i>that everyone still expects to talk to</i>.<p>New protocols only solved this by cutting compatibility. Signal can be E2EE because you can't send a message to an email address with it. Email can also be E2EE, but how do you know the recipient supports it?
What about Matrix?
Sorry to break it to you, but email isn't going anywhere anytime soon.
Rejecting emails from some domains. Why would emails “to” these domains also bounce back?
I had an email kicked back to me from Hotmail this past week complaining about missing DMARC. I fixed that and subsequent messages went through fine.
I’ve been anticipating something like this for a while; the number of folks who don’t have their email-related DNS settings in order is remarkably high.
DMARC has been around for a while now. I know it’s fashionable to bash on Micro$oft and they rightfully deserve it.<p>Just not for this.
What if I include the header string, "DMARC and Jalad at Tanagra."
Stop bitching guys, you have never dealt with t-online.de (T-Mobile)<p><a href="https://telekomhilft-telekom-de.translate.goog/conversations/e-mail/tosarxt-onlinede-fordert-impressum-von-privatpersonen/668887c54ae73561da68333e?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=wapp" rel="nofollow">https://telekomhilft-telekom-de.translate.goog/conversations...</a>
You can hate on outlook.com for a couple of reasons.<p>But this is not one of them.
> Nobody announced it<p>They did: <a href="https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/strengthening-email-ecosystem-outlook%E2%80%99s-new-requirements-for-high%E2%80%90volume-senders/4399730" rel="nofollow">https://techcommunity.microsoft.com/blog/microsoftdefenderfo...</a><p>And it appears to be further documented here:<p><a href="https://learn.microsoft.com/en-us/defender-office-365/anti-phishing-policies-about#spoof-protection-and-sender-dmarc-policies" rel="nofollow">https://learn.microsoft.com/en-us/defender-office-365/anti-p...</a><p><a href="https://learn.microsoft.com/en-us/defender-office-365/email-authentication-dmarc-configure#dmarc-for-inbound-mail-into-microsoft-365" rel="nofollow">https://learn.microsoft.com/en-us/defender-office-365/email-...</a><p>And other sites were reporting about it for at least a year and a half:<p><a href="https://powerdmarc.com/dmarc-outlook-email-authentication/" rel="nofollow">https://powerdmarc.com/dmarc-outlook-email-authentication/</a> (see #4)<p><a href="https://www.mailreach.co/blog/outlook-dmarc-requirements" rel="nofollow">https://www.mailreach.co/blog/outlook-dmarc-requirements</a>
> For domains sending over 5,000 emails per day<p>That's an old announcement about a different change. As far as I can tell this one is completely out of the blue. I'm shocked by the number of people in this thread advocating for spontaneous changes without any warning.
That says for "high volume senders" but they now apply the rules regardless of volume.
Yes, this is an older announcement from last year. Yahoo and Google did the same at that time.<p>The failure associated with that announcement is different. It is 5.7.515.<p>This new failure mode is "5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records (AS9031519)", I haven't seen any formal announcement on my end. The important thing to know about 5.7.1 is that it represents a few different failure modes, the AS9031519 is the important bit and it indicates that the domain lacks a DMARC record.
Is there any actual evidence of this outside of this one company's AI-generated article?
There's been ample evidence of this, many different blogs, notification emails etc.<p>This thread duplicates the first observations of this which showed up here yesterday at <a href="https://news.ycombinator.com/item?id=50404161">https://news.ycombinator.com/item?id=50404161</a><p>My mail provider, MXroute, sent me a notification of the issue early yesterday. There is commentary from various DMARC providers (Suped and PowerDMARC). This is a real thing.<p>It does not matter which host you are using, this has nothing to do with the hosting provider. It has everything to do with having your domain correctly set up on DNS so that anybody receiving mail will know how to authenticate it. Microsoft has apparently advanced a policy that if you don't even try you don't get to send.<p>IMO this is the right call, I've seen plenty of spoofing attacks where the attacker took advantage of nonexistent policy on non-sending domains. You might think that if you don't have an MX record the domain can't be used to send mail, that is wrong. The MX record only tells others where to send your mail, it says nothing about whether the domain can send mail itself.
I got a bounce on a mail from my personal Fastmail account (with my own domain) the day before yesterday.<p>I had SPF/DKIM set up, just not DMARC. Did that yesterday and don‘t see the point. My policy is "none".
The point is to have a DMARC record, setting it to none doesn't really do much of anything for you though. If you really wanted to take advantage of it you will need a DMARC monitoring solution - the market seems to typically price these around $10/month for small-ish domains (though there are a lot of caveats). I'm trying to build a reasonable free option that maybe isn't enough to get a domain to a reject policy, but should be enough for you to maintain a reject policy.<p>The truth is that there are amply "non-sending" domains out there which ignore DMARC and allow abuse. Stopping the assumption of no policy mean p=none prevents this abuse from persisting.
I was hit by this twenty minutes ago. I don't disagree with the policy, but I wish my provider had warned me so I could add the headers. I already had DKIM and SPF, but not DMARC.
Didn't gmail already roll the same thing out in 2024?
I've got the DMARC record on my domain, but it does seem very silly. Why couldn't the spec just make `p=None` the default?
If BIMI was in any way scalable it would actually provide a way for an external signer to say “yeah we trust these guys, you should deliver this”.<p>I haven’t really seen BIMI for less than practically $1000/year and most clients still don’t check it.
For anyone running their own mail server, Microsoft has an authorization system to let you "authorize" your mail server IPs to talk with Microsoft's mail servers.<p>It's stupid, but not terribly difficult to set up and authorize.<p>Like most people who run their own mail, I have had repeated problems with Microsoft in particular, who treats small mail server operators like crap.<p>This post reminded me that I had gotten some email requesting me to "Re-attest Your Network Access". I went in, clicked a few things, and I'm good for another year or whatever.<p><a href="https://substrate.office.com/ip-domain-management-snds/snds" rel="nofollow">https://substrate.office.com/ip-domain-management-snds/snds</a><p><a href="https://www.litmus.com/blog/what-is-microsoft-snds-why-your-deliverability-strategy-depends-on-it" rel="nofollow">https://www.litmus.com/blog/what-is-microsoft-snds-why-your-...</a>
Yahoo is too.
Yeah thanks Microsoft. Really appreciate having to mitigate this for hundreds of customers on a weekend. Nice one!
Its not "one header" to fix. SPF and DKIM must be implemented.
I noticed this when it happened, but I do have a valid DMARC entry (albeit p=quarantine).<p><a href="https://mastodon.social/@davisr/117570496362439342" rel="nofollow">https://mastodon.social/@davisr/117570496362439342</a>
Email is dead. Unfortunately any replacement for it would be owned by Meta or MS or whatever.
The assumption of a single shared medium is dead.<p>When you talk about a single entity to single entity connection it can be any protocol. Email, Matrix, WhatsApp, SMS... Discord... Instagram. All of them work especially if you whitelist the other party.<p>What doesn't work any more is assuming that everyone is using the <i>same</i> thing. Back when email was invented it was the <i>only</i> computer-based communication protocol - I don't remember whether it came before or after USENET - I'm assuming before. If you wanted to send a message to someone you sent it to their email address. Now things aren't so clear.
> The fix is one DNS record.<p>Oh god the slop.<p>Only an LLM would describe DMARC as just "one DNS record".
I literally had to copy paste one dns record to enable it.
lol DMARC is one record.<p>It doesn't have to be just one record, but it doesn't have to be more than one record either.
Do they literally just need the DMARC record to exist though, or do they need it to actually say something? Do you need DKIM? I found that SPF is very easy but DKIM is a royal pain.
DMARC is layered across (/is useless without) two other protocols (SPF, DKIM), both of which also require DNS records.. there's no way to DMARC with one record.. unless you're excluding those SPF and DKIM records in your count. You /could/ DMARC with two records: DMARC+SPF, or DMARK+DKIM but it's ill-advised - use all three. (Ignoring host hierarchy/cname delegation, you can have far more records)
Were you previously sending email without either DKIM or SPF?<p>Because i doubt that has worked at all in the last decade.
I suppose I'm splitting hairs.<p>Yes, a proper email authentication stack has DMARC + SPF + DKIM. But each of these is a separate protocol.<p>This also doesn't take into consideration the other protocols that have arisen BIMI, APRF, MTA-STS / TLS-RPT and are at even lower levels of adoption.
MTA-STS is useful (but it's about helping receivers by demanding mail is sent encrypted, not senders with delivery).<p>BIMI is a pay-to-spam protocol that helps senders, you can add a rule to postfix to mark it as such.<p>APRF is a draft, and likewise helps senders, not receivers.. not sure why anyone would want to adopt this standard. A little closer to DMARC reports, but sharing PI that you owe no sending server.
It's possibly yet another issue relating to the long streak of problems seen the recent months by primarily self-hosters trying to reach people and businesses behind Outlook servers. The past few weeks a lot of my e-mails to friends and family using Hotmail have gone missing. All envelopes were OKd by Outlook servers, nothing bounced, e-mails just gone. My setup is clean, my network is clean.
I'm fine with providers imposing some default level of spam protection but as a user I'd like the option to disable it, even better if I can disable it per domain or sender. The old technique of adding the sender to your contacts doesn't work reliably anymore.
<i>"The old technique of adding the sender to your contacts doesn't work reliably anymore."</i><p>An Outlook user first reaching out to you, and you replying and including the unique message-ID of their original envelope in your headers, doesn't affect anything either. Absurd. The whole situation is complete dog shit.
"First time?"<p>It's not months it's years.
[flagged]
"Since November 5, 2026, Microsoft's consumer mail service has been turning away some of the email from domains that don't publish a DMARC record. If your company emails customers, vendors or applicants with outlook.com, hotmail.com, live.com or msn.com addresses, some of that mail may be bouncing right now. Nobody announced it. The fix is one DNS record."<p>I'm personally seeing this with some email systems I manage - email sent from a domain that has proper SPF and DKIM signatures, but had no DMARC record started bouncing this weekend.
[flagged]
[dead]
[dead]
[flagged]
[dead]
[flagged]