Outlook.com is also rejecting mail based on blocklists that are not public and you essentialy cannot get yourself out. My VPS provider is pretty much entirely blocked and their regular blocklist process says we are golden so nothing to unblock.
Outlook.com and similar are an anathema to email. This is why they tell you not to run a mail server .
On the other hand rejecting domains without dmarc is fine. Just not happy it is silent.
Everybody I know who still runs their email server (you can get Europeans out of Europe, but you can't get Europe out of the Europeans) complains about Microsoft.
I bet Microsoft is single-handedly responsible for 80+% of complaints about email being impossible to host.
In a federated / pseudo-decentralized network, any provider with 10+% of captive users has an outsized leverage on the entire ecosystem. You don't need a monopoly; as long as you have a monopoly on just a few users that others absolutely need to be able to interact with, you can dictate terms to everybody.
Google is no better. It's quite absurd, they even went through the trouble of creating postmaster tools to help you manage your reputation - except that these don't work unless you have fairly high sending rates (I forget, but I think several hundred a day). So essentially they're actively hostile to personal and small business servers.
> I bet Microsoft is single-handedly responsible for 80+% of complaints about email being impossible to host.
They are the reason I dropped self-hosting my mails. They were silently dropping some of my mails depending on the day I sent them. If they were at least sent to the spam folder, it would be easier to communicate with their users. And since a lot of their users are not technical at all, it's complicated to explain them the issue.
It's absurd in every way. I was trying to get it to stop spamming maillist traffic. It's impossible. Global level filters enacted as admin to not spam check are ignored.
Don't forget Google! Gmail will hide your email for no reason no matter what you configure on Gmail's side of things. At least Microsoft has a "please remove me from your spam lists" form (that only worked for ipv4 IP addresses last time I tried).
Same experience here. We have multiple customers whose servers are in large blocked IP ranges, with seemingly no way to get them delisted. The strange thing is that Microsoft only seems to reject their emails on Hotmail/Outlook.com accounts (free accounts), while accepting them just fine on business accounts. Meanwhile, their “support” tools tell you there’s nothing wrong.
Based on my broad experience, I’d comfortably rank Microsoft as the worst of the major email providers. (I am owner poste.io)
I work at a big company that sends alot of emails. And even we have been put in the "bad bad books of o365 bad list", it's an absolute pain to get yourself out of the office 365 defender (I think it's what they call it now?) meanwhile your customers are complaining they arent receiving emails from you.
Yes. I once had issues with emails being rejected by Outlook on MailGun. And it was only Outlook. Had to contact support, they promptly changed my account to another server/IP once I mentioned it was Outlook, sounded like a recurring issue.
Well, your big company should then call M$ out then. E.g., consider you're sending a confirmation e-mail during account registration, then when your server detects that relay is `*.oulook.com` show a warning: 'outlook users most probably will not receive emails from us due to bs policy at microsoft. consider using a different email provider.'
Yes, that may turn some users away, but they would complain and leave anyway, because they don't receive emails from your server. On the other hand, that's how one can contribute to unwinding ms's share of email accounts.
Think about what you're saying: someone is near the top of the sales funnel and despite the odds you've convinced them to provide their email so you can start the process of trying to convert. Even if you are good you'll still lose 80% of people from this point before you see a single dollar. Now, inject some extra weird, sketchy-sounding friction AND ask them to change their email provider, something 99% of employees never think about let alone control. Not sure how old you are but you'd have better luck convincing users "this site works best in IE4".
Right, letting users frustrate silently, without explaining to them why they don't receive correspondence is the way to go. Discussing my age/gender/race isn't productive either. Dont rage, just pay attention to what's written. I only suggest them to select a different e-mail for better experience, not reqiring it. And the actual wording of this suggestion should always be developed in collaboration with company's layers and marketing teams.
outlook.com and O365 are horrible to deliver to. We regularly get issues where we sent an email it was accepted by O365 but was never delivered to the mailbox. We have one person working at least half the time on resolving stuff like that. And that's from a respectably maintained SES egress with good reputation, DMARC, DKIM configured.
There is a trick. Sign up with them, configure custom domain, but don’t set your MX records. On your MTA, route mail that goes to Outlook/Hotmail to go through their MSA with your Outlook credentials and headers stripped as if submitted directly by user. Outlook gets mail through their own MSA it trusts, rest of the world talks to your mail system directly. Replies still go to your MXes.
I haven’t productionized this setup (I send maybe a dozen emails a year) but it worked for me ad hoc a couple years back, when I had to send a mail to an Outlook-hosted address and they blackholed everything I tried to send while 250 OKing me.
The problem with this setup is that if I want to send email to fred@example.com and example.com is actually handled by Outlook, I need to somehow know beforehand that email to example.com needs that special routing. Or do you just route ALL your outbound email through Outlooks MSA?
You can usually figure that out by checking the MX records (though some spam filtering middlemen might make that hard to detect) and TXT records (if a domain imports Outlook's SPF list, it's probably on Outlook in the back).
I have a small client with a large email list who wants to switch from once a month constant contact newsletters to sending them through SES with a self-hosted Sendy instance. This seemed like a reasonable way to save $10k a year or so. I haven't used SES before for anything. I have run an email server for 30 years and had occasional blacklist headaches, but it's not used for mass mailing of that sort... it's usually several years between problems. Is this a terrible idea to switch, even if it's off a "managed" SES dedicated IP? I don't want to switch them and find out no one on Outlook is getting their mail.
I ran a SaaS up until recently. Emailing users notifications for events was just a normal part of the app. Users got upset when the emails didn't come through. So then I had to be email tech support for something I had no control over. Lovely.
Self hosting mail on a shared server in Moldova is basically the entire idea behind email (and the internet).
Which with cheap models like Jev as spam classifiers, this can now become a reality.
The problem is, Google and Microsoft have monopolized the entire email market, so their esoteric deliverability mysticism from 2007 still persists (basically blanket bans on entire IP spaces, locking out anybody trying to send emails on their own).
People used to have party lines and leave their doors unlocked too, but it turns out the world is filled with bad actors and other assorted shitty people.
The problem isn't that a random person can't rent a Moldova VPS and run an email server, though. It's that most people are forced into gmail, apple and outlook accounts if they want to use phone/PC, and a respectful Moldova company now can't reach their respective Moldova clients without paying money towards USA.
Switch Moldova to almost any country (or even a state that isn't California or Washington), and it's the same story everywhere
This is one thing I find more on Hacker News than most other discussion sites. Any topic about annoying or bad behaviour by corporations eventually devolves to "they're allowed to do it".
"They're allowed to do it" is one of those things that doesn't really bear saying so much because that's already been implicitly established. Nobody is claiming what they're doing is illegal, so how does this add anything of value? Who is still unaware that corporations will use their size and market control to their benefit?
> Outlook.com and similar are an anathema to email. This is why they tell you not to run a mail server .
It should be the other way around though.. More people should run their own mail servers so that centralized players cannot control what should be a decentralized communication protocol.
I had experience implementing and debugging mail delivery, so when I chose to run my own server I just opted for a SMTP relay, and never had an issue. I don't know why this isn't the recommended default solution.
I've had several times where mail from custom domains associated with a business were delivered hours late by Outlook. Time sensitive emails. A guy coming to my office for a meeting called me and said he was downstairs and having an issue with security. Went down and swiped him in.
Four hours later, I got the same message by email. I thought he was back - nope. An email sent at 10am that was delivered at 4pm showed it was from 2pm until I looked at the header and saw sent at 10am and just... chilling out for 4 hours. DMARC was set up for them just fine.
I've had the same issue with my own custom domain, with DMARC set up. A year later, it finally got bumped up to some sort of "trusted" domain for that one place and my emails get delivered the same day now.
yeah I see it for them being a problem too if they are not accepting legitimate email. I might be a bit stubborn here but I refuse to give them the monopoly and self host our email anyway. I just wish more people would join this fight
Pretty sure this or part of this just burned me. Icing on the cake is Nintendo will also ban hammer your email if it rejects some or all of their emails - including their dumptruck of marketing junk. The only and I mean only resolution to this is to basically move your Nintendo account to a different email completely. Absolutely unreal on both sides.
Yes, no one should not have DKIM or DMARC but holy yikes when neither side wants to actually give in to help the customer.
I was viciously mean in my communication with the Outlook team when they said they “couldn’t” remove me from the blocklist. I pointed out that, as the operator of a perfectly compliant secure server their inability to deliver my mail is a technical failure on their end and one which I will be contacting their supervisor about and they somehow managed to scrabble together the heroic ability to delete my row from a table. Never back down from these bastards.
Requiring DMARC may be good, but Outlook's approach is awful.
I was working for Microsoft when outlook.com launched and got a good email address that was my primary for more than a decade.
I had so many issues with things getting silently dropped with no recourse (2FA codes, account recovery mails, etc.) on so many sites that I finally gave up, reversed the stream, and had Outlook forward to GMail instead of vice versa. A few months after that, I realized that all my Outlook got was an enormous volume (hundreds of day) a spam and that all legitimate mail was going to my other accounts, so I turned it off entirely and haven't read that mailbox in over a year.
> I had so many issues with things getting silently dropped with no recourse (2FA codes, account recovery mails, etc.) on so many sites
This is not unique to Microsoft and really the source's problem — they did something to get blocked in the first place.
Add in the fact that you're almost certainly not the only one impacted, and that they have no interest in fixing it, it screams incompetence on the source's part.
Been there, done that, good luck explaining the problem to the app's first-level support in the Philippines because it's not in their script.
> and had Outlook forward to GMail
Till the day GMail hits you with the "We couldn't verify it's you" bullshit and locks you out of your account forever. Good luck getting support from Google, the word is not in their lexicon.
> This is not unique to Microsoft and really the source's problem — they did something to get blocked in the first place.
I've never encountered this issue with GMail. Delivery just works. I'm trying to think of the last false-positive spam flag I've had with GMail, and I've definitely never had mail be entirely dropped.
> Till the day GMail hits you with the "We couldn't verify it's you" bullshit and locks you out of your account forever. Good luck getting support from Google, the word is not in their lexicon.
Some hosting providers are known for not caring about the activities of their customers, but in general, how would I know that the other tenants are scum?
I have access to a fairly large dataset of known bad hosting providers, but most people don't. So how do you tell the difference between getting a good deal and "this is cheap because it's sketchy as all hell".
We also don't block all of Vietnam, or all Jio customers in India, even if we know that 20% of bot traffic is from those two alone.
Wait until this guy realizes that all spam these days comes from Azure ASNs, and abuses cross-tenant issues as well as a simple "Fwd: ..." and "Re: ..." tricks to bypass Microsoft Outlook spam filters.
> Outlook.com and similar are an anathema to email. This is why they tell you not to run a mail server .
It turns out that whoever has the most power is the most powerful. This is why distributed/decentralized systems cannot singlehandedly free us from tyranny, and why I find people who spend all their time preaching decentralized systems to be quite silly. We don't need better systems (well maybe we do but,,,), we need better education and awareness of how billionaires manipulate us; this goes beyond software.
Complain all you want about the monopolists, and I do think you're right to do so, but a lot of their power comes from and is aimed at defeating the overwhelming flood of spam.
Mail, then emails, then home phones, then cell phones, then texts, then social media have been gradually rendered less and less usable by bad actors systematically abusing every single tool we try to use to communicate with one another to steal from us, lie to us, and manipulate our beliefs, and we'll just keep inventing and discarding new ways of communicating until we reckon with this.
With cheaper AI classification models coming out every day now, the spam problem is on the cusp of basically being solved in every communication channel.
The only question is how many years the lazy network-effects monopolies (like Google, Microsoft, Verizon, etc) will hold this back from happening.
The optimist in me says this will unlock pathways to true decentralization of push communication protocols (like SMTP) instead of only have decentralization of pull-oriented protocols (like HTTP).
Generation is, and always will be, cheaper and easier to do well than classification.
AI becoming faster empowers attackers far more than it empowers defenders. We're seeing this in every discipline and every corner of the software industry.
A bunch of my accounts were hacked a while book and since then my outlook email is getting flooded with spam.
I have to give MS credit their spam filter is pretty good.
I'll never pay for email so your options are either outlook or Gmail and I don't trust Google.
Decentralization is not a bulletproof solution. It is a mitigation. Until someone gets 50 percent of market share. Then they can run havoc on the ecosystem with their own customized system.
Just put codex in a continuous goal loop to keep you off the blacklists...give it whatever email / creds it needs to make the appropriate requests and make the needed changes (ofc tell it the guardrails it should follow).
Selfhosted email is likely easier now than it ever was before.
The irony is that if more people started to self host again, especially jogger companies, the problem like one exemplified by this post would be solved quickly.
Because the protocol is flawed at its foundation - there is no good way to make sure that the person sending you something is a person and sending content you'd want to interact with. If the big providers weren't doing this stuff, we'd whine about the enormous amount of spam.
The solution is allow only communications that are demonstrably not spam and not unwanted.
There have been lots of proposals to this effect but maybe you have to put up two cents in a crypto wallet, which the other person can claim if the mail is unwanted. If someone takes your two cents, you remove them from your lists ASAP. The receiver doesn't benefit meaningfully from the 2c so they are unlikely to claim it. The sender is only damaged if a lot of different people claim the 2 cents. Maybe a few domains are default whitelisted even if they don't put up 2 cents, to protect against entities that are important but would be frequently spite-claimed (IRS, courts, and other similar). If you use a provider that doesn't whitelist, fine, but you're going to miss those emails.
Maybe the top 'spite claim' users are published and it becomes difficult to get people to agree to put up money to talk to you.
This reduces spam to the level of junk mail, which is still not totally trivial but is orders of magnitude more manageable.
> the protocol is flawed at its foundation - there is no good way to make sure that the person sending you something is a person and sending content you'd want to interact with.
There is and it's the same as other protocols including proprietary ones - a sender address whitelist.
There's no proprietary protocol that solved spam either.
I'm the sysadmin at my company and we regularly get emails spoofing our own addresses! It's wild that Microsoft can't even protect customers when they have all the info to do so.
Mine isn't from those email hosts, but it from google cloud or Azure typically (not AWS for whatever reason). Related, the gmail spam filter is terrible.
It seems insane that gmail doesnt provide a way to automatically send a mail (eg based on domain, keywords, etc) to spam. I know theres block sender but for example aliexpress uses a different name for every email so that's useless.
What this is called is survivorship bias. The question I would ask is how much mail are you not seeing at all because it's dropped at the edge first thing because it's IP block listed?
Next, how much spam are you seeing from them because they and Google are the largest providers on Earth? Kind of like selecting a random person from the population in the US and going "look, it's a white guy". Yea, that's how statistics works.
Lastly, because the are good at blocking spam at the edge, then that's the last bastion of attack for spammers to put their efforts in if they want any return at all.
I self-host and don't have a spam filter. Spam makes up about 1 in 5 messages I receive. It's always the same spam campaigns that would be easily filtered with a few regexes.
Self-hosting allows me to use a different receiving address for each entity I contact, so I know exactly who put me on spam lists and if it gets bad I can route that address to the garbage bin.
It's been a while since I've been an SMTP server admin but when I was I managed a few hundred thousand mailboxes under different domains. Most likely know one knows about your domain and it has little traffic. On average I saw users domains get around 5 spam to 1 ham. Of course you have outliers. I had one domain that received around 1000 spam to 1 ham. That was a domain that looked like it could belong to a university and it got absolutely flooded.
Anecdotes are not a great thing to run mail servers on, broad statistics are.
We have dozens of different ways to send E2EE messages to each other, with realtime publish-subscribe, and yet billions of dollars are spent trying to duct tape email. Who cares if Outlook/Gmail/Icloud use IMAP or Websocket? If the interface looks the same to the end user will they really care?
Why are we so willingly ceding one of the few widely used free and open protocols to replace it with incompatible proprietary ones that don't interoperate?
Experience shows that the walls will get taller and the moats will get deeper.
A web forum's users, who love nothing more than using the "flag" button to stomp out comments they don't like, are indignant upon discovering the world's third largest email provider has a "flag" button of their own.
Sounds more like using outlook.com is a mistake. I've been running my own mail server for over 20 years and outlook.com is literally the only domain I have had problems with, and this is the only reason that I now send via Scaleway's free transactional email service.
The people working on outlook.com are just talentless amateurs - the rest knows how to do it right. It's a shame it's so widely used.
I don't disagree, but what are your options when a giant portion of the population uses O365 and outlook.com? How are you going to get them to stop using it, so that legit emails from user-owned servers are not silently rejected?
It depends on the nature of the transaction. If the user needs the email more than you do, you just remind them Outlook deletes your messages, and they'll find a way, and in the long term usage of Outlook will decrease.
I've also been running my own server for over 20 years, but do note that the big players may block their senders from delivering mail to your server. This happened to me with GMail around 6-7 years ago, until I configured DMARC and/or DKIM and/or SPF to their liking. As far as I know, they don't do a press release when they update their rules.
I have a perfect score in google postmaster tools on dkim, spf and 0 spam reports. They still send all emails to spam. They will even do this if you are replying to the user who contacted you. Same experience for my friend running an indie festival. These days you pretty much have to alert gmail users by some other means (like if signing up on a website) that they have to check spam and whitelist you since it appears gmail would rather block legit emails than allow a single possible spam through.
That may be so, but you can't control what mail service your recipients use. So whether or not it's a bad idea, it can be your problem. That said I don't agree with OP that self-hosting mail is a bad idea.
Seems to work for many websites. But only if your users aren't giving you money, because it's 50/50 whether they'll use a different email address or give up entirely.
>Always? If emails are not answered you'll usually notice unless you're a Spammer
Means you're not using your email seriously. For example, to send CVs in response to job postings.
I send up to 20 email per day to people who have issues with their package build scripts, and I have no idea whether they ignore me because they stopped using the distro or because mail got dropped.
Now watch the goal post moving at light speed. This site is by business for business. They can't stand self hosting. Saas or bust. No matter how much time you spend demonstrating the opposite the next time someone mentions email they'll get a backlash. It's mind boggling how it plays out the same every single time. But give them a saas that returns the next integer for $19.99/month and that "creator" will be praised for their hard work. :)
At the most you need to use an external service for delivery (usually because you have problems with MS) but you can still run your own server with no difficulties once you do that.
That said, DMARC is required by a lot of people now, so I do not think this particular issue is a problem.
I have been self hosting my my personal email (and for family). Few problems so far other than delivery to MS and I have recently moved a domain I use for work email over.
Oddly enough the MS problems come from hotmail, but not other services. If that is a problem, then pay a bit to have email delivered.
It's not enough. I have a domain that I had a very long time but it is on an undesirable tld. I got it long before it was problematic. Outlook always puts my mail in the SPAM folder even though I have done everything I could. I even deliver through a trusted provider. Not on any spam list. DMARC, DKIM, SPF all set up. No dice.
I kind of have to agree. DMARC is not new. It's useful and helps make email safer. It's not even hard to set up. There's just no reason for any legitimate mail provider not to use it. Same for people who are technical enough to run their own mail servers.
"Lazy people"? I only heard about this because a customer complained. Am I supposed to go around the Internet, checking what each mail server will allow or deny?
This seems overly dismissive especially for individuals who send emails from custom domains at low volumes. DMARC has previously been seen to only be really needed for high-volume senders. The mail testing service linked still gives 10/10 for emails received without DMARC (but with SPF and DKIK). My email is setup via Fastmail and I followed all the recommendations they provided (which didn’t include DMARC)
Imagine that I deploy a site in HTTP-only, without TLS, and then complain "hey, why are browsers claiming that my site is insecure and showing some red padlock shenanigan, scaring my users away? Am I supposed to go around the Internet, checking what each browser considers 'secure' or not?"
I just tried this out now with an email from my personal domain that I have configured to send via my gmail account. I got a 10/10, but DMARC does not seem to be required for this. It shows a yellow checkbox for me on this, the same as it shows for me not having an unsubscribe button, which hardly gives the impression of it being necessary, given that I would not expect an unsubscribe button to make sense for most people manually sending emails to their customers from corporate email accounts.
The funny thing is, my domain with Fastmail gets 10/10 and I didn't have a DMARC policy configured. So you're being dismissive when you don't even know what you're talking about.
To be fair, DMARC has been required for a very long time. IIRC Google warned about 2 years ago circa that non-compliant emails would land in spam or be null-routed. And the DMARC noise started even before that.
Gmail only requires DMARC for senders that send >5000 emails per day. Below that it's not required. That rule only appeared in 2024 so I wouldn't say it's been required for a very long time. Perhaps you're thinking of DKIM, which is different.
Google required me to add a DMARC record for a domain that doesn't even send 5000 emails per year. I suspect it was because of another mail server that shared the same subnet but was not under my direct control.
You don't have to, this is the key reason to have a DMARC monitoring service. It will tell you when there's a deliverability issue with some particular receiver.
DMARC applies not on your mail server, inbound or outbound, but on the server that is receiving your mail (which may in fact be your mail server).
That server will look at how the mail authenticates and decide if it should allow the mail to proceed, it (for the most part) will then tell you whether or not it allowed the mail. This is how you will know you might have a deliverability problem before your customers do.
> You don't have to, this is the key reason to have a DMARC monitoring service. It will tell you when there's a deliverability issue with some particular receiver.
It's been a while, but monitoring DMARC seemed pointless once you got things started. If my outbound mail fails to validate, I've asked the receivers to bounce it, and I should be able to see that on my own system.
Otherwise, I'm just getting reports about spoofed spam or people who need to adjust their mail forwarding, but I can't do anything about either.
right, if you're at a reject status DMARC monitoring is (and should be) boring.
But it provides a safe guard against accidentally broken mail flows as your email stack evolves over time which is where it pays dividends.
I would love to say that it would have alerted you ahead of time to this particular event, but given that it's the fix here you would never have seen it.
If running a mail server is central to your business, you should keep up with best practices. If not, 2 days of non-delivery aren't important, just resend.
As a company we realised about 12 months ago that email can no longer be considered a reliable method of communication. I understand the reasoning but the result is the result. Many new clients we deal with have whitelists on and we have to pester our clients to add us to their lists. Not a great experience for anyone. I think we should consider email pretty much moribund at this point.
It is literally one of the last free and open channels on the Internet – I suggest you work on supporting its use and keeping it that way rather than moving to something controlled for profit or data harvesting.
It being free and open is exactly what the big providers can't stand and why they are coming up with ever more "standards" that are complex to configure as well as "reputation" scores that are hard for small senders to clear.
Also why they do non-standard stuff like accepting mail but then simply not delivering it, rather than bouncing it.
"Reputation scores" and blacklists / greylists started in late 1990s / early 2000s as multiple grassroots efforts when spam started to overwhelm systems. Gmail did not exist, outlook.com did not exist, it was easy and expected to run your own SMTP (which I did). And it was very unpleasant.
DMARC appeared 10 if not 15 years ago. There's no reason for a sane MTA configuration not to have it.
Calling it a "free and open channel" when 80% of consumers are on Microsoft/Google addresses that control who can deliver e-mail is laughable. It's dead, Jim.
It can be reliable, but requires an explicit agreement between the two parties. When my server connects to your server and sends a message, that part is reliable enough. If your server decides to delete the message after receiving it, that's entirely on you. You could configure it to never delete messages from me and then it's fine. The problem is that in reality nobody does this, so your vendors and customers get treated identically to random spammers.
Strengthen your contracts / terms of service. Make it their responsibility to configure their email systems properly so they receive emails sent from your domains.
If reliable means the message gets through no matter what, then it's good that no channel is reliable. Such a channel will inevitably be used for spam and attention grabbing.
Delivery to Microsoft's products has been patchy for several years. I am not remotely an email deliverability expert but I have made different SMTP service choices based on how companies approach shared-IP sending plans.
Some can affordably deliver to Microsoft because they aggressively police what they are actually sending on their customers' behalf; others don't get involved and you end up having to spend a fortune on a dedicated IP.
The DMARC thing is just another part of this; one of my clients discovered this silent failure themselves a few weeks back and addressed this.
Hey now, it's not just lazy people, some people set up a mail server twenty to thirty years ago and don't care about all that newfangled tech like DMARC or DANE or IMAPv4.
Too many companies run on incredibly frail email configurations (while at the same time asserting that an hour of downtime on their email is a catastrophic business risk).
Configuring your SPF wrong but everything still sort of working because DMARC doesn't explicityly say anything can be a feature. I guess the time may have finally come for those companies to pay decades of technical debt.
DMARC is a DNS record that says "send emails about spoofed messages here", or optionally "I don't need you to tell me that scammers exist on the internet".
It doesn't prevent spoofing, it doesn't say which IPs are authorized to send on behalf of a domain, it doesn't sign messages. Spoofed messages are still sendable.
Can you explain the benefit of only accepting email if Microsoft knows that you may or may not accept emails about scammers unsuccessfully spoofing your email domain? (Note, there's nothing you can do if they do tell you.)
Don't confuse DMARC with DKIM or SPF; DMARC doesn't actually do anything for email security.
> Don't confuse DMARC with DKIM or SPF; DMARC doesn't actually do anything for email security.
DMARC doesn't introduce a new security mechanism by itself, but it fixed a few bad security flaws in SPF and DKIM. Without DMARC, SPF and DKIM do not add meaningful security.
DMARC updated and formalized how receivers should handle authorization and authentication of inbound email by adding the alignment requirement. Alignment ties the SPF and/or DKIM domain to the rfc5322.From domain. This also allows receivers to use domain reputation rather than IP-reputation.
SPF by itself has a bad design flaw that completely breaks any security that SPF was supposed to provide. By adding DMARC this security hole is fixed. (Although SPF is still horribly unreliable, it should be considered legacy at this point, don't rely on SPF).
DKIM benefits from DMARC alignment requirement too. DMARC ties the rfc5322.From domain to the DKIM signing domain, which makes DKIM practical for sender authorization, not just authentication.
That is not true. Reports are just one of the features of DMARC. The policy which allows you to instruct senders what to do with unauthenticated emails is the much more relevant part an when the receiver follows it, it very much does prevent spoofing.
And what should a provider do if the dmarc policy says that none of the dkim or dmarc records should matter? What was the point of spf saying what servers could send, or dkim specifying signing keys?
"Oh, please, don't ignore the other two ways I told you to ignore unauthorized messages" shouldn't need a knob.
You get an email without a DKIM signature from me.
Is that because I do not use DKIM and do not sign my emails or because the message is forged and not from me at all?
You cannot tell. There is a single SPF record that you can look up to see if SPF is configured. It's just a TXT record on the domain. But there is no standard DKIM record. A DKIM signed email tells you what key identifier it used and you have to use that to look up the DKIM key at <key identifier>._domainkey.<sender domain>. When the email has no DKIM signature you cannot tell if that's because the sender domain does not use DKIM or if it does have a DKIM key record but it was not used, potentially because the email is forged.
You'll have a bad time if you just drop all emails without DKIM. There are many large senders that do not care about well established email standards and you will drop important emails.
You said DMARC does not prevent email forgery. I simply corrected you on that and explained what DMARC does.
Setting a DMARC policy that allows unsigned emails is easier than configuring DMARC signing including key management. It's just adding a DNS record. Although large senders should of course do DKIM and it's not that hard either
But I'm not arguing with you about whatever Outlook did.
> so tell me what benefits that has over having no dmarc record at all ?
The the existence of a DMARC assertion record in the DNS changes how the MTA (the receiving system) assesses the authentication of the message and authorization of the sender with SPF and/or DKIM, as per rfc7489 (and now also rfc9989).
No DMARC results in the MTA falling back to the original assessment method as defined in the original SPF and DKIM RFCs. These RFCs have design flaws and don't define the assessment flow all that well, they leave a lot up to the MTA's digression/interpretation.
So, the existence of a DMARC record with p=none is fundamentally different over not publishing a DMARC assertion record at all. It's just that with p=none you don't enforce the MTA to reject the email if it fails authentication/authorization, you're leaving it up to the MTAs digression.
I have MCP servers for the creation of domains, DNS records with DNSSEC, and email accounts with SPF, DKIM and DMARC. I'm sure if someone wants to be a professional spammer today, DMARC is not a differentiator.
It's an interesting argument. The fact this article exists is somewhat proof that it is a differentiator. The flipside, however, is that spammers very specifically require their emails to get to add many mailboxes as possible, so their motivation is greater to make their emails service compatible.
Company sys admins have likely got all sorts of other issues to worry about, and the occasional report of an email not getting through is likely low on their to-investigate list.
Having said that, I self host a mail server, and have all those things setup correctly, and my workplace uses Outlook, and I've not had issues with delivery, so it's not a particularly difficult bar to jump.
What? How does it prove it's a differentiator for someone who wants to be a spammer, which is what the comment you replied to made a claim about? As far as I can tell, it's evidence (not proof) that Microsoft thinks that they will reduce spam by requiring it, which in turn is circumstantial evidence (definitely not proof) that spammers might have to spend some amount of effort to start using DMARC. I don't understand how you can conclude that it would be onerous for them to do so indefinitely; it seems equally plausible that they might have just not bothered to do it before now but will be able to start doing it without much cost.
This was my second hackernews submit [0]! So, not even https in 2014 :)
When I ran that server, outlook.com was also the only one that would blackhole my email for no known reason. Support was unhelpful and also could not point to any reason. I've since given up, but for a short time it was glorious, email to family would not leave the lan and we could send attachments of arbitrary size.
You adopted it the moment it was announced? Really?
Is there a risk some people on this thread are mixing up DKIM and DMARC?
DKIM = proving that an email was sent from a specific domain using cryptography. Good for spam fighting and deliverability.
DMARC = telling receivers how to handle mail that fails authentication.
DMARC is primarily useful for large, complex organizations where email admins may not be aware of everyone inside the org who is sending mail that advertises the domain in the From header, or organizations that might be targeted by impersonation attacks (e.g. phishing). Being able to tell recipients "yes we absolutely have our act together so feel free to reject or spamfolder unauthenticated email" is great for killing phishing campaigns, and being able to request reports is great for finding that one sales org that signed up for a guerrilla marketing SaaS that's impersonating them.
But for small personal domains the value isn't that high.
I added DMARC and DKIM together, around the same time as some particular life events 10 years ago. Just now, I cross-checked the information against the commits in my Git repos.
Back then, I didn’t use Terraform or anything like that, but I had text files with logs that described the DNS setup in detail so I could fix things. By grepping through the logs, I’m able to put a definitive bound on when I added DMARC—it was no later than June 2016, over 10 years ago.
At the time I thought, “Obviously, we should all be setting this up, because recipients will start rejecting mail from insecure domains, if they don’t already.” This was also back when I self-hosted email. I eventually stopped doing that because I thought it was too time-consuming.
>DMARC is primarily useful for large, complex organizations
>But for small personal domains the value isn't that high.
I don't understand the resistance. It benefits the entire mail ecosystem, not just mass senders.
SPF used to be niche thing, then everyone realised it's a good idea and it became more-or-less mandatory. Same with DKIM. Now it has happened to DMARC as well.
No DMARC is about telling receivers which of SPF/DKIM are valid, what to do with it when it fails, and where to send a report to. Oh look.. like Mike said.
DMARC is primarily about "alignment" (switching SPF from caring about the envelope sender to instead using the from header). Yes, it does also tangentially address those other points, but the primary reason it was adopted was to prevent spoofing of from headers (where in original spf that was a non-goal)
Outlook.com has quietly dropped[0] emails from certain domains/IPs for years, even with SPF/DKIM/DMARC all properly set up and no history of spam. As someone who's administering their own mail server, Outlook has been the bane of my existence.
[0]: As in: They accepted the email just fine (according to the logs) but it still didn't end up in the recipient's mailbox.
"Quietly" in the title is an AI slopspam pattern. It's an over-used teenager hyperbolic crutch word on par with "literally", "actually", "honestly" and similar.
Sometimes it's use is appropriate, but not in this case. Microsoft announced this change loudly, multiple times, starting more than a year ago. I seem to recall one of those announcements being discussed here on HN. Even the article links to it's own previous announcements, so "quietly" here is stupid rage bait to justify a blogspam advert.
I actually totally agree with this. There's too much risk involved with scams disguised as legitimate services because the developers of said service couldn't be bothered to add 1 or 2 dns records.
Although there seems that there hasn't been any communication which is the bad thing here. However, nobody looks at those and sending detailed emails back seems like a good enough solution.
Unfortunately, the people abusing these are very persistent and adding more checks will just increase the sophistication of such attacks which works against the interests of the target.
This stops disguising yourself as a legitimate service.
I don't know what "v=DMARC1; p=none;" is proving to anyone when DKIM and SPF are already aligned but sure whatever. Just wish they'd given some warning!
Agreed. There's no additional verity provided by adding a DNS record with a static line of text. Reminds me of airport security theater: meaningless hoops for citizens to jump thru under the guise of stopping bad actors.
I thought they've been doing this for years, along with gmail/etc. I basically just added setting up the correct DNS records as part of business when sending emails externally.
This is interesting. At some point, I think it'll be desirable to give increasing positive weight to emails with the DPF/DKIM/DMARC trifecta configured, since those are least likely to be problem emails (spam or phishing), but I wonder what the best avenue is to actually make that the default. It's almost certainly not this kind of unannounced cutoff.
Email is, I think, among the most distributed popular online services, and there's a ton of stuff that's legacy, self-managed, or otherwise janky. Supporting SPF, DKIM, and DMARC does put a burden on independent operators, but is it an undue or unreasonable one in the current landscape? Or is it just the new cost of doing business?
It seems like 90% of the spam I receive (on my google account) is sent from google addresses, so it will have valid SPF/DKIM/DMARC setup.
That said checking for these things is a good idea, the only problem I see is dropping the mail on the floor, rather than rejecting it at SMTP time - at least that lets the self-hosting users who haven't got things configured know their email is being rejected, and to pick up the phone instead.
There's nothing worse than sending an email, it being accepted, and then later discarded with no clue to either sender or recipient.
My server doesn't reject anyone, but does greylisting. That's a default setting in Postfix. It means the first time an IP address connects it gets a temporary error. If it retries later the message is accepted. That's the only anti-spam measure I have.
Maybe 1 in 5 emails I get is spam, and because I use a different address with every sender I know who sold "my" address to a spam list.
> but is it an undue or unreasonable one in the current landscape
Yes. In the first place, this should not even be a thing. Two corporations should not be in control of who can send e-mail. If they want to mark not having DMARC as spam, mark it as spam, or better yet flag it with a specific warning about the domain, but these games with refusing to deliver are just bullshit and essentially force a monopoly where other e-mail providers cannot compete because their e-mails aren't delivered.
No, not delivering is much better. You get a clean error message that tells you exactly what to do, it can be fixed in minutes. Spamfoldering email for not having DMARC would be a mistake, it might be years before low volume senders notice and figure out what's wrong (if they ever do).
> You get a clean error message that tells you exactly what to do
We are literally talking about a situation where this is not happening! And the problem is that it's not just this. Once you give them a license to police e-mail, they start policing e-mail for all kinds of arbitrary and inscrutable reasons. If this were going to be done, it should really be formalized as an industry standard by an independent consortium, not up to the whims of Microsoogle.
> I wonder what the best avenue is to actually make that the default. It's almost certainly not this kind of unannounced cutoff.
En contraire, I think not delivering mail is the fastest way to adoption. People will use an old system for as long as it works. It now does not anymore.
I don't know. I think this disenfranchises a lot of independent operators, and the blow of that could at least be softened by making a highly-visible public announcement about it a few months ahead of time.
Maybe you're right that just enforcing it is the way, but I don't agree with doing that with no heads up.
Most spam I get is from Google, Microsoft and Amazon. We should pressure those to start dealing with the problem. Right now they are conveniently ignoring it.
None of them are a good 'Is this spam?' heuristic, though. All they do is ensure the sending domain isn't forged, but most spam, even phishing emails, doesn't really rely on that. Spammers are much more motivated than average to jump through the hoops necessary to set it up, as well. Any anti-spam signal needs to be much more expensive for spammers than regular senders.
Requiring HTTPS was very unreasonable. You have so many more moving parts that can go wrong, and a business relationship with a CA (even if it's Let's Encrypt). We only tolerate this because the alternative is worse.
You can literally just Google a 3 step guide for any provider. What are you even arguing? That security for infra shouldn't be a thing? Should grandma be able to run a mail server? What's your point?
I'm arguing that with a system as distributed as email, there will certainly be people who won't do this upgrade; I'm highlighting the contrast between the need for this set of technologies (SPF, DKIM, DMARC) and the utility of an old-school open web where the barrier to entry is low and anyone can participate.
We have seen a massive erosion of the latter aspect of the web in the past few years, and I think it's useful to frame conversations in terms of that loss. The web used to be fun, and now it's become, more than ever, a professional enterprise. You often can't stand up a website without having to buy into Cloudflare's DDoS protection or something equivalent. I think this is absurd, and it's not the only such case, though these changes are obviously reactions to how usage of the web's evolved over the years.
I wonder if we can get the old web back in some way, shape, or form, cause I think we've lost something with the corporatization of the internet.
And for what it's worth, yeah, I think grandma should be able to run a mail server. Why not?
It's perfectly doable for a hobbyist to set up email authentication properly. It requires some effort, sure, but it's not so hard it prevents you from running your own email server.
Well, if we can get a more relaxed email self hosting experience with the DMARC enforcement, I'd say it is a good trade-off in exchange with freedom of speech, rather than accepting the risk of spamming.
These days, hosting a proper mail server isn't really that hard, thanks to Stalwart https://stalw.art/. I did it to my Talos Linux cluster located on LA and utilizing idle resources. It is pretty great
I self-host my email system and rarely send any outbound email. Occasionally I receive emails from individual users. Users on Microsoft’s email service can send emails to me, but my replies are rejected outright. This doesn’t happen with Gmail or other email providers.
The only mistake people make here is to accept that the problem is on their end even after Microsoft has accepted the e-mail but silently discarded it. This leads to the customer impression that the mistake happens on their end and not on Microsoft's.
When I see in my logs that the e-mail has been successfully delivered to their MTA then I don't have a problem.
Yep. Let's say for example you were sending a legally important email saying you did something, and your customer tried to sue you over not sending the email. If you sent it and the customer's agent (Microsoft) dropped it, that's a problem between the customer and their agent, and you are not liable.
(If this happens to you, don't admit that you know Microsoft drops your emails, or you'll be liable again!)
the problem is Gmail accepting emails from domains that have no MX records!
Even lazy spammers, who didn't even bother to create MX records for their fake, auto-generated domain, are getting into Gmail (Spam folder mostly, yet, why not reject it entirely?)
Since yesterday my email started getting blocked. Does anyone know what's going on ?
5.4.1 smtp; 550 5.4.1 Recipient address rejected: Access denied.
For more information see https://aka.ms/…ors
<redacted>.eurprd02.prod.outlook.com 2026-11-08T19:48:58.651Z <redacted>]
Check blocklists for your domain and IP address (and many ASN if you're sending to certain MS servers). The DMARC change has a specific error message ("Message lacks SPF/DKIM/DMARC Auth Records").
Or whoever you're emailing has blocked you for some reason; perhaps your email was marked as spam before, or you/your mail server/your automated tooling has ignored bounces and has crossed a mail server threshold.
On an unrelated but frustrating "silent behaviour" note, I hate how Outlook rewrites URLs to add their "safe links" domain indirection. Just show me the damn raw URL!
I had an email server and configured everything by the book. Still some scammer were able to send emails which looked like they came from me, so i got responds back.
That's what DMARC and DKIM can help with. If you have `p=reject` then anything failing your DKIM check will be rejected by the recipient mail server (if it supports DMARC)
My first thought as well: how does one quietly reject email? Skimmed the comments and clearly it's not quietly. Saved a click...
It's quiet only if the server accepts it and then deletes it on their end without notifying the sender, but if your mail provider shreds your mail that's then also your provider's responsibility and not the sender's
Lots of big email services do quietly reject mail. They successfully accept it but then throw it away (sometimes not even in the spam folder for particularly high span scores).
That's their issue. Don't be a customer at such an email provider :shrug:
I had a legal dispute once where a shop didn't provide warranty on a product. They took the product in but then it was indefinitely in repair. Long story short, it ended up being helpful that I have email server logs that show every transaction, so that I could say "on date+time the email was delivered to IP address X, which was registered as the mail exchanger for your domain, and your server took the email with status code XYZ Queued <ID> For Delivery." Would have been interesting to hear what a judge has to say about it but they simply agreed to give the full purchase price back after that
Afaik that's not what Microsoft/Hotmail does though: since it rejects noncompliant setups (as well as a lot of legitimate email, unfortunately), the sender gets a delivery failure notification
Replying to all inbound messages with a bounce is an old idea. The theory was that legitimate senders would validate their address and get added to a white list. The scheme didn't work for the same reason captchas don't work.
Maybe an old idea and you can feel about it however you want, but it's still in universal use right? So it's not quiet or am I misunderstanding what you're saying?
I have the opposite problem. I have a 3-letter email address, so for ease of giving out the email address, I use it, while having it forwarded to my Gmail. Somewhere around 2019, emails from legitimate services, especially password reset/OTP codes, stopped landing in my inbox or even junk because my address is so high up the chain of spammers. Nebula was the first to confirm this for me and work out of band to re-enable access to my account - their emails to me were bouncing. But ever since that happened, I’ve slowly moved back to giving my Gmail.
"ARC was devised to solve this problem by giving intermediate servers a way to sign the original message's validation results. Even if the SPF and DKIM validation fail, the receiving service can choose to validate the ARC chain. If it indicates that the original message passed the SPF and DKIM checks, and the only modifications were made by intermediaries trusted by the receiving service, the receiving service may choose to accept the email."
It sounds like Gmail is seeing 3000 emails a day coming from foo@bar.com, some of which are different kinds of spam, and reasonably concludes they are a spammer.
I have a bunch of email accounts which have SPF and DKIM, but are missing the DMARC line - I've had no deliverability problems at all, until this weekend, and now only with Outlook. Emails to Gmail accounts go through just fine.
The combination of:
√ Valid SPF
√ Valid DKIM signature
X Missing DMARC policy
Is clearly ambiguous. Since a DMARC of "p=none" (in the context of valid SPF and DKIM) really adds no information, so interpreting "missing DMARC" as "p=none" seems reasonable. Sounds like Microsoft was taking that approach until this weekend.
Under RFC 7489 [1], a domain with no DMARC record simply has no DMARC policy, the receiver is able to enforce whatever policy it likes.
Most receivers have chosen to treat this as p=none for the last decade (Microsoft included). This is changing to now so that mail with no record is simply refused. Nothing in the standard prohibits this.
a DMARC of p=none might be seen as ambiguous - SPF and DKIM have their own jobs and they work. However, the point of DMARC is not a new way of enforcing mail authentication. Instead it is a way of making certain that the mail is internally consistent and furthermore provides two additional things.
1. it indicates if the domain owner has thoroughly gotten their mail to authenticate (in which case they adopt a p=reject), and
2. it provides a feedback mechanism that allows the domain owner to know if they are seeing authentication and deliverability problems in such a way that they can fix those broken mail flows.
Googling around this started at least a year ago, but I worked at an MSP 3 years ago when it was first announced and we started getting customers into compliance. This wasn't something out of the blue.
DMARC does basically nothing. Certainly nothing that DKIM doesn't already do. Users just get phished by email that's not in their own company domain but something similar (or even completely random)
This is a good thing for the actual email users. The volume of really obvious “spam” emails were through the roof that it became quite tedious to rescue legit emails. It’s not like setting up DMARC is hard either.
Tangentially-related: Gmail has started sending completely legitimate emails to spam. DMARC/SPF/DKIM (2048 bits) all properly configured of course so there has to be something else that isn't documented.
They have been doing that for years. A long time ago there was a submission here on HN about some Ivy League college urging college applicants to provide something other than a Gmail address because application-related emails (including acceptances!) would frequently not get through.
Started? My Gmail spam filter has been broken for several years now. Extremely obvious spam regularly ends up in the primary inbox and critical, fully legitimate messages get buried in spam. It’s a major reason why I left for another provider.
This has been going on for much longer than stated here - we had domain mismatch issues with outlook going back years and our policy was p=none. They’re very sensitive and mailing lists with forwarding are heavily impacted.
Do you know if it’ll affect my (personal) account? I run everything through a normal Gmail account and have forwarding for incoming email and an alias for outgoing stuff
If you're using Gmail's “Send As” feature to use a different SMTP server for outgoing mail, then yes, you must have a proper DMARC TXT record configured on the domain you send from (even if it's just `v=DMARC1; p=none`).
That's an old announcement about a different change. As far as I can tell this one is completely out of the blue. I'm shocked by the number of people in this thread advocating for spontaneous changes without any warning.
Yes, this is an older announcement from last year. Yahoo and Google did the same at that time.
The failure associated with that announcement is different. It is 5.7.515.
This new failure mode is "5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records (AS9031519)", I haven't seen any formal announcement on my end. The important thing to know about 5.7.1 is that it represents a few different failure modes, the AS9031519 is the important bit and it indicates that the domain lacks a DMARC record.
My mail provider, MXroute, sent me a notification of the issue early yesterday. There is commentary from various DMARC providers (Suped and PowerDMARC). This is a real thing.
It does not matter which host you are using, this has nothing to do with the hosting provider. It has everything to do with having your domain correctly set up on DNS so that anybody receiving mail will know how to authenticate it. Microsoft has apparently advanced a policy that if you don't even try you don't get to send.
IMO this is the right call, I've seen plenty of spoofing attacks where the attacker took advantage of nonexistent policy on non-sending domains. You might think that if you don't have an MX record the domain can't be used to send mail, that is wrong. The MX record only tells others where to send your mail, it says nothing about whether the domain can send mail itself.
The point is to have a DMARC record, setting it to none doesn't really do much of anything for you though. If you really wanted to take advantage of it you will need a DMARC monitoring solution - the market seems to typically price these around $10/month for small-ish domains (though there are a lot of caveats). I'm trying to build a reasonable free option that maybe isn't enough to get a domain to a reject policy, but should be enough for you to maintain a reject policy.
The truth is that there are amply "non-sending" domains out there which ignore DMARC and allow abuse. Stopping the assumption of no policy mean p=none prevents this abuse from persisting.
We have everything we need to define email 2.0 with mandatory security, the problem is all the older installations that support 1.0 that everyone still expects to talk to.
New protocols only solved this by cutting compatibility. Signal can be E2EE because you can't send a message to an email address with it. Email can also be E2EE, but how do you know the recipient supports it?
It shouldn't BE backwards compatible. That's the Microsoft problem. They can't innovate because they have 40 years of legacy holding them back. Email might be the only situation that's worse. I don't want another new layer over the top like DMARC, and I don't want to try to "fix it." It can't be fixed, it's just a bad design.
I want something fundamentally new that doesn't stink of 70's era pre-security thinking.
A group of heavy hitters needs to just form a working group and propose Email 2.0. As long as it's supported by the biggest vendors and companies and they don't go all "IPv6: It's better because it's complicated!" on it people will sign up because it will be able to offer MUCH more in terms of features, usability, security, ease of hosting, etc.
I like Matrix, but I'm not sure it's really a direct email replacement. I think it could become one with sufficient work, but it's not there right now.
I’ve been anticipating something like this for a while; the number of folks who don’t have their email-related DNS settings in order is remarkably high.
And have Microsoft started checking DMARC correctly yet?
We discovered when we set up a third-party to send via Amazon SES with one of our domains at the start of 2025 that Microsoft didn't correctly check DKIM alignment, and would incorrectly fail valid emails. The issue, so far as I could tell at the time, was that if an email had multiple (in our case 2) DKIM signatures, Microsoft's handling seemed to be non-deterministic, sometimes checking one signature, sometimes the other, and sometimes both. Of course, those times when it only checked one signature and that wasn't the one for the sending domain, it would then fail the alignment check, even though there was a perfectly valid and aligned signature right there it had just decided to ignore.
I raised it with Microsoft support at the time, but they were unsurprisingly useless, I think the most constructive thing they said was "just add the Amazon SES IPs to your SPF record", which, uh, no.
In the end, IIRC, we ended up setting up the third party to sign into a 365 email account on our domain we created for them so they could send through MS's infrastructure and avoid all that. So no idea what their DMARC checking is like these days, but I'd assume the same, if not worse.
Deutsche Telekom is a regional monopoly that abuses its position in every possible way. It's like Comcast but even worse. Best thing you can do is forget they exist and if someone really wants to contact you they'll find another way.
I was hit by this twenty minutes ago. I don't disagree with the policy, but I wish my provider had warned me so I could add the headers. I already had DKIM and SPF, but not DMARC.
> That rule is aimed at marketers and bulk senders, and most small businesses rightly assumed it didn't apply to them.
This would be naive. It currently means that Microsoft censors and
decides what you can see in the first place. I do not recall having
given Microsoft such a permission. On the other hand I don't use
Microsoft for email anyway (though, unfortunately, one local university
here does, which is super-annoying. Europe is unable to think strategically
here).
For anyone running their own mail server, Microsoft has an authorization system to let you "authorize" your mail server IPs to talk with Microsoft's mail servers.
It's stupid, but not terribly difficult to set up and authorize.
Like most people who run their own mail, I have had repeated problems with Microsoft in particular, who treats small mail server operators like crap.
This post reminded me that I had gotten some email requesting me to "Re-attest Your Network Access". I went in, clicked a few things, and I'm good for another year or whatever.
Unfortunately, SPF and DKIM become optional once you send enough email for a mail server to trust you. You could've never bothered to update your email to the futuristic year of 2015 and still made your way into every inbox without ever knowing you forgot something.
I suspect that he/she means they runs a mail server and it was up to his customers to comply, but now they’ve had to deal with the fallout from their customers not complying.
The customers have to do it themselves since they control their domains. I recommend doing everything correctly but also understand that this stuff is pretty hard for people just trying to run a small business. But if it makes you happy to feel smug you can carry on assuming.
When you talk about a single entity to single entity connection it can be any protocol. Email, Matrix, WhatsApp, SMS... Discord... Instagram. All of them work especially if you whitelist the other party.
What doesn't work any more is assuming that everyone is using the same thing. Back when email was invented it was the only computer-based communication protocol - I don't remember whether it came before or after USENET - I'm assuming before. If you wanted to send a message to someone you sent it to their email address. Now things aren't so clear.
DMARC is layered across (/is useless without) two other protocols (SPF, DKIM), both of which also require DNS records.. there's no way to DMARC with one record.. unless you're excluding those SPF and DKIM records in your count. You /could/ DMARC with two records: DMARC+SPF, or DMARK+DKIM but it's ill-advised - use all three. (Ignoring host hierarchy/cname delegation, you can have far more records)
MTA-STS is useful (but it's about helping receivers by demanding mail is sent encrypted, not senders with delivery).
BIMI is a pay-to-spam protocol that helps senders, you can add a rule to postfix to mark it as such.
APRF is a draft, and likewise helps senders, not receivers.. not sure why anyone would want to adopt this standard. A little closer to DMARC reports, but sharing PI that you owe no sending server.
Do they literally just need the DMARC record to exist though, or do they need it to actually say something? Do you need DKIM? I found that SPF is very easy but DKIM is a royal pain.
It's possibly yet another issue relating to the long streak of problems seen the recent months by primarily self-hosters trying to reach people and businesses behind Outlook servers. The past few weeks a lot of my e-mails to friends and family using Hotmail have gone missing. All envelopes were OKd by Outlook servers, nothing bounced, e-mails just gone. My setup is clean, my network is clean.
I'm fine with providers imposing some default level of spam protection but as a user I'd like the option to disable it, even better if I can disable it per domain or sender. The old technique of adding the sender to your contacts doesn't work reliably anymore.
"The old technique of adding the sender to your contacts doesn't work reliably anymore."
An Outlook user first reaching out to you, and you replying and including the unique message-ID of their original envelope in your headers, doesn't affect anything either. Absurd. The whole situation is complete dog shit.
They used to just drop all messages from domains not on their whitelist and to get whitelisted you needed to have a Microsoft account and open a support ticket.
"Since November 5, 2026, Microsoft's consumer mail service has been turning away some of the email from domains that don't publish a DMARC record. If your company emails customers, vendors or applicants with outlook.com, hotmail.com, live.com or msn.com addresses, some of that mail may be bouncing right now. Nobody announced it. The fix is one DNS record."
I'm personally seeing this with some email systems I manage - email sent from a domain that has proper SPF and DKIM signatures, but had no DMARC record started bouncing this weekend.
Outlook.com is also rejecting mail based on blocklists that are not public and you essentialy cannot get yourself out. My VPS provider is pretty much entirely blocked and their regular blocklist process says we are golden so nothing to unblock.
Outlook.com and similar are an anathema to email. This is why they tell you not to run a mail server .
On the other hand rejecting domains without dmarc is fine. Just not happy it is silent.
Everybody I know who still runs their email server (you can get Europeans out of Europe, but you can't get Europe out of the Europeans) complains about Microsoft.
I bet Microsoft is single-handedly responsible for 80+% of complaints about email being impossible to host.
In a federated / pseudo-decentralized network, any provider with 10+% of captive users has an outsized leverage on the entire ecosystem. You don't need a monopoly; as long as you have a monopoly on just a few users that others absolutely need to be able to interact with, you can dictate terms to everybody.
Google is no better. It's quite absurd, they even went through the trouble of creating postmaster tools to help you manage your reputation - except that these don't work unless you have fairly high sending rates (I forget, but I think several hundred a day). So essentially they're actively hostile to personal and small business servers.
Google is in fact much worse. Not only is it as hard to send mail to Gmail users, Gmail is a leading producer of spam.
I wish I could just wholesale block gmail.com like people used to do with the early webmail providers.
> I bet Microsoft is single-handedly responsible for 80+% of complaints about email being impossible to host.
They are the reason I dropped self-hosting my mails. They were silently dropping some of my mails depending on the day I sent them. If they were at least sent to the spam folder, it would be easier to communicate with their users. And since a lot of their users are not technical at all, it's complicated to explain them the issue.
Not just email - their identity / SSO system is just as fucked
more like 98%
It's absurd in every way. I was trying to get it to stop spamming maillist traffic. It's impossible. Global level filters enacted as admin to not spam check are ignored.
Don't forget Google! Gmail will hide your email for no reason no matter what you configure on Gmail's side of things. At least Microsoft has a "please remove me from your spam lists" form (that only worked for ipv4 IP addresses last time I tried).
Yahoo were annoying and I'm happy the collapsed solely because of that
Same experience here. We have multiple customers whose servers are in large blocked IP ranges, with seemingly no way to get them delisted. The strange thing is that Microsoft only seems to reject their emails on Hotmail/Outlook.com accounts (free accounts), while accepting them just fine on business accounts. Meanwhile, their “support” tools tell you there’s nothing wrong.
Based on my broad experience, I’d comfortably rank Microsoft as the worst of the major email providers. (I am owner poste.io)
I work at a big company that sends alot of emails. And even we have been put in the "bad bad books of o365 bad list", it's an absolute pain to get yourself out of the office 365 defender (I think it's what they call it now?) meanwhile your customers are complaining they arent receiving emails from you.
Are companies like MailChimp, SendGrid, etc affected the same way?
Yes. I once had issues with emails being rejected by Outlook on MailGun. And it was only Outlook. Had to contact support, they promptly changed my account to another server/IP once I mentioned it was Outlook, sounded like a recurring issue.
Well, your big company should then call M$ out then. E.g., consider you're sending a confirmation e-mail during account registration, then when your server detects that relay is `*.oulook.com` show a warning: 'outlook users most probably will not receive emails from us due to bs policy at microsoft. consider using a different email provider.'
Yes, that may turn some users away, but they would complain and leave anyway, because they don't receive emails from your server. On the other hand, that's how one can contribute to unwinding ms's share of email accounts.
Think about what you're saying: someone is near the top of the sales funnel and despite the odds you've convinced them to provide their email so you can start the process of trying to convert. Even if you are good you'll still lose 80% of people from this point before you see a single dollar. Now, inject some extra weird, sketchy-sounding friction AND ask them to change their email provider, something 99% of employees never think about let alone control. Not sure how old you are but you'd have better luck convincing users "this site works best in IE4".
Right, letting users frustrate silently, without explaining to them why they don't receive correspondence is the way to go. Discussing my age/gender/race isn't productive either. Dont rage, just pay attention to what's written. I only suggest them to select a different e-mail for better experience, not reqiring it. And the actual wording of this suggestion should always be developed in collaboration with company's layers and marketing teams.
Email delivery for enterprise accounts has always been more lenient, the assumption being that enterprises do have their own mail filtering software.
outlook.com and O365 are horrible to deliver to. We regularly get issues where we sent an email it was accepted by O365 but was never delivered to the mailbox. We have one person working at least half the time on resolving stuff like that. And that's from a respectably maintained SES egress with good reputation, DMARC, DKIM configured.
There is a trick. Sign up with them, configure custom domain, but don’t set your MX records. On your MTA, route mail that goes to Outlook/Hotmail to go through their MSA with your Outlook credentials and headers stripped as if submitted directly by user. Outlook gets mail through their own MSA it trusts, rest of the world talks to your mail system directly. Replies still go to your MXes.
I haven’t productionized this setup (I send maybe a dozen emails a year) but it worked for me ad hoc a couple years back, when I had to send a mail to an Outlook-hosted address and they blackholed everything I tried to send while 250 OKing me.
The problem with this setup is that if I want to send email to fred@example.com and example.com is actually handled by Outlook, I need to somehow know beforehand that email to example.com needs that special routing. Or do you just route ALL your outbound email through Outlooks MSA?
You can usually figure that out by checking the MX records (though some spam filtering middlemen might make that hard to detect) and TXT records (if a domain imports Outlook's SPF list, it's probably on Outlook in the back).
Pretty easy to tell whether example.com uses outlook; it'll have MX records pointing there.
Great idea
I have a small client with a large email list who wants to switch from once a month constant contact newsletters to sending them through SES with a self-hosted Sendy instance. This seemed like a reasonable way to save $10k a year or so. I haven't used SES before for anything. I have run an email server for 30 years and had occasional blacklist headaches, but it's not used for mass mailing of that sort... it's usually several years between problems. Is this a terrible idea to switch, even if it's off a "managed" SES dedicated IP? I don't want to switch them and find out no one on Outlook is getting their mail.
What's the nature of your operation? If they're not giving you money then you're within your rights to say "sorry, don't use outlook"
Our customers are giving us lots of money. And the nature of the emails are account reminders, activation and internal message notifications.
Usually they are giving you money...
I ran a SaaS up until recently. Emailing users notifications for events was just a normal part of the app. Users got upset when the emails didn't come through. So then I had to be email tech support for something I had no control over. Lovely.
Funny, they have no problem handling mail for essentially every Fortune 500 company and others large and small.
It's always people self-hosting mail on a shared server in Moldova (because they think it makes them cool) that are complaining.
Self hosting mail on a shared server in Moldova is basically the entire idea behind email (and the internet).
Which with cheap models like Jev as spam classifiers, this can now become a reality.
The problem is, Google and Microsoft have monopolized the entire email market, so their esoteric deliverability mysticism from 2007 still persists (basically blanket bans on entire IP spaces, locking out anybody trying to send emails on their own).
People used to have party lines and leave their doors unlocked too, but it turns out the world is filled with bad actors and other assorted shitty people.
Email naturally followed this evolution.
The problem isn't that a random person can't rent a Moldova VPS and run an email server, though. It's that most people are forced into gmail, apple and outlook accounts if they want to use phone/PC, and a respectful Moldova company now can't reach their respective Moldova clients without paying money towards USA.
Switch Moldova to almost any country (or even a state that isn't California or Washington), and it's the same story everywhere
So naturally everyone should just leave e-mail to be run by all the corporations.
You shouldn't own your car or your house, give them to all the corporations as well.
You might be on to something with the car thing... Maybe most people should rely on public transit.
Nothing is stopping you and your three friends from running your own SMTP servers and emailing each other.
As soon as you want to do business with Outlook's customers, you play by their rules.
This is one thing I find more on Hacker News than most other discussion sites. Any topic about annoying or bad behaviour by corporations eventually devolves to "they're allowed to do it".
"They're allowed to do it" is one of those things that doesn't really bear saying so much because that's already been implicitly established. Nobody is claiming what they're doing is illegal, so how does this add anything of value? Who is still unaware that corporations will use their size and market control to their benefit?
> As soon as you want to do business with Outlook's customers, you play by their rules.
"Their rules" seems to be turning into "you spend money to another corporation that we trust".
Some of us still leave our doors unlocked, too.
I've never even had the key to mine. I've lived here over a decade.
> Which with cheap models like Jev as spam classifiers, this can now become a reality.
With LLMs on the other side trying to make spam less detectable by cheap models like Jev?
It's funny when people assume benefits from some tech go one way and baddies will surely never use it...
Nope, people self-hosting mail on their own hardware from their own basement in Serbia ;)
https://www.mimar.rs/blog/a-journey-of-my-mx-server-to-new-r...
And yes, it's cool not to have to let scum read your private communications :D
Err we are part of a Fortune 500 and we can't even deliver to ourselves sometimes.
Maybe because every Fortune 500 company (and 99% of all large companies / orgs worldwide) uses O365 / Exchange / GSuite?
> Outlook.com and similar are an anathema to email. This is why they tell you not to run a mail server .
It should be the other way around though.. More people should run their own mail servers so that centralized players cannot control what should be a decentralized communication protocol.
I had experience implementing and debugging mail delivery, so when I chose to run my own server I just opted for a SMTP relay, and never had an issue. I don't know why this isn't the recommended default solution.
I've had several times where mail from custom domains associated with a business were delivered hours late by Outlook. Time sensitive emails. A guy coming to my office for a meeting called me and said he was downstairs and having an issue with security. Went down and swiped him in.
Four hours later, I got the same message by email. I thought he was back - nope. An email sent at 10am that was delivered at 4pm showed it was from 2pm until I looked at the header and saw sent at 10am and just... chilling out for 4 hours. DMARC was set up for them just fine.
I've had the same issue with my own custom domain, with DMARC set up. A year later, it finally got bumped up to some sort of "trusted" domain for that one place and my emails get delivered the same day now.
Got a similar issues with outlook. Emails from some websites were delayed by several hours.
Mildly infuriating for emails containing OTP codes "valid for 10 minutes".
Is it SNDS (https://substrate.office.com/ip-domain-management-snds/snds) you refer to as their regular blocklist process?
yeah I see it for them being a problem too if they are not accepting legitimate email. I might be a bit stubborn here but I refuse to give them the monopoly and self host our email anyway. I just wish more people would join this fight
Pretty sure this or part of this just burned me. Icing on the cake is Nintendo will also ban hammer your email if it rejects some or all of their emails - including their dumptruck of marketing junk. The only and I mean only resolution to this is to basically move your Nintendo account to a different email completely. Absolutely unreal on both sides.
Yes, no one should not have DKIM or DMARC but holy yikes when neither side wants to actually give in to help the customer.
I was viciously mean in my communication with the Outlook team when they said they “couldn’t” remove me from the blocklist. I pointed out that, as the operator of a perfectly compliant secure server their inability to deliver my mail is a technical failure on their end and one which I will be contacting their supervisor about and they somehow managed to scrabble together the heroic ability to delete my row from a table. Never back down from these bastards.
Which VPS provider out of curiosity?
Maybe don't self-host mail on a shitty $1/month VPS where 99% of the tenants are spammer scum?
This is not Microsoft's fault. The building's on fire and they're locking out the arsonists.
Requiring DMARC may be good, but Outlook's approach is awful.
I was working for Microsoft when outlook.com launched and got a good email address that was my primary for more than a decade.
I had so many issues with things getting silently dropped with no recourse (2FA codes, account recovery mails, etc.) on so many sites that I finally gave up, reversed the stream, and had Outlook forward to GMail instead of vice versa. A few months after that, I realized that all my Outlook got was an enormous volume (hundreds of day) a spam and that all legitimate mail was going to my other accounts, so I turned it off entirely and haven't read that mailbox in over a year.
> I had so many issues with things getting silently dropped with no recourse (2FA codes, account recovery mails, etc.) on so many sites
This is not unique to Microsoft and really the source's problem — they did something to get blocked in the first place.
Add in the fact that you're almost certainly not the only one impacted, and that they have no interest in fixing it, it screams incompetence on the source's part.
Been there, done that, good luck explaining the problem to the app's first-level support in the Philippines because it's not in their script.
> and had Outlook forward to GMail
Till the day GMail hits you with the "We couldn't verify it's you" bullshit and locks you out of your account forever. Good luck getting support from Google, the word is not in their lexicon.
> This is not unique to Microsoft and really the source's problem — they did something to get blocked in the first place.
I've never encountered this issue with GMail. Delivery just works. I'm trying to think of the last false-positive spam flag I've had with GMail, and I've definitely never had mail be entirely dropped.
I've had a lot of that.
> Till the day GMail hits you with the "We couldn't verify it's you" bullshit and locks you out of your account forever. Good luck getting support from Google, the word is not in their lexicon.
This is also true of Microsoft though.
no matter how much you pay for VPS or which cloud you use you'd get same treatment
Stop being so ignorant
Some hosting providers are known for not caring about the activities of their customers, but in general, how would I know that the other tenants are scum?
I have access to a fairly large dataset of known bad hosting providers, but most people don't. So how do you tell the difference between getting a good deal and "this is cheap because it's sketchy as all hell".
We also don't block all of Vietnam, or all Jio customers in India, even if we know that 20% of bot traffic is from those two alone.
> This is not Microsoft's fault.
Wait until this guy realizes that all spam these days comes from Azure ASNs, and abuses cross-tenant issues as well as a simple "Fwd: ..." and "Re: ..." tricks to bypass Microsoft Outlook spam filters.
> Outlook.com and similar are an anathema to email. This is why they tell you not to run a mail server .
It turns out that whoever has the most power is the most powerful. This is why distributed/decentralized systems cannot singlehandedly free us from tyranny, and why I find people who spend all their time preaching decentralized systems to be quite silly. We don't need better systems (well maybe we do but,,,), we need better education and awareness of how billionaires manipulate us; this goes beyond software.
Complain all you want about the monopolists, and I do think you're right to do so, but a lot of their power comes from and is aimed at defeating the overwhelming flood of spam.
Mail, then emails, then home phones, then cell phones, then texts, then social media have been gradually rendered less and less usable by bad actors systematically abusing every single tool we try to use to communicate with one another to steal from us, lie to us, and manipulate our beliefs, and we'll just keep inventing and discarding new ways of communicating until we reckon with this.
With cheaper AI classification models coming out every day now, the spam problem is on the cusp of basically being solved in every communication channel.
The only question is how many years the lazy network-effects monopolies (like Google, Microsoft, Verizon, etc) will hold this back from happening.
The optimist in me says this will unlock pathways to true decentralization of push communication protocols (like SMTP) instead of only have decentralization of pull-oriented protocols (like HTTP).
On the contrary, with cheaper AI generation the spam problem becomes harder by the day.
The power of defenders is greater than attackers here, because the defenders have more knowledge about what is "normal" for you the user.
classification != generation
Generation is, and always will be, cheaper and easier to do well than classification.
AI becoming faster empowers attackers far more than it empowers defenders. We're seeing this in every discipline and every corner of the software industry.
"Two years from now, spam will be solved." - Bill Gates at the World Economic Forum, in 2004
A bunch of my accounts were hacked a while book and since then my outlook email is getting flooded with spam. I have to give MS credit their spam filter is pretty good.
I'll never pay for email so your options are either outlook or Gmail and I don't trust Google.
I don't think anyone believes it will "singlehandedly free us from tyranny", it's one component for a healthy ecosystem.
Decentralization is not a bulletproof solution. It is a mitigation. Until someone gets 50 percent of market share. Then they can run havoc on the ecosystem with their own customized system.
We could tax billionaires and use the money for a Manhattan Project to stamp out fraud, abuse, and corruption.
But we won't.
>we need better education and awareness of how billionaires manipulate us
So that people would vote for the government to manipulate them instead?
Honestly, I hate outlook as much as you do, but I'd still prefer it to Max
https://en.wikipedia.org/wiki/Max_(app)
Just put codex in a continuous goal loop to keep you off the blacklists...give it whatever email / creds it needs to make the appropriate requests and make the needed changes (ofc tell it the guardrails it should follow).
Selfhosted email is likely easier now than it ever was before.
> give it whatever email / creds it needs
Oh man, please tag me if you're ever the lead on any project so I know to stay far away from it.
Using self hosted email service is a big mistake in 2026.
Why are we so willingly ceding one of the few widely used free and open protocols to a handful of $mega-billion providers?
Experience shows that the walls will get taller and the moats will get deeper.
The irony is that if more people started to self host again, especially jogger companies, the problem like one exemplified by this post would be solved quickly.
Because the noise is so loud now that people are basically just coping with the stresses of work life by taking the easy path in the home life.
Because the protocol is flawed at its foundation - there is no good way to make sure that the person sending you something is a person and sending content you'd want to interact with. If the big providers weren't doing this stuff, we'd whine about the enormous amount of spam.
The solution is allow only communications that are demonstrably not spam and not unwanted.
There have been lots of proposals to this effect but maybe you have to put up two cents in a crypto wallet, which the other person can claim if the mail is unwanted. If someone takes your two cents, you remove them from your lists ASAP. The receiver doesn't benefit meaningfully from the 2c so they are unlikely to claim it. The sender is only damaged if a lot of different people claim the 2 cents. Maybe a few domains are default whitelisted even if they don't put up 2 cents, to protect against entities that are important but would be frequently spite-claimed (IRS, courts, and other similar). If you use a provider that doesn't whitelist, fine, but you're going to miss those emails.
Maybe the top 'spite claim' users are published and it becomes difficult to get people to agree to put up money to talk to you.
This reduces spam to the level of junk mail, which is still not totally trivial but is orders of magnitude more manageable.
> the protocol is flawed at its foundation - there is no good way to make sure that the person sending you something is a person and sending content you'd want to interact with.
There is and it's the same as other protocols including proprietary ones - a sender address whitelist.
There's no proprietary protocol that solved spam either.
Nearly all the spam I get has an email address from those providers.
Seems they are the disease not the cure
I'm the sysadmin at my company and we regularly get emails spoofing our own addresses! It's wild that Microsoft can't even protect customers when they have all the info to do so.
Mine isn't from those email hosts, but it from google cloud or Azure typically (not AWS for whatever reason). Related, the gmail spam filter is terrible.
Most of my spam is from gmail addresses. Why Google hasn't figured out how to stop the fake Norton renewal notices is just mind-boggling.
Lately I've also been getting a lot from compromised MS365 accounts.
>Related, the gmail spam filter is terrible.
It seems insane that gmail doesnt provide a way to automatically send a mail (eg based on domain, keywords, etc) to spam. I know theres block sender but for example aliexpress uses a different name for every email so that's useless.
I think you misunderstand the disease.
What this is called is survivorship bias. The question I would ask is how much mail are you not seeing at all because it's dropped at the edge first thing because it's IP block listed?
Next, how much spam are you seeing from them because they and Google are the largest providers on Earth? Kind of like selecting a random person from the population in the US and going "look, it's a white guy". Yea, that's how statistics works.
Lastly, because the are good at blocking spam at the edge, then that's the last bastion of attack for spammers to put their efforts in if they want any return at all.
I self-host and don't have a spam filter. Spam makes up about 1 in 5 messages I receive. It's always the same spam campaigns that would be easily filtered with a few regexes.
Self-hosting allows me to use a different receiving address for each entity I contact, so I know exactly who put me on spam lists and if it gets bad I can route that address to the garbage bin.
It's been a while since I've been an SMTP server admin but when I was I managed a few hundred thousand mailboxes under different domains. Most likely know one knows about your domain and it has little traffic. On average I saw users domains get around 5 spam to 1 ham. Of course you have outliers. I had one domain that received around 1000 spam to 1 ham. That was a domain that looked like it could belong to a university and it got absolutely flooded.
Anecdotes are not a great thing to run mail servers on, broad statistics are.
Sorry but bastions are defensive.
Spam is a super solved problem though and I'd rather have false negative spam than email oligarchy.
> frequently spite-claimed (IRS, courts, and other similar)
These entities communicate via plain old mail, that costs more than 2 cents already.
why do we cling on to the email protocol at all?
We have dozens of different ways to send E2EE messages to each other, with realtime publish-subscribe, and yet billions of dollars are spent trying to duct tape email. Who cares if Outlook/Gmail/Icloud use IMAP or Websocket? If the interface looks the same to the end user will they really care?
Why are we so willingly ceding one of the few widely used free and open protocols to replace it with incompatible proprietary ones that don't interoperate?
Experience shows that the walls will get taller and the moats will get deeper.
A web forum's users, who love nothing more than using the "flag" button to stomp out comments they don't like, are indignant upon discovering the world's third largest email provider has a "flag" button of their own.
Third? What's second, Yahoo? I know Gmail is first.
Sounds more like using outlook.com is a mistake. I've been running my own mail server for over 20 years and outlook.com is literally the only domain I have had problems with, and this is the only reason that I now send via Scaleway's free transactional email service.
The people working on outlook.com are just talentless amateurs - the rest knows how to do it right. It's a shame it's so widely used.
>I've been running my own mail server for over 20 years and outlook.com is literally the only domain I have had problems with
What about tencent.com, foxmail.com, or qq.com?
I don't disagree, but what are your options when a giant portion of the population uses O365 and outlook.com? How are you going to get them to stop using it, so that legit emails from user-owned servers are not silently rejected?
Most of them wouldn't even care probably...
It depends on the nature of the transaction. If the user needs the email more than you do, you just remind them Outlook deletes your messages, and they'll find a way, and in the long term usage of Outlook will decrease.
I use a sending service. I would prefer not having to, but at least all inbound email goes directly to my server.
I've also been running my own server for over 20 years, but do note that the big players may block their senders from delivering mail to your server. This happened to me with GMail around 6-7 years ago, until I configured DMARC and/or DKIM and/or SPF to their liking. As far as I know, they don't do a press release when they update their rules.
I have a perfect score in google postmaster tools on dkim, spf and 0 spam reports. They still send all emails to spam. They will even do this if you are replying to the user who contacted you. Same experience for my friend running an indie festival. These days you pretty much have to alert gmail users by some other means (like if signing up on a website) that they have to check spam and whitelist you since it appears gmail would rather block legit emails than allow a single possible spam through.
Alt take: Using a Microsoft-hosted email service is a big mistake in 2026...
That may be so, but you can't control what mail service your recipients use. So whether or not it's a bad idea, it can be your problem. That said I don't agree with OP that self-hosting mail is a bad idea.
Yes you can.
User signs up, uses @outlook. Your app declines it and explains that they block with no way to remedy, and explain they are a bad vendor.
Deeply unserious take.
As unserious as you claim, we had this exact problem.
Emails would be accepted by Outlook.com, but would never deliver. We had SPF/DKIM/DMARC and full reporting. They RBL'ed us with no remedy.
We told the customer to not use outlook.com BECAUSE we told them we could not guarantee any delivery of messages.
Seems to work for many websites. But only if your users aren't giving you money, because it's 50/50 whether they'll use a different email address or give up entirely.
Lol if you do that, your service is just going to have a small minority of people and most people will just not bother using your app/service entirely
Most people aren't using Outlook. If your users mostly are, then this solution doesn't work for you. But it does work for many people.
You can take my email server from my cold, dead hands.
Proudly self-hosting since 2001. My mail server is in my basement. Do not know what you are talking about.
How often would you be able to detect acceptance-but-non-delivery of your emails to office.com-hosted emails?
Always? If emails are not answered you'll usually notice unless you're a Spammer
>Always? If emails are not answered you'll usually notice unless you're a Spammer
Means you're not using your email seriously. For example, to send CVs in response to job postings.
I send up to 20 email per day to people who have issues with their package build scripts, and I have no idea whether they ignore me because they stopped using the distro or because mail got dropped.
Does it ever get silently dropped or just filed straight in their spam folder?
Silently dropped in my case.. that’s why I stopped self-hosting. Email hosting is sadly now a cartel
MS live/hotmail/outlook would silently drop - although not for this DMARC, that gets a straight bounce.
> How often would you be able to detect acceptance-but-non-delivery of your emails to office.com-hosted emails?
You should be able to see this on your DMARC dashboard
Now watch the goal post moving at light speed. This site is by business for business. They can't stand self hosting. Saas or bust. No matter how much time you spend demonstrating the opposite the next time someone mentions email they'll get a backlash. It's mind boggling how it plays out the same every single time. But give them a saas that returns the next integer for $19.99/month and that "creator" will be praised for their hard work. :)
This is what google and microsoft want the make you think for obvious reasons.
Fortunate for those running their own servers is that they actually still get all the cool emails from people not complying.
Why?
At the most you need to use an external service for delivery (usually because you have problems with MS) but you can still run your own server with no difficulties once you do that.
That said, DMARC is required by a lot of people now, so I do not think this particular issue is a problem.
I have been self hosting my my personal email (and for family). Few problems so far other than delivery to MS and I have recently moved a domain I use for work email over.
Oddly enough the MS problems come from hotmail, but not other services. If that is a problem, then pay a bit to have email delivered.
It's not enough. I have a domain that I had a very long time but it is on an undesirable tld. I got it long before it was problematic. Outlook always puts my mail in the SPAM folder even though I have done everything I could. I even deliver through a trusted provider. Not on any spam list. DMARC, DKIM, SPF all set up. No dice.
I've never had a problem not having dmarc. DMARC doesn't really mean anything. The security comes from DKIM (or SPF, but that's garbage)
Sounds like something every mail sender should have done already.
Good for Microsoft customers and I don't care one bit for the lazy people who have to late-patch now.
I kind of have to agree. DMARC is not new. It's useful and helps make email safer. It's not even hard to set up. There's just no reason for any legitimate mail provider not to use it. Same for people who are technical enough to run their own mail servers.
"Lazy people"? I only heard about this because a customer complained. Am I supposed to go around the Internet, checking what each mail server will allow or deny?
No. You're supposed to understand how mail works on the Internet, and configure it correctly so that everyone else accepts it.
Go to https://mail-tester.com. Send a test email. If you don't get 10/10, fix your shit.
This seems overly dismissive especially for individuals who send emails from custom domains at low volumes. DMARC has previously been seen to only be really needed for high-volume senders. The mail testing service linked still gives 10/10 for emails received without DMARC (but with SPF and DKIK). My email is setup via Fastmail and I followed all the recommendations they provided (which didn’t include DMARC)
Imagine that I deploy a site in HTTP-only, without TLS, and then complain "hey, why are browsers claiming that my site is insecure and showing some red padlock shenanigan, scaring my users away? Am I supposed to go around the Internet, checking what each browser considers 'secure' or not?"
I just tried this out now with an email from my personal domain that I have configured to send via my gmail account. I got a 10/10, but DMARC does not seem to be required for this. It shows a yellow checkbox for me on this, the same as it shows for me not having an unsubscribe button, which hardly gives the impression of it being necessary, given that I would not expect an unsubscribe button to make sense for most people manually sending emails to their customers from corporate email accounts.
This service is not accurate, it cannot handle multiple dkim keys.
Not enough. O365 still discard/lose e-mails.
The funny thing is, my domain with Fastmail gets 10/10 and I didn't have a DMARC policy configured. So you're being dismissive when you don't even know what you're talking about.
How about you read other testimonials in this thread and dial down your patronizing mouth?
To be fair, DMARC has been required for a very long time. IIRC Google warned about 2 years ago circa that non-compliant emails would land in spam or be null-routed. And the DMARC noise started even before that.
Gmail only requires DMARC for senders that send >5000 emails per day. Below that it's not required. That rule only appeared in 2024 so I wouldn't say it's been required for a very long time. Perhaps you're thinking of DKIM, which is different.
Google required me to add a DMARC record for a domain that doesn't even send 5000 emails per year. I suspect it was because of another mail server that shared the same subnet but was not under my direct control.
You don't have to, this is the key reason to have a DMARC monitoring service. It will tell you when there's a deliverability issue with some particular receiver.
DMARC applies not on your mail server, inbound or outbound, but on the server that is receiving your mail (which may in fact be your mail server).
That server will look at how the mail authenticates and decide if it should allow the mail to proceed, it (for the most part) will then tell you whether or not it allowed the mail. This is how you will know you might have a deliverability problem before your customers do.
If you're wanting to know about deliverability (particularly for this Microsoft case), my company (Alesian Security) has a free check at https://alesiansecurity.com/try?tab=deliverability
> You don't have to, this is the key reason to have a DMARC monitoring service. It will tell you when there's a deliverability issue with some particular receiver.
It's been a while, but monitoring DMARC seemed pointless once you got things started. If my outbound mail fails to validate, I've asked the receivers to bounce it, and I should be able to see that on my own system.
Otherwise, I'm just getting reports about spoofed spam or people who need to adjust their mail forwarding, but I can't do anything about either.
right, if you're at a reject status DMARC monitoring is (and should be) boring.
But it provides a safe guard against accidentally broken mail flows as your email stack evolves over time which is where it pays dividends.
I would love to say that it would have alerted you ahead of time to this particular event, but given that it's the fix here you would never have seen it.
If running a mail server is central to your business, you should keep up with best practices. If not, 2 days of non-delivery aren't important, just resend.
As a company we realised about 12 months ago that email can no longer be considered a reliable method of communication. I understand the reasoning but the result is the result. Many new clients we deal with have whitelists on and we have to pester our clients to add us to their lists. Not a great experience for anyone. I think we should consider email pretty much moribund at this point.
It is literally one of the last free and open channels on the Internet – I suggest you work on supporting its use and keeping it that way rather than moving to something controlled for profit or data harvesting.
It being free and open is exactly what the big providers can't stand and why they are coming up with ever more "standards" that are complex to configure as well as "reputation" scores that are hard for small senders to clear.
Also why they do non-standard stuff like accepting mail but then simply not delivering it, rather than bouncing it.
DMARC is not hard.
"Reputation scores" and blacklists / greylists started in late 1990s / early 2000s as multiple grassroots efforts when spam started to overwhelm systems. Gmail did not exist, outlook.com did not exist, it was easy and expected to run your own SMTP (which I did). And it was very unpleasant.
DMARC appeared 10 if not 15 years ago. There's no reason for a sane MTA configuration not to have it.
Outlook.com is a rebranding of Hotmail.com which absolutely did exist in the 90’s.
Indeed, Hotmail was sold to MS in 1997, which I incorrectly remembered to have happened past 2000.
Microsoft has provided free email addresses to the public for decades.
There is no such thing as a free and open channel on the internet that will not suffer the tragedy of the commons.
Calling it a "free and open channel" when 80% of consumers are on Microsoft/Google addresses that control who can deliver e-mail is laughable. It's dead, Jim.
Fair point - I meant free in the sense that the protocol is open. I didn’t mean that it’s not under threat.
You seem to miss the point WHY customers go there. I, for one, switched when I realized Google filters spam effectively.
That WHY seems to only address a very small slice of the market. Some other WHYs I've encountered
- it was a way to outsource the mail server administration and already free in our corporate package
Which is pretty much all I have from the corporate side. On the personal or small business side its most often
- I don't really care that much about running my own stuff
- I needed a personal email address
All these are valid reasons/motivations but none explicitly argue that email messaging should become proprietary.
It can be reliable, but requires an explicit agreement between the two parties. When my server connects to your server and sends a message, that part is reliable enough. If your server decides to delete the message after receiving it, that's entirely on you. You could configure it to never delete messages from me and then it's fine. The problem is that in reality nobody does this, so your vendors and customers get treated identically to random spammers.
Strengthen your contracts / terms of service. Make it their responsibility to configure their email systems properly so they receive emails sent from your domains.
So what have you switched to instead?
Postal mail still works.
Spoiler alert: no method of communication is reliable anymore. All of them are controlled by companies that will route your messages to spam.
If reliable means the message gets through no matter what, then it's good that no channel is reliable. Such a channel will inevitably be used for spam and attention grabbing.
Delivery to Microsoft's products has been patchy for several years. I am not remotely an email deliverability expert but I have made different SMTP service choices based on how companies approach shared-IP sending plans.
Some can affordably deliver to Microsoft because they aggressively police what they are actually sending on their customers' behalf; others don't get involved and you end up having to spend a fortune on a dedicated IP.
The DMARC thing is just another part of this; one of my clients discovered this silent failure themselves a few weeks back and addressed this.
Hey now, it's not just lazy people, some people set up a mail server twenty to thirty years ago and don't care about all that newfangled tech like DMARC or DANE or IMAPv4.
Too many companies run on incredibly frail email configurations (while at the same time asserting that an hour of downtime on their email is a catastrophic business risk).
Configuring your SPF wrong but everything still sort of working because DMARC doesn't explicityly say anything can be a feature. I guess the time may have finally come for those companies to pay decades of technical debt.
DMARC is a DNS record that says "send emails about spoofed messages here", or optionally "I don't need you to tell me that scammers exist on the internet".
It doesn't prevent spoofing, it doesn't say which IPs are authorized to send on behalf of a domain, it doesn't sign messages. Spoofed messages are still sendable.
Can you explain the benefit of only accepting email if Microsoft knows that you may or may not accept emails about scammers unsuccessfully spoofing your email domain? (Note, there's nothing you can do if they do tell you.)
Don't confuse DMARC with DKIM or SPF; DMARC doesn't actually do anything for email security.
> Don't confuse DMARC with DKIM or SPF; DMARC doesn't actually do anything for email security.
DMARC doesn't introduce a new security mechanism by itself, but it fixed a few bad security flaws in SPF and DKIM. Without DMARC, SPF and DKIM do not add meaningful security.
DMARC updated and formalized how receivers should handle authorization and authentication of inbound email by adding the alignment requirement. Alignment ties the SPF and/or DKIM domain to the rfc5322.From domain. This also allows receivers to use domain reputation rather than IP-reputation.
SPF by itself has a bad design flaw that completely breaks any security that SPF was supposed to provide. By adding DMARC this security hole is fixed. (Although SPF is still horribly unreliable, it should be considered legacy at this point, don't rely on SPF).
DKIM benefits from DMARC alignment requirement too. DMARC ties the rfc5322.From domain to the DKIM signing domain, which makes DKIM practical for sender authorization, not just authentication.
That is not true. Reports are just one of the features of DMARC. The policy which allows you to instruct senders what to do with unauthenticated emails is the much more relevant part an when the receiver follows it, it very much does prevent spoofing.
And what should a provider do if the dmarc policy says that none of the dkim or dmarc records should matter? What was the point of spf saying what servers could send, or dkim specifying signing keys?
"Oh, please, don't ignore the other two ways I told you to ignore unauthorized messages" shouldn't need a knob.
You are a mail server.
You get an email without a DKIM signature from me.
Is that because I do not use DKIM and do not sign my emails or because the message is forged and not from me at all?
You cannot tell. There is a single SPF record that you can look up to see if SPF is configured. It's just a TXT record on the domain. But there is no standard DKIM record. A DKIM signed email tells you what key identifier it used and you have to use that to look up the DKIM key at <key identifier>._domainkey.<sender domain>. When the email has no DKIM signature you cannot tell if that's because the sender domain does not use DKIM or if it does have a DKIM key record but it was not used, potentially because the email is forged.
Right. And if you mandate dkim, as seems to be the case with servers that demand dmarc, what's the issue? You reject the emails where dkim isn't set.
Or do you think it's critical to support mail that doesn't have dkim?
You'll have a bad time if you just drop all emails without DKIM. There are many large senders that do not care about well established email standards and you will drop important emails.
These are the same senders that are correctly configuring DMARC?
You said DMARC does not prevent email forgery. I simply corrected you on that and explained what DMARC does.
Setting a DMARC policy that allows unsigned emails is easier than configuring DMARC signing including key management. It's just adding a DNS record. Although large senders should of course do DKIM and it's not that hard either
But I'm not arguing with you about whatever Outlook did.
DMARC gives you 20 reminders that you have sent an email, just incase you had forgotten.
lol, what a bunch of bs.
gmail runs with p=none
so tell me what benefits that has over having no dmarc record at all ?
> so tell me what benefits that has over having no dmarc record at all ?
The the existence of a DMARC assertion record in the DNS changes how the MTA (the receiving system) assesses the authentication of the message and authorization of the sender with SPF and/or DKIM, as per rfc7489 (and now also rfc9989).
No DMARC results in the MTA falling back to the original assessment method as defined in the original SPF and DKIM RFCs. These RFCs have design flaws and don't define the assessment flow all that well, they leave a lot up to the MTA's digression/interpretation.
So, the existence of a DMARC record with p=none is fundamentally different over not publishing a DMARC assertion record at all. It's just that with p=none you don't enforce the MTA to reject the email if it fails authentication/authorization, you're leaving it up to the MTAs digression.
Yeah, and people who don't switch to Dvorak are lazy, too!
https://ciphercue.com/blog/dmarc-enforcement-gap-rua-fragmen...
https://news.ycombinator.com/item?id=49081783
I have MCP servers for the creation of domains, DNS records with DNSSEC, and email accounts with SPF, DKIM and DMARC. I'm sure if someone wants to be a professional spammer today, DMARC is not a differentiator.
It's an interesting argument. The fact this article exists is somewhat proof that it is a differentiator. The flipside, however, is that spammers very specifically require their emails to get to add many mailboxes as possible, so their motivation is greater to make their emails service compatible.
Company sys admins have likely got all sorts of other issues to worry about, and the occasional report of an email not getting through is likely low on their to-investigate list.
Having said that, I self host a mail server, and have all those things setup correctly, and my workplace uses Outlook, and I've not had issues with delivery, so it's not a particularly difficult bar to jump.
What? How does it prove it's a differentiator for someone who wants to be a spammer, which is what the comment you replied to made a claim about? As far as I can tell, it's evidence (not proof) that Microsoft thinks that they will reduce spam by requiring it, which in turn is circumstantial evidence (definitely not proof) that spammers might have to spend some amount of effort to start using DMARC. I don't understand how you can conclude that it would be onerous for them to do so indefinitely; it seems equally plausible that they might have just not bothered to do it before now but will be able to start doing it without much cost.
Just had a non tech friend reach out to me because they’re unable login to Claude. Sure enough, Anthropic (MAIL.ANTHROPIC.COM) does not seem to have their DMARC properly setup: https://mxtoolbox.com/SuperTool.aspx?action=Txt%3aMAIL.ANTHR...
I set up DMARC on my personal domain so long ago I can't even remember when I did it. 10 years+?
I had kinda assumed that a lot of providers would start rejecting domains without DMARC support. I'm surprised it's happening this late.
This was my second hackernews submit [0]! So, not even https in 2014 :)
When I ran that server, outlook.com was also the only one that would blackhole my email for no known reason. Support was unhelpful and also could not point to any reason. I've since given up, but for a short time it was glorious, email to family would not leave the lan and we could send attachments of arbitrary size.
[0] https://news.ycombinator.com/item?id=7708882
You adopted it the moment it was announced? Really?
Is there a risk some people on this thread are mixing up DKIM and DMARC?
DKIM = proving that an email was sent from a specific domain using cryptography. Good for spam fighting and deliverability.
DMARC = telling receivers how to handle mail that fails authentication.
DMARC is primarily useful for large, complex organizations where email admins may not be aware of everyone inside the org who is sending mail that advertises the domain in the From header, or organizations that might be targeted by impersonation attacks (e.g. phishing). Being able to tell recipients "yes we absolutely have our act together so feel free to reject or spamfolder unauthenticated email" is great for killing phishing campaigns, and being able to request reports is great for finding that one sales org that signed up for a guerrilla marketing SaaS that's impersonating them.
But for small personal domains the value isn't that high.
I added DMARC and DKIM together, around the same time as some particular life events 10 years ago. Just now, I cross-checked the information against the commits in my Git repos.
Back then, I didn’t use Terraform or anything like that, but I had text files with logs that described the DNS setup in detail so I could fix things. By grepping through the logs, I’m able to put a definitive bound on when I added DMARC—it was no later than June 2016, over 10 years ago.
At the time I thought, “Obviously, we should all be setting this up, because recipients will start rejecting mail from insecure domains, if they don’t already.” This was also back when I self-hosted email. I eventually stopped doing that because I thought it was too time-consuming.
>DMARC is primarily useful for large, complex organizations
>But for small personal domains the value isn't that high.
I don't understand the resistance. It benefits the entire mail ecosystem, not just mass senders.
SPF used to be niche thing, then everyone realised it's a good idea and it became more-or-less mandatory. Same with DKIM. Now it has happened to DMARC as well.
> DMARC = telling receivers how to handle mail that fails authentication.
No. DMARC is about if the from address has to match the address used in dkim/spf
No DMARC is about telling receivers which of SPF/DKIM are valid, what to do with it when it fails, and where to send a report to. Oh look.. like Mike said.
To be clear, I am saying this is incorrect.
DMARC is primarily about "alignment" (switching SPF from caring about the envelope sender to instead using the from header). Yes, it does also tangentially address those other points, but the primary reason it was adopted was to prevent spoofing of from headers (where in original spf that was a non-goal)
> You adopted it the moment it was announced? Really?
A specification exists since 2012, 14 years ago. 10 years ago it was already old.
Email is the largest social network on earth (8.3 Billion addresses)
10 years is nothing. I'm sure there's still millions of companies globally who still aren't properly signing mail with DMARC.
Then it’s dying. I don’t know a single person under 30 who uses email NOT for work
People also use email to sign up for accounts, and sometimes still for handing in homework.
That's pretty much all email is good for these days. Even in business, Slack/Teams/Mattermost has replaced a lot of 2000s email communication.
The fact that email is for work is why it will never die.
No, you will never be contacting your bank over Instagram DMs or getting hotel confirmations via Facebook or dealing with governments over Youtube.
Nobody sends physical mail to each other anymore either, yet last mile delivery is as important as ever.
Outlook.com has quietly dropped[0] emails from certain domains/IPs for years, even with SPF/DKIM/DMARC all properly set up and no history of spam. As someone who's administering their own mail server, Outlook has been the bane of my existence.
[0]: As in: They accepted the email just fine (according to the logs) but it still didn't end up in the recipient's mailbox.
I went through this and ended up following these instructions (clearly AI-generated so strip through the verbosity) to get delivery restored: https://www.suped.com/learn/blocklists/how-can-i-resolve-mic...
It's probably just another bug in their software.
They're not rejecting them quietly. They're sending 5xx permanent delivery failures.
The title may mean it in the sense of being unannounced
"Quietly" in the title is an AI slopspam pattern. It's an over-used teenager hyperbolic crutch word on par with "literally", "actually", "honestly" and similar.
Sometimes it's use is appropriate, but not in this case. Microsoft announced this change loudly, multiple times, starting more than a year ago. I seem to recall one of those announcements being discussed here on HN. Even the article links to it's own previous announcements, so "quietly" here is stupid rage bait to justify a blogspam advert.
The word "quietly" has now been dropped from the link title, but still appears on the original.
Real men do not review their articles, they post them on HN and have the whole world review them :)
I actually totally agree with this. There's too much risk involved with scams disguised as legitimate services because the developers of said service couldn't be bothered to add 1 or 2 dns records.
Although there seems that there hasn't been any communication which is the bad thing here. However, nobody looks at those and sending detailed emails back seems like a good enough solution.
Maybe they should also work on what their users are sending as well.
Unfortunately, the people abusing these are very persistent and adding more checks will just increase the sophistication of such attacks which works against the interests of the target.
This stops disguising yourself as a legitimate service.
Charge for the service. How much spam do you get from Fastmail?
If they did that you’d decry censorship.
Allowing basically ~whatever, but proving the sender address is an obviously good approach to me.
I don't know what "v=DMARC1; p=none;" is proving to anyone when DKIM and SPF are already aligned but sure whatever. Just wish they'd given some warning!
email is weird, without this it doesn't perform the checks at all
Agreed. There's no additional verity provided by adding a DNS record with a static line of text. Reminds me of airport security theater: meaningless hoops for citizens to jump thru under the guise of stopping bad actors.
I thought they've been doing this for years, along with gmail/etc. I basically just added setting up the correct DNS records as part of business when sending emails externally.
You can send an email through mail-tester to see what you might be missing. https://mail-tester.com/
Exactly! Was pretty sure these existed, makes that part of email hosting setup easier.
This is interesting. At some point, I think it'll be desirable to give increasing positive weight to emails with the DPF/DKIM/DMARC trifecta configured, since those are least likely to be problem emails (spam or phishing), but I wonder what the best avenue is to actually make that the default. It's almost certainly not this kind of unannounced cutoff.
Email is, I think, among the most distributed popular online services, and there's a ton of stuff that's legacy, self-managed, or otherwise janky. Supporting SPF, DKIM, and DMARC does put a burden on independent operators, but is it an undue or unreasonable one in the current landscape? Or is it just the new cost of doing business?
It seems like 90% of the spam I receive (on my google account) is sent from google addresses, so it will have valid SPF/DKIM/DMARC setup.
That said checking for these things is a good idea, the only problem I see is dropping the mail on the floor, rather than rejecting it at SMTP time - at least that lets the self-hosting users who haven't got things configured know their email is being rejected, and to pick up the phone instead.
There's nothing worse than sending an email, it being accepted, and then later discarded with no clue to either sender or recipient.
Selection bias: you don’t see the spam that get rejected at HELO.
My server doesn't reject anyone, but does greylisting. That's a default setting in Postfix. It means the first time an IP address connects it gets a temporary error. If it retries later the message is accepted. That's the only anti-spam measure I have.
Maybe 1 in 5 emails I get is spam, and because I use a different address with every sender I know who sold "my" address to a spam list.
> but is it an undue or unreasonable one in the current landscape
Yes. In the first place, this should not even be a thing. Two corporations should not be in control of who can send e-mail. If they want to mark not having DMARC as spam, mark it as spam, or better yet flag it with a specific warning about the domain, but these games with refusing to deliver are just bullshit and essentially force a monopoly where other e-mail providers cannot compete because their e-mails aren't delivered.
No, not delivering is much better. You get a clean error message that tells you exactly what to do, it can be fixed in minutes. Spamfoldering email for not having DMARC would be a mistake, it might be years before low volume senders notice and figure out what's wrong (if they ever do).
> You get a clean error message that tells you exactly what to do
We are literally talking about a situation where this is not happening! And the problem is that it's not just this. Once you give them a license to police e-mail, they start policing e-mail for all kinds of arbitrary and inscrutable reasons. If this were going to be done, it should really be formalized as an industry standard by an independent consortium, not up to the whims of Microsoogle.
Are we? Microsoft is bouncing emails with instructions on what to do.
DMARC, DKIM and the rest are industry standards set through an independent consortium (it's called the MAAWG iirc)
> I wonder what the best avenue is to actually make that the default. It's almost certainly not this kind of unannounced cutoff.
En contraire, I think not delivering mail is the fastest way to adoption. People will use an old system for as long as it works. It now does not anymore.
I don't know. I think this disenfranchises a lot of independent operators, and the blow of that could at least be softened by making a highly-visible public announcement about it a few months ahead of time.
Maybe you're right that just enforcing it is the way, but I don't agree with doing that with no heads up.
Most spam I get is from Google, Microsoft and Amazon. We should pressure those to start dealing with the problem. Right now they are conveniently ignoring it.
None of them are a good 'Is this spam?' heuristic, though. All they do is ensure the sending domain isn't forged, but most spam, even phishing emails, doesn't really rely on that. Spammers are much more motivated than average to jump through the hoops necessary to set it up, as well. Any anti-spam signal needs to be much more expensive for spammers than regular senders.
I could be naive, but I don't see how this would be any more unreasonable than requiring HTTPS
Requiring HTTPS was very unreasonable. You have so many more moving parts that can go wrong, and a business relationship with a CA (even if it's Let's Encrypt). We only tolerate this because the alternative is worse.
There's no burden whatsoever. It's a one time setup that takes like 15 minutes.
That is a burden definitionally, though; and that's to say nothing of the effort required to understand the technology and its impacts on operations.
You can literally just Google a 3 step guide for any provider. What are you even arguing? That security for infra shouldn't be a thing? Should grandma be able to run a mail server? What's your point?
I'm arguing that with a system as distributed as email, there will certainly be people who won't do this upgrade; I'm highlighting the contrast between the need for this set of technologies (SPF, DKIM, DMARC) and the utility of an old-school open web where the barrier to entry is low and anyone can participate.
We have seen a massive erosion of the latter aspect of the web in the past few years, and I think it's useful to frame conversations in terms of that loss. The web used to be fun, and now it's become, more than ever, a professional enterprise. You often can't stand up a website without having to buy into Cloudflare's DDoS protection or something equivalent. I think this is absurd, and it's not the only such case, though these changes are obviously reactions to how usage of the web's evolved over the years.
I wonder if we can get the old web back in some way, shape, or form, cause I think we've lost something with the corporatization of the internet.
And for what it's worth, yeah, I think grandma should be able to run a mail server. Why not?
It's perfectly doable for a hobbyist to set up email authentication properly. It requires some effort, sure, but it's not so hard it prevents you from running your own email server.
Well, if we can get a more relaxed email self hosting experience with the DMARC enforcement, I'd say it is a good trade-off in exchange with freedom of speech, rather than accepting the risk of spamming.
These days, hosting a proper mail server isn't really that hard, thanks to Stalwart https://stalw.art/. I did it to my Talos Linux cluster located on LA and utilizing idle resources. It is pretty great
I self-host my email system and rarely send any outbound email. Occasionally I receive emails from individual users. Users on Microsoft’s email service can send emails to me, but my replies are rejected outright. This doesn’t happen with Gmail or other email providers.
The only mistake people make here is to accept that the problem is on their end even after Microsoft has accepted the e-mail but silently discarded it. This leads to the customer impression that the mistake happens on their end and not on Microsoft's.
When I see in my logs that the e-mail has been successfully delivered to their MTA then I don't have a problem.
Yep. Let's say for example you were sending a legally important email saying you did something, and your customer tried to sue you over not sending the email. If you sent it and the customer's agent (Microsoft) dropped it, that's a problem between the customer and their agent, and you are not liable.
(If this happens to you, don't admit that you know Microsoft drops your emails, or you'll be liable again!)
the problem is Gmail accepting emails from domains that have no MX records!
Even lazy spammers, who didn't even bother to create MX records for their fake, auto-generated domain, are getting into Gmail (Spam folder mostly, yet, why not reject it entirely?)
Since yesterday my email started getting blocked. Does anyone know what's going on ?
Check blocklists for your domain and IP address (and many ASN if you're sending to certain MS servers). The DMARC change has a specific error message ("Message lacks SPF/DKIM/DMARC Auth Records").
Or whoever you're emailing has blocked you for some reason; perhaps your email was marked as spam before, or you/your mail server/your automated tooling has ignored bounces and has crossed a mail server threshold.
You could consider following the URL in the bounce message. Or searching online for the particular error code, which quickly turns up:
https://learn.microsoft.com/en-us/troubleshoot/exchange/emai...
Thanks!
Some additional context:
- I checked online and they do have this email address listed on their pages
- This affected 2 separate domains served by Microsoft
- I sent them an inquiry email now from my @gmail.com and no bounce was returned so far
EDIT: Also gmail got the error response, so I guess it's really up to the outlook server these unrelated entities use...
On an unrelated but frustrating "silent behaviour" note, I hate how Outlook rewrites URLs to add their "safe links" domain indirection. Just show me the damn raw URL!
I don't get the Email thing anyway.
I had an email server and configured everything by the book. Still some scammer were able to send emails which looked like they came from me, so i got responds back.
If not even this was fixed...
That's what DMARC and DKIM can help with. If you have `p=reject` then anything failing your DKIM check will be rejected by the recipient mail server (if it supports DMARC)
> Quietly Rejecting Email
> The sender gets a bounce
?
"quietly" is a sign that an LLM wrote it
My first thought as well: how does one quietly reject email? Skimmed the comments and clearly it's not quietly. Saved a click...
It's quiet only if the server accepts it and then deletes it on their end without notifying the sender, but if your mail provider shreds your mail that's then also your provider's responsibility and not the sender's
Lots of big email services do quietly reject mail. They successfully accept it but then throw it away (sometimes not even in the spam folder for particularly high span scores).
That's their issue. Don't be a customer at such an email provider :shrug:
I had a legal dispute once where a shop didn't provide warranty on a product. They took the product in but then it was indefinitely in repair. Long story short, it ended up being helpful that I have email server logs that show every transaction, so that I could say "on date+time the email was delivered to IP address X, which was registered as the mail exchanger for your domain, and your server took the email with status code XYZ Queued <ID> For Delivery." Would have been interesting to hear what a judge has to say about it but they simply agreed to give the full purchase price back after that
Afaik that's not what Microsoft/Hotmail does though: since it rejects noncompliant setups (as well as a lot of legitimate email, unfortunately), the sender gets a delivery failure notification
Replying to all inbound messages with a bounce is an old idea. The theory was that legitimate senders would validate their address and get added to a white list. The scheme didn't work for the same reason captchas don't work.
Maybe an old idea and you can feel about it however you want, but it's still in universal use right? So it's not quiet or am I misunderstanding what you're saying?
I have the opposite problem. I have a 3-letter email address, so for ease of giving out the email address, I use it, while having it forwarded to my Gmail. Somewhere around 2019, emails from legitimate services, especially password reset/OTP codes, stopped landing in my inbox or even junk because my address is so high up the chain of spammers. Nebula was the first to confirm this for me and work out of band to re-enable access to my account - their emails to me were bouncing. But ever since that happened, I’ve slowly moved back to giving my Gmail.
There's something called ARC https://en.wikipedia.org/wiki/Authenticated_Received_Chain which is supposed to handle forwarded emails, but no idea how it works in practice.
Sounds like kind of a hack:
"ARC was devised to solve this problem by giving intermediate servers a way to sign the original message's validation results. Even if the SPF and DKIM validation fail, the receiving service can choose to validate the ARC chain. If it indicates that the original message passed the SPF and DKIM checks, and the only modifications were made by intermediaries trusted by the receiving service, the receiving service may choose to accept the email."
Sounds like Gmail is the one blocking it. Stop forwarding it to Gmail and set up email directly on the address.
huh
maybe someone was too lazy to set up "inbound block list" and just did a total blackout instead?
It sounds like Gmail is seeing 3000 emails a day coming from foo@bar.com, some of which are different kinds of spam, and reasonably concludes they are a spammer.
As they should. You should have done this 5 years ago. Takes like 10 minutes. Gmail has been rejecting them for years at this point.
"Google has been rejecting them for years..."
Not true, at least in my experiences.
I have a bunch of email accounts which have SPF and DKIM, but are missing the DMARC line - I've had no deliverability problems at all, until this weekend, and now only with Outlook. Emails to Gmail accounts go through just fine.
The combination of: √ Valid SPF √ Valid DKIM signature X Missing DMARC policy
Is clearly ambiguous. Since a DMARC of "p=none" (in the context of valid SPF and DKIM) really adds no information, so interpreting "missing DMARC" as "p=none" seems reasonable. Sounds like Microsoft was taking that approach until this weekend.
I wonder if there's an actual written standard?
Under RFC 7489 [1], a domain with no DMARC record simply has no DMARC policy, the receiver is able to enforce whatever policy it likes.
Most receivers have chosen to treat this as p=none for the last decade (Microsoft included). This is changing to now so that mail with no record is simply refused. Nothing in the standard prohibits this.
a DMARC of p=none might be seen as ambiguous - SPF and DKIM have their own jobs and they work. However, the point of DMARC is not a new way of enforcing mail authentication. Instead it is a way of making certain that the mail is internally consistent and furthermore provides two additional things.
1. it indicates if the domain owner has thoroughly gotten their mail to authenticate (in which case they adopt a p=reject), and
2. it provides a feedback mechanism that allows the domain owner to know if they are seeing authentication and deliverability problems in such a way that they can fix those broken mail flows.
[1] https://www.rfc-editor.org/info/rfc7489/
Googling around this started at least a year ago, but I worked at an MSP 3 years ago when it was first announced and we started getting customers into compliance. This wasn't something out of the blue.
Mail admins had 20+ years to fix config. Not saying that outlook is properly config, but it’s well overdue using solutions designed to reduce spam.
DMARC does basically nothing. Certainly nothing that DKIM doesn't already do. Users just get phished by email that's not in their own company domain but something similar (or even completely random)
Does DMARC reduce spam?
This is a good thing for the actual email users. The volume of really obvious “spam” emails were through the roof that it became quite tedious to rescue legit emails. It’s not like setting up DMARC is hard either.
If it's not hard, what stops spammers from doing it?
Tangentially-related: Gmail has started sending completely legitimate emails to spam. DMARC/SPF/DKIM (2048 bits) all properly configured of course so there has to be something else that isn't documented.
They have been doing that for years. A long time ago there was a submission here on HN about some Ivy League college urging college applicants to provide something other than a Gmail address because application-related emails (including acceptances!) would frequently not get through.
Started? My Gmail spam filter has been broken for several years now. Extremely obvious spam regularly ends up in the primary inbox and critical, fully legitimate messages get buried in spam. It’s a major reason why I left for another provider.
Gmail send their own service notifications to spam.
I gave up last month and set up the outgoing email for my personal domain to go through the free tier of smtp2go.
Receiving is still self hosted.
This has been going on for much longer than stated here - we had domain mismatch issues with outlook going back years and our policy was p=none. They’re very sensitive and mailing lists with forwarding are heavily impacted.
Mail security non-expert here, is this going to affect people who use alternative addresses for their Gmail account?
It affected my google workspace account
Do you know if it’ll affect my (personal) account? I run everything through a normal Gmail account and have forwarding for incoming email and an alias for outgoing stuff
If you're using Gmail's “Send As” feature to use a different SMTP server for outgoing mail, then yes, you must have a proper DMARC TXT record configured on the domain you send from (even if it's just `v=DMARC1; p=none`).
However, it is worth mentioning that Gmail is fully dropping the ability to use a non-Gmail SMTP server as of January: https://support.google.com/mail/answer/22370.
It shouldn't affect you. DMARC policies apply to the authenticated domain, which is Gmail.
> Nobody announced it
They did: https://techcommunity.microsoft.com/blog/microsoftdefenderfo...
And it appears to be further documented here:
https://learn.microsoft.com/en-us/defender-office-365/anti-p...
https://learn.microsoft.com/en-us/defender-office-365/email-...
And other sites were reporting about it for at least a year and a half:
https://powerdmarc.com/dmarc-outlook-email-authentication/ (see #4)
https://www.mailreach.co/blog/outlook-dmarc-requirements
> For domains sending over 5,000 emails per day
That's an old announcement about a different change. As far as I can tell this one is completely out of the blue. I'm shocked by the number of people in this thread advocating for spontaneous changes without any warning.
That says for "high volume senders" but they now apply the rules regardless of volume.
Yes, this is an older announcement from last year. Yahoo and Google did the same at that time.
The failure associated with that announcement is different. It is 5.7.515.
This new failure mode is "5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records (AS9031519)", I haven't seen any formal announcement on my end. The important thing to know about 5.7.1 is that it represents a few different failure modes, the AS9031519 is the important bit and it indicates that the domain lacks a DMARC record.
Is there any actual evidence of this outside of this one company's AI-generated article?
There's been ample evidence of this, many different blogs, notification emails etc.
This thread duplicates the first observations of this which showed up here yesterday at https://news.ycombinator.com/item?id=50404161
My mail provider, MXroute, sent me a notification of the issue early yesterday. There is commentary from various DMARC providers (Suped and PowerDMARC). This is a real thing.
It does not matter which host you are using, this has nothing to do with the hosting provider. It has everything to do with having your domain correctly set up on DNS so that anybody receiving mail will know how to authenticate it. Microsoft has apparently advanced a policy that if you don't even try you don't get to send.
IMO this is the right call, I've seen plenty of spoofing attacks where the attacker took advantage of nonexistent policy on non-sending domains. You might think that if you don't have an MX record the domain can't be used to send mail, that is wrong. The MX record only tells others where to send your mail, it says nothing about whether the domain can send mail itself.
Ample evidence that the policy now extends to low-volume senders? Could you provide even one example?
There seem to be some just in these comments, including me, so yes.
I got a bounce on a mail from my personal Fastmail account (with my own domain) the day before yesterday.
I had SPF/DKIM set up, just not DMARC. Did that yesterday and don‘t see the point. My policy is "none".
The point is to have a DMARC record, setting it to none doesn't really do much of anything for you though. If you really wanted to take advantage of it you will need a DMARC monitoring solution - the market seems to typically price these around $10/month for small-ish domains (though there are a lot of caveats). I'm trying to build a reasonable free option that maybe isn't enough to get a domain to a reject policy, but should be enough for you to maintain a reject policy.
The truth is that there are amply "non-sending" domains out there which ignore DMARC and allow abuse. Stopping the assumption of no policy mean p=none prevents this abuse from persisting.
How does having a record with no policy make the internet safer?
How does making driving license exams harder make the roads safer?
Email was invented in 1965. It needs to be replaced with something that doesn't try to bolt security on as a lazy afterthought 30-40 years later.
We have everything we need to define email 2.0 with mandatory security, the problem is all the older installations that support 1.0 that everyone still expects to talk to.
New protocols only solved this by cutting compatibility. Signal can be E2EE because you can't send a message to an email address with it. Email can also be E2EE, but how do you know the recipient supports it?
It shouldn't BE backwards compatible. That's the Microsoft problem. They can't innovate because they have 40 years of legacy holding them back. Email might be the only situation that's worse. I don't want another new layer over the top like DMARC, and I don't want to try to "fix it." It can't be fixed, it's just a bad design.
I want something fundamentally new that doesn't stink of 70's era pre-security thinking.
A group of heavy hitters needs to just form a working group and propose Email 2.0. As long as it's supported by the biggest vendors and companies and they don't go all "IPv6: It's better because it's complicated!" on it people will sign up because it will be able to offer MUCH more in terms of features, usability, security, ease of hosting, etc.
What about Matrix?
I like Matrix, but I'm not sure it's really a direct email replacement. I think it could become one with sufficient work, but it's not there right now.
Sorry to break it to you, but email isn't going anywhere anytime soon.
I had an email kicked back to me from Hotmail this past week complaining about missing DMARC. I fixed that and subsequent messages went through fine.
Rejecting emails from some domains. Why would emails “to” these domains also bounce back?
I’ve been anticipating something like this for a while; the number of folks who don’t have their email-related DNS settings in order is remarkably high.
And have Microsoft started checking DMARC correctly yet?
We discovered when we set up a third-party to send via Amazon SES with one of our domains at the start of 2025 that Microsoft didn't correctly check DKIM alignment, and would incorrectly fail valid emails. The issue, so far as I could tell at the time, was that if an email had multiple (in our case 2) DKIM signatures, Microsoft's handling seemed to be non-deterministic, sometimes checking one signature, sometimes the other, and sometimes both. Of course, those times when it only checked one signature and that wasn't the one for the sending domain, it would then fail the alignment check, even though there was a perfectly valid and aligned signature right there it had just decided to ignore.
I raised it with Microsoft support at the time, but they were unsurprisingly useless, I think the most constructive thing they said was "just add the Amazon SES IPs to your SPF record", which, uh, no.
In the end, IIRC, we ended up setting up the third party to sign into a 365 email account on our domain we created for them so they could send through MS's infrastructure and avoid all that. So no idea what their DMARC checking is like these days, but I'd assume the same, if not worse.
DMARC has been around for a while now. I know it’s fashionable to bash on Micro$oft and they rightfully deserve it.
Just not for this.
You can hate on outlook.com for a couple of reasons.
But this is not one of them.
Seriously, in fact I would say this is rare instance of Microsoft handling email in a way that makes sense.
What if I include the header string, "DMARC and Jalad at Tanagra."
DKIM, its signature verified.
SPF when the alignment fell
Stop bitching guys, you have never dealt with t-online.de (T-Mobile)
https://telekomhilft-telekom-de.translate.goog/conversations...
Deutsche Telekom is a regional monopoly that abuses its position in every possible way. It's like Comcast but even worse. Best thing you can do is forget they exist and if someone really wants to contact you they'll find another way.
I was hit by this twenty minutes ago. I don't disagree with the policy, but I wish my provider had warned me so I could add the headers. I already had DKIM and SPF, but not DMARC.
Didn't gmail already roll the same thing out in 2024?
If BIMI was in any way scalable it would actually provide a way for an external signer to say “yeah we trust these guys, you should deliver this”.
I haven’t really seen BIMI for less than practically $1000/year and most clients still don’t check it.
> That rule is aimed at marketers and bulk senders, and most small businesses rightly assumed it didn't apply to them.
This would be naive. It currently means that Microsoft censors and decides what you can see in the first place. I do not recall having given Microsoft such a permission. On the other hand I don't use Microsoft for email anyway (though, unfortunately, one local university here does, which is super-annoying. Europe is unable to think strategically here).
It’s 2026.. having been at a few email companies for years, this time I would agree with Outlook on this one
Yahoo is too.
Yahoo has randomly rejected emails for decades. In my experience it's probably the worst among the mainstream providers.
I've got the DMARC record on my domain, but it does seem very silly. Why couldn't the spec just make `p=None` the default?
For anyone running their own mail server, Microsoft has an authorization system to let you "authorize" your mail server IPs to talk with Microsoft's mail servers.
It's stupid, but not terribly difficult to set up and authorize.
Like most people who run their own mail, I have had repeated problems with Microsoft in particular, who treats small mail server operators like crap.
This post reminded me that I had gotten some email requesting me to "Re-attest Your Network Access". I went in, clicked a few things, and I'm good for another year or whatever.
https://substrate.office.com/ip-domain-management-snds/snds
https://www.litmus.com/blog/what-is-microsoft-snds-why-your-...
Its not "one header" to fix. SPF and DKIM must be implemented.
If you have no spf or dkim your emails have been getting rejected for a very long time.
(dmarc only requires one of spf or dkim, not both, but it is a good idea to use both)
Not IME. I just added all 3, after not having any noticeable email issues for years.
Unfortunately, SPF and DKIM become optional once you send enough email for a mail server to trust you. You could've never bothered to update your email to the futuristic year of 2015 and still made your way into every inbox without ever knowing you forgot something.
Yeah thanks Microsoft. Really appreciate having to mitigate this for hundreds of customers on a weekend. Nice one!
You should have done this for your customers years ago, yikes.
I suspect that he/she means they runs a mail server and it was up to his customers to comply, but now they’ve had to deal with the fallout from their customers not complying.
Cool, charge them for it. That's what IT support is.
The customers have to do it themselves since they control their domains. I recommend doing everything correctly but also understand that this stuff is pretty hard for people just trying to run a small business. But if it makes you happy to feel smug you can carry on assuming.
My assumption is that they were in control of the domains. If not, it isn't their problem and if anything it's billable hours, aka their job.
I noticed this when it happened, but I do have a valid DMARC entry (albeit p=quarantine).
https://mastodon.social/@davisr/117570496362439342
Email is dead. Unfortunately any replacement for it would be owned by Meta or MS or whatever.
The assumption of a single shared medium is dead.
When you talk about a single entity to single entity connection it can be any protocol. Email, Matrix, WhatsApp, SMS... Discord... Instagram. All of them work especially if you whitelist the other party.
What doesn't work any more is assuming that everyone is using the same thing. Back when email was invented it was the only computer-based communication protocol - I don't remember whether it came before or after USENET - I'm assuming before. If you wanted to send a message to someone you sent it to their email address. Now things aren't so clear.
> The fix is one DNS record.
Oh god the slop.
Only an LLM would describe DMARC as just "one DNS record".
I literally had to copy paste one dns record to enable it.
lol DMARC is one record.
It doesn't have to be just one record, but it doesn't have to be more than one record either.
DMARC is layered across (/is useless without) two other protocols (SPF, DKIM), both of which also require DNS records.. there's no way to DMARC with one record.. unless you're excluding those SPF and DKIM records in your count. You /could/ DMARC with two records: DMARC+SPF, or DMARK+DKIM but it's ill-advised - use all three. (Ignoring host hierarchy/cname delegation, you can have far more records)
Were you previously sending email without either DKIM or SPF?
Because i doubt that has worked at all in the last decade.
Are you replying to the wrong comment? No on all counts.
Then setting up DMARC is only one record because you already had the other records.
I suppose I'm splitting hairs.
Yes, a proper email authentication stack has DMARC + SPF + DKIM. But each of these is a separate protocol.
This also doesn't take into consideration the other protocols that have arisen BIMI, APRF, MTA-STS / TLS-RPT and are at even lower levels of adoption.
MTA-STS is useful (but it's about helping receivers by demanding mail is sent encrypted, not senders with delivery).
BIMI is a pay-to-spam protocol that helps senders, you can add a rule to postfix to mark it as such.
APRF is a draft, and likewise helps senders, not receivers.. not sure why anyone would want to adopt this standard. A little closer to DMARC reports, but sharing PI that you owe no sending server.
Do they literally just need the DMARC record to exist though, or do they need it to actually say something? Do you need DKIM? I found that SPF is very easy but DKIM is a royal pain.
It's possibly yet another issue relating to the long streak of problems seen the recent months by primarily self-hosters trying to reach people and businesses behind Outlook servers. The past few weeks a lot of my e-mails to friends and family using Hotmail have gone missing. All envelopes were OKd by Outlook servers, nothing bounced, e-mails just gone. My setup is clean, my network is clean.
I'm fine with providers imposing some default level of spam protection but as a user I'd like the option to disable it, even better if I can disable it per domain or sender. The old technique of adding the sender to your contacts doesn't work reliably anymore.
"The old technique of adding the sender to your contacts doesn't work reliably anymore."
An Outlook user first reaching out to you, and you replying and including the unique message-ID of their original envelope in your headers, doesn't affect anything either. Absurd. The whole situation is complete dog shit.
"First time?"
It's not months it's years.
Anecdotal. I've self-hosted for many years but didn't run into these issues with O365 until this year. But not surprised to hear it.
They used to just drop all messages from domains not on their whitelist and to get whitelisted you needed to have a Microsoft account and open a support ticket.
"Since November 5, 2026, Microsoft's consumer mail service has been turning away some of the email from domains that don't publish a DMARC record. If your company emails customers, vendors or applicants with outlook.com, hotmail.com, live.com or msn.com addresses, some of that mail may be bouncing right now. Nobody announced it. The fix is one DNS record."
I'm personally seeing this with some email systems I manage - email sent from a domain that has proper SPF and DKIM signatures, but had no DMARC record started bouncing this weekend.