Rendered at 23:29:53 GMT+0000 (Coordinated Universal Time) with Cloudflare Workers.
Neikius 1 days ago [-]
Outlook.com is also rejecting mail based on blocklists that are not public and you essentialy cannot get yourself out. My VPS provider is pretty much entirely blocked and their regular blocklist process says we are golden so nothing to unblock.
Outlook.com and similar are an anathema to email. This is why they tell you not to run a mail server .
On the other hand rejecting domains without dmarc is fine. Just not happy it is silent.
miki123211 14 hours ago [-]
Everybody I know who still runs their email server (you can get Europeans out of Europe, but you can't get Europe out of the Europeans) complains about Microsoft.
I bet Microsoft is single-handedly responsible for 80+% of complaints about email being impossible to host.
In a federated / pseudo-decentralized network, any provider with 10+% of captive users has an outsized leverage on the entire ecosystem. You don't need a monopoly; as long as you have a monopoly on just a few users that others absolutely need to be able to interact with, you can dictate terms to everybody.
oggy 11 hours ago [-]
Google is no better. It's quite absurd, they even went through the trouble of creating postmaster tools to help you manage your reputation - except that these don't work unless you have fairly high sending rates (I forget, but I think several hundred a day). So essentially they're actively hostile to personal and small business servers.
thesuitonym 9 hours ago [-]
Google is in fact much worse. Not only is it as hard to send mail to Gmail users, Gmail is a leading producer of spam.
I wish I could just wholesale block gmail.com like people used to do with the early webmail providers.
prmoustache 5 hours ago [-]
> they even went through the trouble of creating postmaster tools to help you manage your reputation
I think that implies having an actual google account to do that, which is absurd.
> I bet Microsoft is single-handedly responsible for 80+% of complaints about email being impossible to host.
They are the reason I dropped self-hosting my mails. They were silently dropping some of my mails depending on the day I sent them. If they were at least sent to the spam folder, it would be easier to communicate with their users. And since a lot of their users are not technical at all, it's complicated to explain them the issue.
icantevenhold 14 hours ago [-]
Not just email - their identity / SSO system is just as fucked
InsidiousWombat 10 hours ago [-]
more like 98%
It's absurd in every way. I was trying to get it to stop spamming maillist traffic. It's impossible. Global level filters enacted as admin to not spam check are ignored.
jeroenhd 13 hours ago [-]
Don't forget Google! Gmail will hide your email for no reason no matter what you configure on Gmail's side of things. At least Microsoft has a "please remove me from your spam lists" form (that only worked for ipv4 IP addresses last time I tried).
dwedge 11 hours ago [-]
Yahoo were annoying and I'm happy the collapsed solely because of that
efesak 15 hours ago [-]
Same experience here. We have multiple customers whose servers are in large blocked IP ranges, with seemingly no way to get them delisted. The strange thing is that Microsoft only seems to reject their emails on Hotmail/Outlook.com accounts (free accounts), while accepting them just fine on business accounts. Meanwhile, their “support” tools tell you there’s nothing wrong.
Based on my broad experience, I’d comfortably rank Microsoft as the worst of the major email providers. (I am owner poste.io)
jofzar 14 hours ago [-]
I work at a big company that sends alot of emails. And even we have been put in the "bad bad books of o365 bad list", it's an absolute pain to get yourself out of the office 365 defender (I think it's what they call it now?) meanwhile your customers are complaining they arent receiving emails from you.
TedDoesntTalk 13 hours ago [-]
Are companies like MailChimp, SendGrid, etc affected the same way?
leonidasv 10 hours ago [-]
Yes. I once had issues with emails being rejected by Outlook on MailGun. And it was only Outlook. Had to contact support, they promptly changed my account to another server/IP once I mentioned it was Outlook, sounded like a recurring issue.
nik_ca 9 hours ago [-]
Well, your big company should then call M$ out then. E.g., consider you're sending a confirmation e-mail during account registration, then when your server detects that relay is `*.oulook.com` show a warning: 'outlook users most probably will not receive emails from us due to bs policy at microsoft. consider using a different email provider.'
Yes, that may turn some users away, but they would complain and leave anyway, because they don't receive emails from your server. On the other hand, that's how one can contribute to unwinding ms's share of email accounts.
skeeter2020 9 hours ago [-]
Think about what you're saying: someone is near the top of the sales funnel and despite the odds you've convinced them to provide their email so you can start the process of trying to convert. Even if you are good you'll still lose 80% of people from this point before you see a single dollar. Now, inject some extra weird, sketchy-sounding friction AND ask them to change their email provider, something 99% of employees never think about let alone control. Not sure how old you are but you'd have better luck convincing users "this site works best in IE4".
nik_ca 8 hours ago [-]
Right, letting users frustrate silently, without explaining to them why they don't receive correspondence is the way to go. Discussing my age/gender/race isn't productive either. Dont rage, just pay attention to what's written. I only suggest them to select a different e-mail for better experience, not reqiring it. And the actual wording of this suggestion should always be developed in collaboration with company's layers and marketing teams.
sam_lowry_ 15 hours ago [-]
Email delivery for enterprise accounts has always been more lenient, the assumption being that enterprises do have their own mail filtering software.
Ungh 1 days ago [-]
outlook.com and O365 are horrible to deliver to. We regularly get issues where we sent an email it was accepted by O365 but was never delivered to the mailbox. We have one person working at least half the time on resolving stuff like that. And that's from a respectably maintained SES egress with good reputation, DMARC, DKIM configured.
drdaeman 24 hours ago [-]
There is a trick. Sign up with them, configure custom domain, but don’t set your MX records. On your MTA, route mail that goes to Outlook/Hotmail to go through their MSA with your Outlook credentials and headers stripped as if submitted directly by user. Outlook gets mail through their own MSA it trusts, rest of the world talks to your mail system directly. Replies still go to your MXes.
I haven’t productionized this setup (I send maybe a dozen emails a year) but it worked for me ad hoc a couple years back, when I had to send a mail to an Outlook-hosted address and they blackholed everything I tried to send while 250 OKing me.
litoE 17 hours ago [-]
The problem with this setup is that if I want to send email to fred@example.com and example.com is actually handled by Outlook, I need to somehow know beforehand that email to example.com needs that special routing. Or do you just route ALL your outbound email through Outlooks MSA?
jeroenhd 12 hours ago [-]
You can usually figure that out by checking the MX records (though some spam filtering middlemen might make that hard to detect) and TXT records (if a domain imports Outlook's SPF list, it's probably on Outlook in the back).
danielheath 16 hours ago [-]
Pretty easy to tell whether example.com uses outlook; it'll have MX records pointing there.
unixhero 17 hours ago [-]
Great idea
noduerme 15 hours ago [-]
I have a small client with a large email list who wants to switch from once a month constant contact newsletters to sending them through SES with a self-hosted Sendy instance. This seemed like a reasonable way to save $10k a year or so. I haven't used SES before for anything. I have run an email server for 30 years and had occasional blacklist headaches, but it's not used for mass mailing of that sort... it's usually several years between problems. Is this a terrible idea to switch, even if it's off a "managed" SES dedicated IP? I don't want to switch them and find out no one on Outlook is getting their mail.
cowlevel 18 hours ago [-]
What's the nature of your operation? If they're not giving you money then you're within your rights to say "sorry, don't use outlook"
Ungh 16 hours ago [-]
Our customers are giving us lots of money. And the nature of the emails are account reminders, activation and internal message notifications.
hdjrudni 17 hours ago [-]
Usually they are giving you money...
I ran a SaaS up until recently. Emailing users notifications for events was just a normal part of the app. Users got upset when the emails didn't come through. So then I had to be email tech support for something I had no control over. Lovely.
lakeviewterrace 23 hours ago [-]
Funny, they have no problem handling mail for essentially every Fortune 500 company and others large and small.
It's always people self-hosting mail on a shared server in Moldova (because they think it makes them cool) that are complaining.
pembrook 23 hours ago [-]
Self hosting mail on a shared server in Moldova is basically the entire idea behind email (and the internet).
Which with cheap models like Jev as spam classifiers, this can now become a reality.
The problem is, Google and Microsoft have monopolized the entire email market, so their esoteric deliverability mysticism from 2007 still persists (basically blanket bans on entire IP spaces, locking out anybody trying to send emails on their own).
lakeviewterrace 23 hours ago [-]
People used to have party lines and leave their doors unlocked too, but it turns out the world is filled with bad actors and other assorted shitty people.
Email naturally followed this evolution.
lesostep 12 hours ago [-]
The problem isn't that a random person can't rent a Moldova VPS and run an email server, though. It's that most people are forced into gmail, apple and outlook accounts if they want to use phone/PC, and a respectful Moldova company now can't reach their respective Moldova clients without paying money towards USA.
Switch Moldova to almost any country (or even a state that isn't California or Washington), and it's the same story everywhere
prmoustache 5 hours ago [-]
The bad actors are actually using mostly gmail and outlook accounts so this is a weak justification.
dualvariable 20 hours ago [-]
So naturally everyone should just leave e-mail to be run by all the corporations.
You shouldn't own your car or your house, give them to all the corporations as well.
thesuitonym 8 hours ago [-]
You might be on to something with the car thing... Maybe most people should rely on public transit.
lakeviewterrace 18 hours ago [-]
Nothing is stopping you and your three friends from running your own SMTP servers and emailing each other.
As soon as you want to do business with Outlook's customers, you play by their rules.
sirtaj 18 hours ago [-]
This is one thing I find more on Hacker News than most other discussion sites. Any topic about annoying or bad behaviour by corporations eventually devolves to "they're allowed to do it".
"They're allowed to do it" is one of those things that doesn't really bear saying so much because that's already been implicitly established. Nobody is claiming what they're doing is illegal, so how does this add anything of value? Who is still unaware that corporations will use their size and market control to their benefit?
dualvariable 6 hours ago [-]
> As soon as you want to do business with Outlook's customers, you play by their rules.
"Their rules" seems to be turning into "you spend money to another corporation that we trust".
qup 21 hours ago [-]
Some of us still leave our doors unlocked, too.
I've never even had the key to mine. I've lived here over a decade.
ShinyLeftPad 18 hours ago [-]
> Which with cheap models like Jev as spam classifiers, this can now become a reality.
With LLMs on the other side trying to make spam less detectable by cheap models like Jev?
It's funny when people assume benefits from some tech go one way and baddies will surely never use it...
pacija 23 hours ago [-]
Nope, people self-hosting mail on their own hardware from their own basement in Serbia ;)
And yes, it's cool not to have to let scum read your private communications :D
Ungh 16 hours ago [-]
Err we are part of a Fortune 500 and we can't even deliver to ourselves sometimes.
jaza 18 hours ago [-]
Maybe because every Fortune 500 company (and 99% of all large companies / orgs worldwide) uses O365 / Exchange / GSuite?
0xpgm 12 hours ago [-]
> Outlook.com and similar are an anathema to email. This is why they tell you not to run a mail server .
It should be the other way around though.. More people should run their own mail servers so that centralized players cannot control what should be a decentralized communication protocol.
newsoftheday 2 hours ago [-]
They had blocked my server by block range, I filed a support request (free) at https://olcsupport.office.com/ and they had it fixed in less than 2 days.
3RTB297 19 hours ago [-]
I've had several times where mail from custom domains associated with a business were delivered hours late by Outlook. Time sensitive emails. A guy coming to my office for a meeting called me and said he was downstairs and having an issue with security. Went down and swiped him in.
Four hours later, I got the same message by email. I thought he was back - nope. An email sent at 10am that was delivered at 4pm showed it was from 2pm until I looked at the header and saw sent at 10am and just... chilling out for 4 hours. DMARC was set up for them just fine.
I've had the same issue with my own custom domain, with DMARC set up. A year later, it finally got bumped up to some sort of "trusted" domain for that one place and my emails get delivered the same day now.
asksomeoneelse 15 hours ago [-]
Got a similar issues with outlook. Emails from some websites were delayed by several hours.
Mildly infuriating for emails containing OTP codes "valid for 10 minutes".
woolion 8 hours ago [-]
I had experience implementing and debugging mail delivery, so when I chose to run my own server I just opted for a SMTP relay, and never had an issue. I don't know why this isn't the recommended default solution.
yeah I see it for them being a problem too if they are not accepting legitimate email. I might be a bit stubborn here but I refuse to give them the monopoly and self host our email anyway. I just wish more people would join this fight
hypercube33 18 hours ago [-]
Pretty sure this or part of this just burned me. Icing on the cake is Nintendo will also ban hammer your email if it rejects some or all of their emails - including their dumptruck of marketing junk. The only and I mean only resolution to this is to basically move your Nintendo account to a different email completely. Absolutely unreal on both sides.
Yes, no one should not have DKIM or DMARC but holy yikes when neither side wants to actually give in to help the customer.
gatlin 1 days ago [-]
I was viciously mean in my communication with the Outlook team when they said they “couldn’t” remove me from the blocklist. I pointed out that, as the operator of a perfectly compliant secure server their inability to deliver my mail is a technical failure on their end and one which I will be contacting their supervisor about and they somehow managed to scrabble together the heroic ability to delete my row from a table. Never back down from these bastards.
pigggg 19 hours ago [-]
Which VPS provider out of curiosity?
functionmouse 1 days ago [-]
> Outlook.com and similar are an anathema to email. This is why they tell you not to run a mail server .
It turns out that whoever has the most power is the most powerful. This is why distributed/decentralized systems cannot singlehandedly free us from tyranny, and why I find people who spend all their time preaching decentralized systems to be quite silly. We don't need better systems (well maybe we do but,,,), we need better education and awareness of how billionaires manipulate us; this goes beyond software.
BobaFloutist 24 hours ago [-]
Complain all you want about the monopolists, and I do think you're right to do so, but a lot of their power comes from and is aimed at defeating the overwhelming flood of spam.
Mail, then emails, then home phones, then cell phones, then texts, then social media have been gradually rendered less and less usable by bad actors systematically abusing every single tool we try to use to communicate with one another to steal from us, lie to us, and manipulate our beliefs, and we'll just keep inventing and discarding new ways of communicating until we reckon with this.
pembrook 23 hours ago [-]
With cheaper AI classification models coming out every day now, the spam problem is on the cusp of basically being solved in every communication channel.
The only question is how many years the lazy network-effects monopolies (like Google, Microsoft, Verizon, etc) will hold this back from happening.
The optimist in me says this will unlock pathways to true decentralization of push communication protocols (like SMTP) instead of only have decentralization of pull-oriented protocols (like HTTP).
Arainach 22 hours ago [-]
On the contrary, with cheaper AI generation the spam problem becomes harder by the day.
Roark66 15 hours ago [-]
The power of defenders is greater than attackers here, because the defenders have more knowledge about what is "normal" for you the user.
Natfan 20 hours ago [-]
classification != generation
Arainach 19 hours ago [-]
Generation is, and always will be, cheaper and easier to do well than classification.
AI becoming faster empowers attackers far more than it empowers defenders. We're seeing this in every discipline and every corner of the software industry.
djray 20 hours ago [-]
"Two years from now, spam will be solved."
- Bill Gates at the World Economic Forum, in 2004
expedition32 13 hours ago [-]
A bunch of my accounts were hacked a while book and since then my outlook email is getting flooded with spam.
I have to give MS credit their spam filter is pretty good.
I'll never pay for email so your options are either outlook or Gmail and I don't trust Google.
myaccountonhn 22 hours ago [-]
I don't think anyone believes it will "singlehandedly free us from tyranny", it's one component for a healthy ecosystem.
nashashmi 1 days ago [-]
Decentralization is not a bulletproof solution. It is a mitigation. Until someone gets 50 percent of market share. Then they can run havoc on the ecosystem with their own customized system.
dualvariable 20 hours ago [-]
We could tax billionaires and use the money for a Manhattan Project to stamp out fraud, abuse, and corruption.
But we won't.
aboardRat4 19 hours ago [-]
>we need better education and awareness of how billionaires manipulate us
So that people would vote for the government to manipulate them instead?
Honestly, I hate outlook as much as you do, but I'd still prefer it to Max
Just put codex in a continuous goal loop to keep you off the blacklists...give it whatever email / creds it needs to make the appropriate requests and make the needed changes (ofc tell it the guardrails it should follow).
Selfhosted email is likely easier now than it ever was before.
thesuitonym 8 hours ago [-]
> give it whatever email / creds it needs
Oh man, please tag me if you're ever the lead on any project so I know to stay far away from it.
lakeviewterrace 24 hours ago [-]
Maybe don't self-host mail on a shitty $1/month VPS where 99% of the tenants are spammer scum?
This is not Microsoft's fault. The building's on fire and they're locking out the arsonists.
Arainach 23 hours ago [-]
Requiring DMARC may be good, but Outlook's approach is awful.
I was working for Microsoft when outlook.com launched and got a good email address that was my primary for more than a decade.
I had so many issues with things getting silently dropped with no recourse (2FA codes, account recovery mails, etc.) on so many sites that I finally gave up, reversed the stream, and had Outlook forward to GMail instead of vice versa. A few months after that, I realized that all my Outlook got was an enormous volume (hundreds of day) a spam and that all legitimate mail was going to my other accounts, so I turned it off entirely and haven't read that mailbox in over a year.
lakeviewterrace 23 hours ago [-]
> I had so many issues with things getting silently dropped with no recourse (2FA codes, account recovery mails, etc.) on so many sites
This is not unique to Microsoft and really the source's problem — they did something to get blocked in the first place.
Add in the fact that you're almost certainly not the only one impacted, and that they have no interest in fixing it, it screams incompetence on the source's part.
Been there, done that, good luck explaining the problem to the app's first-level support in the Philippines because it's not in their script.
> and had Outlook forward to GMail
Till the day GMail hits you with the "We couldn't verify it's you" bullshit and locks you out of your account forever. Good luck getting support from Google, the word is not in their lexicon.
Arainach 23 hours ago [-]
> This is not unique to Microsoft and really the source's problem — they did something to get blocked in the first place.
I've never encountered this issue with GMail. Delivery just works. I'm trying to think of the last false-positive spam flag I've had with GMail, and I've definitely never had mail be entirely dropped.
aboardRat4 19 hours ago [-]
I've had a lot of that.
VorpalWay 9 hours ago [-]
> Till the day GMail hits you with the "We couldn't verify it's you" bullshit and locks you out of your account forever. Good luck getting support from Google, the word is not in their lexicon.
This is also true of Microsoft though.
InsidiousWombat 10 hours ago [-]
no matter how much you pay for VPS or which cloud you use you'd get same treatment
Stop being so ignorant
mrweasel 14 hours ago [-]
Some hosting providers are known for not caring about the activities of their customers, but in general, how would I know that the other tenants are scum?
I have access to a fairly large dataset of known bad hosting providers, but most people don't. So how do you tell the difference between getting a good deal and "this is cheap because it's sketchy as all hell".
We also don't block all of Vietnam, or all Jio customers in India, even if we know that 20% of bot traffic is from those two alone.
20 hours ago [-]
likestosneed 12 hours ago [-]
> This is not Microsoft's fault.
Wait until this guy realizes that all spam these days comes from Azure ASNs, and abuses cross-tenant issues as well as a simple "Fwd: ..." and "Re: ..." tricks to bypass Microsoft Outlook spam filters.
system2 1 days ago [-]
Using self hosted email service is a big mistake in 2026.
SoftTalker 1 days ago [-]
Why are we so willingly ceding one of the few widely used free and open protocols to a handful of $mega-billion providers?
Experience shows that the walls will get taller and the moats will get deeper.
cromka 15 hours ago [-]
The irony is that if more people started to self host again, especially jogger companies, the problem like one exemplified by this post would be solved quickly.
newsoftheday 2 hours ago [-]
I'm not! Hosted my email since the 1990's, don't plan too stop. I do use the big services too but not giving my ability to use my own server.
cheschire 1 days ago [-]
Because the noise is so loud now that people are basically just coping with the stresses of work life by taking the easy path in the home life.
idiotsecant 1 days ago [-]
Because the protocol is flawed at its foundation - there is no good way to make sure that the person sending you something is a person and sending content you'd want to interact with. If the big providers weren't doing this stuff, we'd whine about the enormous amount of spam.
The solution is allow only communications that are demonstrably not spam and not unwanted.
There have been lots of proposals to this effect but maybe you have to put up two cents in a crypto wallet, which the other person can claim if the mail is unwanted. If someone takes your two cents, you remove them from your lists ASAP. The receiver doesn't benefit meaningfully from the 2c so they are unlikely to claim it. The sender is only damaged if a lot of different people claim the 2 cents. Maybe a few domains are default whitelisted even if they don't put up 2 cents, to protect against entities that are important but would be frequently spite-claimed (IRS, courts, and other similar). If you use a provider that doesn't whitelist, fine, but you're going to miss those emails.
Maybe the top 'spite claim' users are published and it becomes difficult to get people to agree to put up money to talk to you.
This reduces spam to the level of junk mail, which is still not totally trivial but is orders of magnitude more manageable.
cowlevel 18 hours ago [-]
> the protocol is flawed at its foundation - there is no good way to make sure that the person sending you something is a person and sending content you'd want to interact with.
There is and it's the same as other protocols including proprietary ones - a sender address whitelist.
There's no proprietary protocol that solved spam either.
croes 1 days ago [-]
Nearly all the spam I get has an email address from those providers.
Seems they are the disease not the cure
TaLiTr 8 hours ago [-]
I'm the sysadmin at my company and we regularly get emails spoofing our own addresses! It's wild that Microsoft can't even protect customers when they have all the info to do so.
anonreplier 1 days ago [-]
Mine isn't from those email hosts, but it from google cloud or Azure typically (not AWS for whatever reason). Related, the gmail spam filter is terrible.
SoftTalker 20 hours ago [-]
Most of my spam is from gmail addresses. Why Google hasn't figured out how to stop the fake Norton renewal notices is just mind-boggling.
Lately I've also been getting a lot from compromised MS365 accounts.
Frotag 23 hours ago [-]
>Related, the gmail spam filter is terrible.
It seems insane that gmail doesnt provide a way to automatically send a mail (eg based on domain, keywords, etc) to spam. I know theres block sender but for example aliexpress uses a different name for every email so that's useless.
pixl97 1 days ago [-]
I think you misunderstand the disease.
What this is called is survivorship bias. The question I would ask is how much mail are you not seeing at all because it's dropped at the edge first thing because it's IP block listed?
Next, how much spam are you seeing from them because they and Google are the largest providers on Earth? Kind of like selecting a random person from the population in the US and going "look, it's a white guy". Yea, that's how statistics works.
Lastly, because the are good at blocking spam at the edge, then that's the last bastion of attack for spammers to put their efforts in if they want any return at all.
cowlevel 18 hours ago [-]
I self-host and don't have a spam filter. Spam makes up about 1 in 5 messages I receive. It's always the same spam campaigns that would be easily filtered with a few regexes.
Self-hosting allows me to use a different receiving address for each entity I contact, so I know exactly who put me on spam lists and if it gets bad I can route that address to the garbage bin.
pixl97 6 hours ago [-]
It's been a while since I've been an SMTP server admin but when I was I managed a few hundred thousand mailboxes under different domains. Most likely know one knows about your domain and it has little traffic. On average I saw users domains get around 5 spam to 1 ham. Of course you have outliers. I had one domain that received around 1000 spam to 1 ham. That was a domain that looked like it could belong to a university and it got absolutely flooded.
Anecdotes are not a great thing to run mail servers on, broad statistics are.
unpleasurable 19 hours ago [-]
Sorry but bastions are defensive.
what 1 days ago [-]
> frequently spite-claimed (IRS, courts, and other similar)
These entities communicate via plain old mail, that costs more than 2 cents already.
timcobb 21 hours ago [-]
Spam is a super solved problem though and I'd rather have false negative spam than email oligarchy.
lakeviewterrace 21 hours ago [-]
A web forum's users, who love nothing more than using the "flag" button to stomp out comments they don't like, are indignant upon discovering the world's third largest email provider has a "flag" button of their own.
cowlevel 18 hours ago [-]
Third? What's second, Yahoo? I know Gmail is first.
waterTanuki 15 hours ago [-]
why do we cling on to the email protocol at all?
We have dozens of different ways to send E2EE messages to each other, with realtime publish-subscribe, and yet billions of dollars are spent trying to duct tape email. Who cares if Outlook/Gmail/Icloud use IMAP or Websocket? If the interface looks the same to the end user will they really care?
account42 14 hours ago [-]
Why are we so willingly ceding one of the few widely used free and open protocols to replace it with incompatible proprietary ones that don't interoperate?
Experience shows that the walls will get taller and the moats will get deeper.
waterTanuki 19 minutes ago [-]
So free and open that open source email clients/servers are the most popular and widely used /s.
Protocols aren't proprietary by definition. It's a protocol. Anyone can implement it.
ulrikrasmussen 1 days ago [-]
Sounds more like using outlook.com is a mistake. I've been running my own mail server for over 20 years and outlook.com is literally the only domain I have had problems with, and this is the only reason that I now send via Scaleway's free transactional email service.
The people working on outlook.com are just talentless amateurs - the rest knows how to do it right. It's a shame it's so widely used.
newsoftheday 2 hours ago [-]
I still run my own server and do not use a relay service and do host on a cheap (free actually, OCI) VPS and other cheap VPS's before that since the 1990's. In that time only one big email service blocked my IP by a large block range, twice...Microsoft but by filing a support request here https://olcsupport.office.com/ both times, they resolved in in less than 2 days. The second incident was just in the last several days so the request does work.
stdatomic 1 days ago [-]
I don't disagree, but what are your options when a giant portion of the population uses O365 and outlook.com? How are you going to get them to stop using it, so that legit emails from user-owned servers are not silently rejected?
Most of them wouldn't even care probably...
cowlevel 18 hours ago [-]
It depends on the nature of the transaction. If the user needs the email more than you do, you just remind them Outlook deletes your messages, and they'll find a way, and in the long term usage of Outlook will decrease.
ulrikrasmussen 1 days ago [-]
I use a sending service. I would prefer not having to, but at least all inbound email goes directly to my server.
raegis 19 hours ago [-]
I've also been running my own server for over 20 years, but do note that the big players may block their senders from delivering mail to your server. This happened to me with GMail around 6-7 years ago, until I configured DMARC and/or DKIM and/or SPF to their liking. As far as I know, they don't do a press release when they update their rules.
capitainenemo 19 hours ago [-]
I have a perfect score in google postmaster tools on dkim, spf and 0 spam reports. They still send all emails to spam. They will even do this if you are replying to the user who contacted you. Same experience for my friend running an indie festival. These days you pretty much have to alert gmail users by some other means (like if signing up on a website) that they have to check spam and whitelist you since it appears gmail would rather block legit emails than allow a single possible spam through.
aboardRat4 19 hours ago [-]
>I've been running my own mail server for over 20 years and outlook.com is literally the only domain I have had problems with
What about tencent.com, foxmail.com, or qq.com?
nbernard 1 days ago [-]
Alt take: Using a Microsoft-hosted email service is a big mistake in 2026...
bigstrat2003 1 days ago [-]
That may be so, but you can't control what mail service your recipients use. So whether or not it's a bad idea, it can be your problem. That said I don't agree with OP that self-hosting mail is a bad idea.
nekusar 1 days ago [-]
Yes you can.
User signs up, uses @outlook. Your app declines it and explains that they block with no way to remedy, and explain they are a bad vendor.
Scharkenberg 1 days ago [-]
Deeply unserious take.
nekusar 23 hours ago [-]
As unserious as you claim, we had this exact problem.
Emails would be accepted by Outlook.com, but would never deliver. We had SPF/DKIM/DMARC and full reporting. They RBL'ed us with no remedy.
We told the customer to not use outlook.com BECAUSE we told them we could not guarantee any delivery of messages.
cowlevel 18 hours ago [-]
Seems to work for many websites. But only if your users aren't giving you money, because it's 50/50 whether they'll use a different email address or give up entirely.
ethin 20 hours ago [-]
Lol if you do that, your service is just going to have a small minority of people and most people will just not bother using your app/service entirely
cowlevel 18 hours ago [-]
Most people aren't using Outlook. If your users mostly are, then this solution doesn't work for you. But it does work for many people.
drnick1 1 days ago [-]
You can take my email server from my cold, dead hands.
glum64 1 days ago [-]
Proudly self-hosting since 2001. My mail server is in my basement. Do not know what you are talking about.
mgkimsal 1 days ago [-]
How often would you be able to detect acceptance-but-non-delivery of your emails to office.com-hosted emails?
geek_at 1 days ago [-]
Always? If emails are not answered you'll usually notice unless you're a Spammer
aboardRat4 19 hours ago [-]
>Always? If emails are not answered you'll usually notice unless you're a Spammer
Means you're not using your email seriously. For example, to send CVs in response to job postings.
I send up to 20 email per day to people who have issues with their package build scripts, and I have no idea whether they ignore me because they stopped using the distro or because mail got dropped.
cromka 15 hours ago [-]
Does it ever get silently dropped or just filed straight in their spam folder?
alfiedotwtf 14 hours ago [-]
Silently dropped in my case.. that’s why I stopped self-hosting. Email hosting is sadly now a cartel
anonreplier 1 days ago [-]
MS live/hotmail/outlook would silently drop - although not for this DMARC, that gets a straight bounce.
TuringNYC 20 hours ago [-]
> How often would you be able to detect acceptance-but-non-delivery of your emails to office.com-hosted emails?
You should be able to see this on your DMARC dashboard
dizhn 17 hours ago [-]
Now watch the goal post moving at light speed. This site is by business for business. They can't stand self hosting. Saas or bust. No matter how much time you spend demonstrating the opposite the next time someone mentions email they'll get a backlash. It's mind boggling how it plays out the same every single time. But give them a saas that returns the next integer for $19.99/month and that "creator" will be praised for their hard work. :)
riedel 1 days ago [-]
This is what google and microsoft want the make you think for obvious reasons.
Fortunate for those running their own servers is that they actually still get all the cool emails from people not complying.
graemep 1 days ago [-]
Why?
At the most you need to use an external service for delivery (usually because you have problems with MS) but you can still run your own server with no difficulties once you do that.
That said, DMARC is required by a lot of people now, so I do not think this particular issue is a problem.
I have been self hosting my my personal email (and for family). Few problems so far other than delivery to MS and I have recently moved a domain I use for work email over.
Oddly enough the MS problems come from hotmail, but not other services. If that is a problem, then pay a bit to have email delivered.
BadBadJellyBean 1 days ago [-]
It's not enough. I have a domain that I had a very long time but it is on an undesirable tld. I got it long before it was problematic. Outlook always puts my mail in the SPAM folder even though I have done everything I could. I even deliver through a trusted provider. Not on any spam list. DMARC, DKIM, SPF all set up. No dice.
singpolyma3 1 days ago [-]
I've never had a problem not having dmarc. DMARC doesn't really mean anything. The security comes from DKIM (or SPF, but that's garbage)
unrented7977 1 days ago [-]
[flagged]
stephbook 1 days ago [-]
Sounds like something every mail sender should have done already.
Good for Microsoft customers and I don't care one bit for the lazy people who have to late-patch now.
ramijames 1 days ago [-]
I kind of have to agree. DMARC is not new. It's useful and helps make email safer. It's not even hard to set up. There's just no reason for any legitimate mail provider not to use it. Same for people who are technical enough to run their own mail servers.
stavros 1 days ago [-]
"Lazy people"? I only heard about this because a customer complained. Am I supposed to go around the Internet, checking what each mail server will allow or deny?
caymanjim 1 days ago [-]
No. You're supposed to understand how mail works on the Internet, and configure it correctly so that everyone else accepts it.
This seems overly dismissive especially for individuals who send emails from custom domains at low volumes. DMARC has previously been seen to only be really needed for high-volume senders. The mail testing service linked still gives 10/10 for emails received without DMARC (but with SPF and DKIK). My email is setup via Fastmail and I followed all the recommendations they provided (which didn’t include DMARC)
newsoftheday 2 hours ago [-]
I've had DMARC implemented on my low volume server since I learned about it 10 years ago, it's not that hard.
jcoulaud 1 days ago [-]
[flagged]
Rygian 14 hours ago [-]
Imagine that I deploy a site in HTTP-only, without TLS, and then complain "hey, why are browsers claiming that my site is insecure and showing some red padlock shenanigan, scaring my users away? Am I supposed to go around the Internet, checking what each browser considers 'secure' or not?"
saghm 1 days ago [-]
I just tried this out now with an email from my personal domain that I have configured to send via my gmail account. I got a 10/10, but DMARC does not seem to be required for this. It shows a yellow checkbox for me on this, the same as it shows for me not having an unsubscribe button, which hardly gives the impression of it being necessary, given that I would not expect an unsubscribe button to make sense for most people manually sending emails to their customers from corporate email accounts.
svdr 1 days ago [-]
This service is not accurate, it cannot handle multiple dkim keys.
daneel_w 1 days ago [-]
Not enough. O365 still discard/lose e-mails.
adamors 17 hours ago [-]
The funny thing is, my domain with Fastmail gets 10/10 and I didn't have a DMARC policy configured. So you're being dismissive when you don't even know what you're talking about.
cromka 15 hours ago [-]
How about you read other testimonials in this thread and dial down your patronizing mouth?
rednb 1 days ago [-]
To be fair, DMARC has been required for a very long time. IIRC Google warned about 2 years ago circa that non-compliant emails would land in spam or be null-routed. And the DMARC noise started even before that.
mike_hearn 1 days ago [-]
Gmail only requires DMARC for senders that send >5000 emails per day. Below that it's not required. That rule only appeared in 2024 so I wouldn't say it's been required for a very long time. Perhaps you're thinking of DKIM, which is different.
castwide 15 hours ago [-]
Google required me to add a DMARC record for a domain that doesn't even send 5000 emails per year. I suspect it was because of another mail server that shared the same subnet but was not under my direct control.
jared_stewart 1 days ago [-]
You don't have to, this is the key reason to have a DMARC monitoring service. It will tell you when there's a deliverability issue with some particular receiver.
DMARC applies not on your mail server, inbound or outbound, but on the server that is receiving your mail (which may in fact be your mail server).
That server will look at how the mail authenticates and decide if it should allow the mail to proceed, it (for the most part) will then tell you whether or not it allowed the mail. This is how you will know you might have a deliverability problem before your customers do.
> You don't have to, this is the key reason to have a DMARC monitoring service. It will tell you when there's a deliverability issue with some particular receiver.
It's been a while, but monitoring DMARC seemed pointless once you got things started. If my outbound mail fails to validate, I've asked the receivers to bounce it, and I should be able to see that on my own system.
Otherwise, I'm just getting reports about spoofed spam or people who need to adjust their mail forwarding, but I can't do anything about either.
jared_stewart 1 days ago [-]
right, if you're at a reject status DMARC monitoring is (and should be) boring.
But it provides a safe guard against accidentally broken mail flows as your email stack evolves over time which is where it pays dividends.
I would love to say that it would have alerted you ahead of time to this particular event, but given that it's the fix here you would never have seen it.
stephbook 1 days ago [-]
If running a mail server is central to your business, you should keep up with best practices. If not, 2 days of non-delivery aren't important, just resend.
reynard_le_faux 1 days ago [-]
As a company we realised about 12 months ago that email can no longer be considered a reliable method of communication. I understand the reasoning but the result is the result. Many new clients we deal with have whitelists on and we have to pester our clients to add us to their lists. Not a great experience for anyone. I think we should consider email pretty much moribund at this point.
urbandw311er 1 days ago [-]
It is literally one of the last free and open channels on the Internet – I suggest you work on supporting its use and keeping it that way rather than moving to something controlled for profit or data harvesting.
SoftTalker 1 days ago [-]
It being free and open is exactly what the big providers can't stand and why they are coming up with ever more "standards" that are complex to configure as well as "reputation" scores that are hard for small senders to clear.
Also why they do non-standard stuff like accepting mail but then simply not delivering it, rather than bouncing it.
nine_k 1 days ago [-]
DMARC is not hard.
"Reputation scores" and blacklists / greylists started in late 1990s / early 2000s as multiple grassroots efforts when spam started to overwhelm systems. Gmail did not exist, outlook.com did not exist, it was easy and expected to run your own SMTP (which I did). And it was very unpleasant.
DMARC appeared 10 if not 15 years ago. There's no reason for a sane MTA configuration not to have it.
jonathanlydall 18 hours ago [-]
Outlook.com is a rebranding of Hotmail.com which absolutely did exist in the 90’s.
nine_k 16 hours ago [-]
Indeed, Hotmail was sold to MS in 1997, which I incorrectly remembered to have happened past 2000.
expedition32 1 days ago [-]
Microsoft has provided free email addresses to the public for decades.
pixl97 1 days ago [-]
There is no such thing as a free and open channel on the internet that will not suffer the tragedy of the commons.
anonymous908213 1 days ago [-]
Calling it a "free and open channel" when 80% of consumers are on Microsoft/Google addresses that control who can deliver e-mail is laughable. It's dead, Jim.
urbandw311er 1 days ago [-]
Fair point - I meant free in the sense that the protocol is open. I didn’t mean that it’s not under threat.
stephbook 1 days ago [-]
You seem to miss the point WHY customers go there. I, for one, switched when I realized Google filters spam effectively.
theK 1 days ago [-]
That WHY seems to only address a very small slice of the market. Some other WHYs I've encountered
- it was a way to outsource the mail server administration and already free in our corporate package
Which is pretty much all I have from the corporate side. On the personal or small business side its most often
- I don't really care that much about running my own stuff
- I needed a personal email address
All these are valid reasons/motivations but none explicitly argue that email messaging should become proprietary.
cowlevel 18 hours ago [-]
It can be reliable, but requires an explicit agreement between the two parties. When my server connects to your server and sends a message, that part is reliable enough. If your server decides to delete the message after receiving it, that's entirely on you. You could configure it to never delete messages from me and then it's fine. The problem is that in reality nobody does this, so your vendors and customers get treated identically to random spammers.
rednb 1 days ago [-]
Strengthen your contracts / terms of service. Make it their responsibility to configure their email systems properly so they receive emails sent from your domains.
saagarjha 1 days ago [-]
So what have you switched to instead?
aboardRat4 19 hours ago [-]
Most of the world has switched to sending SMS to user's phone numbers.
SoftTalker 1 days ago [-]
Postal mail still works.
EGreg 1 days ago [-]
Spoiler alert: no method of communication is reliable anymore. All of them are controlled by companies that will route your messages to spam.
threatofrain 1 days ago [-]
If reliable means the message gets through no matter what, then it's good that no channel is reliable. Such a channel will inevitably be used for spam and attention grabbing.
dofm 1 days ago [-]
Delivery to Microsoft's products has been patchy for several years. I am not remotely an email deliverability expert but I have made different SMTP service choices based on how companies approach shared-IP sending plans.
Some can affordably deliver to Microsoft because they aggressively police what they are actually sending on their customers' behalf; others don't get involved and you end up having to spend a fortune on a dedicated IP.
The DMARC thing is just another part of this; one of my clients discovered this silent failure themselves a few weeks back and addressed this.
jeroenhd 7 hours ago [-]
Hey now, it's not just lazy people, some people set up a mail server twenty to thirty years ago and don't care about all that newfangled tech like DMARC or DANE or IMAPv4.
Too many companies run on incredibly frail email configurations (while at the same time asserting that an hour of downtime on their email is a catastrophic business risk).
Configuring your SPF wrong but everything still sort of working because DMARC doesn't explicityly say anything can be a feature. I guess the time may have finally come for those companies to pay decades of technical debt.
0c3ca83 1 days ago [-]
DMARC is a DNS record that says "send emails about spoofed messages here", or optionally "I don't need you to tell me that scammers exist on the internet".
It doesn't prevent spoofing, it doesn't say which IPs are authorized to send on behalf of a domain, it doesn't sign messages. Spoofed messages are still sendable.
Can you explain the benefit of only accepting email if Microsoft knows that you may or may not accept emails about scammers unsuccessfully spoofing your email domain? (Note, there's nothing you can do if they do tell you.)
Don't confuse DMARC with DKIM or SPF; DMARC doesn't actually do anything for email security.
basilikum 1 days ago [-]
That is not true. Reports are just one of the features of DMARC. The policy which allows you to instruct senders what to do with unauthenticated emails is the much more relevant part an when the receiver follows it, it very much does prevent spoofing.
0c3ca83 1 days ago [-]
And what should a provider do if the dmarc policy says that none of the dkim or dmarc records should matter? What was the point of spf saying what servers could send, or dkim specifying signing keys?
"Oh, please, don't ignore the other two ways I told you to ignore unauthorized messages" shouldn't need a knob.
basilikum 1 days ago [-]
You are a mail server.
You get an email without a DKIM signature from me.
Is that because I do not use DKIM and do not sign my emails or because the message is forged and not from me at all?
You cannot tell. There is a single SPF record that you can look up to see if SPF is configured. It's just a TXT record on the domain. But there is no standard DKIM record. A DKIM signed email tells you what key identifier it used and you have to use that to look up the DKIM key at <key identifier>._domainkey.<sender domain>. When the email has no DKIM signature you cannot tell if that's because the sender domain does not use DKIM or if it does have a DKIM key record but it was not used, potentially because the email is forged.
0c3ca83 1 days ago [-]
Right. And if you mandate dkim, as seems to be the case with servers that demand dmarc, what's the issue? You reject the emails where dkim isn't set.
Or do you think it's critical to support mail that doesn't have dkim?
basilikum 24 hours ago [-]
You'll have a bad time if you just drop all emails without DKIM. There are many large senders that do not care about well established email standards and you will drop important emails.
0c3ca83 23 hours ago [-]
These are the same senders that are correctly configuring DMARC?
basilikum 10 hours ago [-]
You said DMARC does not prevent email forgery. I simply corrected you on that and explained what DMARC does.
Setting a DMARC policy that allows unsigned emails is easier than configuring DMARC signing including key management. It's just adding a DNS record. Although large senders should of course do DKIM and it's not that hard either
But I'm not arguing with you about whatever Outlook did.
1 days ago [-]
LeonM 13 hours ago [-]
> Don't confuse DMARC with DKIM or SPF; DMARC doesn't actually do anything for email security.
DMARC doesn't introduce a new security mechanism by itself, but it fixed a few bad security flaws in SPF and DKIM. Without DMARC, SPF and DKIM do not add meaningful security.
DMARC updated and formalized how receivers should handle authorization and authentication of inbound email by adding the alignment requirement. Alignment ties the SPF and/or DKIM domain to the rfc5322.From domain. This also allows receivers to use domain reputation rather than IP-reputation.
SPF by itself has a bad design flaw that completely breaks any security that SPF was supposed to provide. By adding DMARC this security hole is fixed. (Although SPF is still horribly unreliable, it should be considered legacy at this point, don't rely on SPF).
DKIM benefits from DMARC alignment requirement too. DMARC ties the rfc5322.From domain to the DKIM signing domain, which makes DKIM practical for sender authorization, not just authentication.
23 hours ago [-]
rjsw 23 hours ago [-]
DMARC gives you 20 reminders that you have sent an email, just incase you had forgotten.
gtech1 1 days ago [-]
lol, what a bunch of bs.
gmail runs with p=none
so tell me what benefits that has over having no dmarc record at all ?
LeonM 11 hours ago [-]
> so tell me what benefits that has over having no dmarc record at all ?
The the existence of a DMARC assertion record in the DNS changes how the MTA (the receiving system) assesses the authentication of the message and authorization of the sender with SPF and/or DKIM, as per rfc7489 (and now also rfc9989).
No DMARC results in the MTA falling back to the original assessment method as defined in the original SPF and DKIM RFCs. These RFCs have design flaws and don't define the assessment flow all that well, they leave a lot up to the MTA's digression/interpretation.
So, the existence of a DMARC record with p=none is fundamentally different over not publishing a DMARC assertion record at all. It's just that with p=none you don't enforce the MTA to reject the email if it fails authentication/authorization, you're leaving it up to the MTAs digression.
gtech1 5 hours ago [-]
that's not new for Hotmail/Outlook. They were _already_ requiring SPF or DKIM.
So how does them enforcing requiring a p=none record change that ?
sshine 1 days ago [-]
Yeah, and people who don't switch to Dvorak are lazy, too!
I have MCP servers for the creation of domains, DNS records with DNSSEC, and email accounts with SPF, DKIM and DMARC. I'm sure if someone wants to be a professional spammer today, DMARC is not a differentiator.
BLKNSLVR 1 days ago [-]
It's an interesting argument. The fact this article exists is somewhat proof that it is a differentiator. The flipside, however, is that spammers very specifically require their emails to get to add many mailboxes as possible, so their motivation is greater to make their emails service compatible.
Company sys admins have likely got all sorts of other issues to worry about, and the occasional report of an email not getting through is likely low on their to-investigate list.
Having said that, I self host a mail server, and have all those things setup correctly, and my workplace uses Outlook, and I've not had issues with delivery, so it's not a particularly difficult bar to jump.
saghm 1 days ago [-]
What? How does it prove it's a differentiator for someone who wants to be a spammer, which is what the comment you replied to made a claim about? As far as I can tell, it's evidence (not proof) that Microsoft thinks that they will reduce spam by requiring it, which in turn is circumstantial evidence (definitely not proof) that spammers might have to spend some amount of effort to start using DMARC. I don't understand how you can conclude that it would be onerous for them to do so indefinitely; it seems equally plausible that they might have just not bothered to do it before now but will be able to start doing it without much cost.
klodolph 1 days ago [-]
I set up DMARC on my personal domain so long ago I can't even remember when I did it. 10 years+?
I had kinda assumed that a lot of providers would start rejecting domains without DMARC support. I'm surprised it's happening this late.
teekert 1 days ago [-]
This was my second hackernews submit [0]! So, not even https in 2014 :)
When I ran that server, outlook.com was also the only one that would blackhole my email for no known reason. Support was unhelpful and also could not point to any reason. I've since given up, but for a short time it was glorious, email to family would not leave the lan and we could send attachments of arbitrary size.
You adopted it the moment it was announced? Really?
Is there a risk some people on this thread are mixing up DKIM and DMARC?
DKIM = proving that an email was sent from a specific domain using cryptography. Good for spam fighting and deliverability.
DMARC = telling receivers how to handle mail that fails authentication.
DMARC is primarily useful for large, complex organizations where email admins may not be aware of everyone inside the org who is sending mail that advertises the domain in the From header, or organizations that might be targeted by impersonation attacks (e.g. phishing). Being able to tell recipients "yes we absolutely have our act together so feel free to reject or spamfolder unauthenticated email" is great for killing phishing campaigns, and being able to request reports is great for finding that one sales org that signed up for a guerrilla marketing SaaS that's impersonating them.
But for small personal domains the value isn't that high.
klodolph 20 hours ago [-]
I added DMARC and DKIM together, around the same time as some particular life events 10 years ago. Just now, I cross-checked the information against the commits in my Git repos.
Back then, I didn’t use Terraform or anything like that, but I had text files with logs that described the DNS setup in detail so I could fix things. By grepping through the logs, I’m able to put a definitive bound on when I added DMARC—it was no later than June 2016, over 10 years ago.
At the time I thought, “Obviously, we should all be setting this up, because recipients will start rejecting mail from insecure domains, if they don’t already.” This was also back when I self-hosted email. I eventually stopped doing that because I thought it was too time-consuming.
waste_monk 17 hours ago [-]
>DMARC is primarily useful for large, complex organizations
>But for small personal domains the value isn't that high.
I don't understand the resistance. It benefits the entire mail ecosystem, not just mass senders.
SPF used to be niche thing, then everyone realised it's a good idea and it became more-or-less mandatory. Same with DKIM. Now it has happened to DMARC as well.
bawolff 22 hours ago [-]
> DMARC = telling receivers how to handle mail that fails authentication.
No. DMARC is about if the from address has to match the address used in dkim/spf
gnabgib 22 hours ago [-]
No DMARC is about telling receivers which of SPF/DKIM are valid, what to do with it when it fails, and where to send a report to. Oh look.. like Mike said.
bawolff 21 hours ago [-]
To be clear, I am saying this is incorrect.
DMARC is primarily about "alignment" (switching SPF from caring about the envelope sender to instead using the from header). Yes, it does also tangentially address those other points, but the primary reason it was adopted was to prevent spoofing of from headers (where in original spf that was a non-goal)
drdexebtjl 22 hours ago [-]
> You adopted it the moment it was announced? Really?
A specification exists since 2012, 14 years ago. 10 years ago it was already old.
pembrook 23 hours ago [-]
Email is the largest social network on earth (8.3 Billion addresses)
10 years is nothing. I'm sure there's still millions of companies globally who still aren't properly signing mail with DMARC.
alfiedotwtf 14 hours ago [-]
Then it’s dying. I don’t know a single person under 30 who uses email NOT for work
jeroenhd 7 hours ago [-]
People also use email to sign up for accounts, and sometimes still for handing in homework.
That's pretty much all email is good for these days. Even in business, Slack/Teams/Mattermost has replaced a lot of 2000s email communication.
pembrook 10 hours ago [-]
The fact that email is for work is why it will never die.
No, you will never be contacting your bank over Instagram DMs or getting hotel confirmations via Facebook or dealing with governments over Youtube.
Nobody sends physical mail to each other anymore either, yet last mile delivery is as important as ever.
codethief 1 days ago [-]
Outlook.com has quietly dropped[0] emails from certain domains/IPs for years, even with SPF/DKIM/DMARC all properly set up and no history of spam. As someone who's administering their own mail server, Outlook has been the bane of my existence.
[0]: As in: They accepted the email just fine (according to the logs) but it still didn't end up in the recipient's mailbox.
I thought they've been doing this for years, along with gmail/etc. I basically just added setting up the correct DNS records as part of business when sending emails externally.
jmathai 1 days ago [-]
You can send an email through mail-tester to see what you might be missing. https://mail-tester.com/
green-salt 7 hours ago [-]
Exactly! Was pretty sure these existed, makes that part of email hosting setup easier.
Tree1993 24 hours ago [-]
I self-host my email system and rarely send any outbound email. Occasionally I receive emails from individual users. Users on Microsoft’s email service can send emails to me, but my replies are rejected outright. This doesn’t happen with Gmail or other email providers.
Grimeton 23 hours ago [-]
The only mistake people make here is to accept that the problem is on their end even after Microsoft has accepted the e-mail but silently discarded it. This leads to the customer impression that the mistake happens on their end and not on Microsoft's.
When I see in my logs that the e-mail has been successfully delivered to their MTA then I don't have a problem.
cowlevel 18 hours ago [-]
Yep. Let's say for example you were sending a legally important email saying you did something, and your customer tried to sue you over not sending the email. If you sent it and the customer's agent (Microsoft) dropped it, that's a problem between the customer and their agent, and you are not liable.
(If this happens to you, don't admit that you know Microsoft drops your emails, or you'll be liable again!)
verandaguy 1 days ago [-]
This is interesting. At some point, I think it'll be desirable to give increasing positive weight to emails with the DPF/DKIM/DMARC trifecta configured, since those are least likely to be problem emails (spam or phishing), but I wonder what the best avenue is to actually make that the default. It's almost certainly not this kind of unannounced cutoff.
Email is, I think, among the most distributed popular online services, and there's a ton of stuff that's legacy, self-managed, or otherwise janky. Supporting SPF, DKIM, and DMARC does put a burden on independent operators, but is it an undue or unreasonable one in the current landscape? Or is it just the new cost of doing business?
stevekemp 1 days ago [-]
It seems like 90% of the spam I receive (on my google account) is sent from google addresses, so it will have valid SPF/DKIM/DMARC setup.
That said checking for these things is a good idea, the only problem I see is dropping the mail on the floor, rather than rejecting it at SMTP time - at least that lets the self-hosting users who haven't got things configured know their email is being rejected, and to pick up the phone instead.
There's nothing worse than sending an email, it being accepted, and then later discarded with no clue to either sender or recipient.
shye 1 days ago [-]
Selection bias: you don’t see the spam that get rejected at HELO.
cowlevel 18 hours ago [-]
My server doesn't reject anyone, but does greylisting. That's a default setting in Postfix. It means the first time an IP address connects it gets a temporary error. If it retries later the message is accepted. That's the only anti-spam measure I have.
Maybe 1 in 5 emails I get is spam, and because I use a different address with every sender I know who sold "my" address to a spam list.
qsfp28 1 days ago [-]
[dead]
anonymous908213 1 days ago [-]
> but is it an undue or unreasonable one in the current landscape
Yes. In the first place, this should not even be a thing. Two corporations should not be in control of who can send e-mail. If they want to mark not having DMARC as spam, mark it as spam, or better yet flag it with a specific warning about the domain, but these games with refusing to deliver are just bullshit and essentially force a monopoly where other e-mail providers cannot compete because their e-mails aren't delivered.
mike_hearn 1 days ago [-]
No, not delivering is much better. You get a clean error message that tells you exactly what to do, it can be fixed in minutes. Spamfoldering email for not having DMARC would be a mistake, it might be years before low volume senders notice and figure out what's wrong (if they ever do).
anonymous908213 1 days ago [-]
> You get a clean error message that tells you exactly what to do
We are literally talking about a situation where this is not happening! And the problem is that it's not just this. Once you give them a license to police e-mail, they start policing e-mail for all kinds of arbitrary and inscrutable reasons. If this were going to be done, it should really be formalized as an industry standard by an independent consortium, not up to the whims of Microsoogle.
mike_hearn 1 days ago [-]
Are we? Microsoft is bouncing emails with instructions on what to do.
DMARC, DKIM and the rest are industry standards set through an independent consortium (it's called the MAAWG iirc)
stephbook 1 days ago [-]
> I wonder what the best avenue is to actually make that the default. It's almost certainly not this kind of unannounced cutoff.
En contraire, I think not delivering mail is the fastest way to adoption. People will use an old system for as long as it works. It now does not anymore.
verandaguy 1 days ago [-]
I don't know. I think this disenfranchises a lot of independent operators, and the blow of that could at least be softened by making a highly-visible public announcement about it a few months ahead of time.
Maybe you're right that just enforcing it is the way, but I don't agree with doing that with no heads up.
jwr 1 days ago [-]
Most spam I get is from Google, Microsoft and Amazon. We should pressure those to start dealing with the problem. Right now they are conveniently ignoring it.
rcxdude 1 days ago [-]
None of them are a good 'Is this spam?' heuristic, though. All they do is ensure the sending domain isn't forged, but most spam, even phishing emails, doesn't really rely on that. Spammers are much more motivated than average to jump through the hoops necessary to set it up, as well. Any anti-spam signal needs to be much more expensive for spammers than regular senders.
9029 1 days ago [-]
I could be naive, but I don't see how this would be any more unreasonable than requiring HTTPS
cowlevel 18 hours ago [-]
Requiring HTTPS was very unreasonable. You have so many more moving parts that can go wrong, and a business relationship with a CA (even if it's Let's Encrypt). We only tolerate this because the alternative is worse.
esikich 1 days ago [-]
There's no burden whatsoever. It's a one time setup that takes like 15 minutes.
verandaguy 1 days ago [-]
That is a burden definitionally, though; and that's to say nothing of the effort required to understand the technology and its impacts on operations.
esikich 24 hours ago [-]
You can literally just Google a 3 step guide for any provider. What are you even arguing? That security for infra shouldn't be a thing? Should grandma be able to run a mail server? What's your point?
verandaguy 23 hours ago [-]
I'm arguing that with a system as distributed as email, there will certainly be people who won't do this upgrade; I'm highlighting the contrast between the need for this set of technologies (SPF, DKIM, DMARC) and the utility of an old-school open web where the barrier to entry is low and anyone can participate.
We have seen a massive erosion of the latter aspect of the web in the past few years, and I think it's useful to frame conversations in terms of that loss. The web used to be fun, and now it's become, more than ever, a professional enterprise. You often can't stand up a website without having to buy into Cloudflare's DDoS protection or something equivalent. I think this is absurd, and it's not the only such case, though these changes are obviously reactions to how usage of the web's evolved over the years.
I wonder if we can get the old web back in some way, shape, or form, cause I think we've lost something with the corporatization of the internet.
And for what it's worth, yeah, I think grandma should be able to run a mail server. Why not?
2000UltraDeluxe 9 hours ago [-]
It's perfectly doable for a hobbyist to set up email authentication properly. It requires some effort, sure, but it's not so hard it prevents you from running your own email server.
himata4113 1 days ago [-]
I actually totally agree with this. There's too much risk involved with scams disguised as legitimate services because the developers of said service couldn't be bothered to add 1 or 2 dns records.
Although there seems that there hasn't been any communication which is the bad thing here. However, nobody looks at those and sending detailed emails back seems like a good enough solution.
itopaloglu83 1 days ago [-]
Maybe they should also work on what their users are sending as well.
himata4113 1 days ago [-]
Unfortunately, the people abusing these are very persistent and adding more checks will just increase the sophistication of such attacks which works against the interests of the target.
This stops disguising yourself as a legitimate service.
SoftTalker 1 days ago [-]
Charge for the service. How much spam do you get from Fastmail?
paulddraper 1 days ago [-]
If they did that you’d decry censorship.
Allowing basically ~whatever, but proving the sender address is an obviously good approach to me.
almost 1 days ago [-]
I don't know what "v=DMARC1; p=none;" is proving to anyone when DKIM and SPF are already aligned but sure whatever. Just wish they'd given some warning!
himata4113 1 days ago [-]
email is weird, without this it doesn't perform the checks at all
semolino 1 days ago [-]
Agreed. There's no additional verity provided by adding a DNS record with a static line of text. Reminds me of airport security theater: meaningless hoops for citizens to jump thru under the guise of stopping bad actors.
subset 23 hours ago [-]
On an unrelated but frustrating "silent behaviour" note, I hate how Outlook rewrites URLs to add their "safe links" domain indirection. Just show me the damn raw URL!
stevefan1999 15 hours ago [-]
Well, if we can get a more relaxed email self hosting experience with the DMARC enforcement, I'd say it is a good trade-off in exchange with freedom of speech, rather than accepting the risk of spamming.
These days, hosting a proper mail server isn't really that hard, thanks to Stalwart https://stalw.art/. I did it to my Talos Linux cluster located on LA and utilizing idle resources. It is pretty great
tjwds 1 days ago [-]
> Quietly Rejecting Email
> The sender gets a bounce
?
cowlevel 18 hours ago [-]
"quietly" is a sign that an LLM wrote it
Aachen 1 days ago [-]
My first thought as well: how does one quietly reject email? Skimmed the comments and clearly it's not quietly. Saved a click...
It's quiet only if the server accepts it and then deletes it on their end without notifying the sender, but if your mail provider shreds your mail that's then also your provider's responsibility and not the sender's
kevincox 12 hours ago [-]
Lots of big email services do quietly reject mail. They successfully accept it but then throw it away (sometimes not even in the spam folder for particularly high span scores).
Aachen 8 hours ago [-]
That's their issue. Don't be a customer at such an email provider :shrug:
I had a legal dispute once where a shop didn't provide warranty on a product. They took the product in but then it was indefinitely in repair. Long story short, it ended up being helpful that I have email server logs that show every transaction, so that I could say "on date+time the email was delivered to IP address X, which was registered as the mail exchanger for your domain, and your server took the email with status code XYZ Queued <ID> For Delivery." Would have been interesting to hear what a judge has to say about it but they simply agreed to give the full purchase price back after that
Afaik that's not what Microsoft/Hotmail does though: since it rejects noncompliant setups (as well as a lot of legitimate email, unfortunately), the sender gets a delivery failure notification
dboreham 23 hours ago [-]
Replying to all inbound messages with a bounce is an old idea. The theory was that legitimate senders would validate their address and get added to a white list. The scheme didn't work for the same reason captchas don't work.
Aachen 13 hours ago [-]
Maybe an old idea and you can feel about it however you want, but it's still in universal use right? So it's not quiet or am I misunderstanding what you're saying?
6 hours ago [-]
ofcrpls 1 days ago [-]
I have the opposite problem. I have a 3-letter email address, so for ease of giving out the email address, I use it, while having it forwarded to my Gmail. Somewhere around 2019, emails from legitimate services, especially password reset/OTP codes, stopped landing in my inbox or even junk because my address is so high up the chain of spammers. Nebula was the first to confirm this for me and work out of band to re-enable access to my account - their emails to me were bouncing. But ever since that happened, I’ve slowly moved back to giving my Gmail.
"ARC was devised to solve this problem by giving intermediate servers a way to sign the original message's validation results. Even if the SPF and DKIM validation fail, the receiving service can choose to validate the ARC chain. If it indicates that the original message passed the SPF and DKIM checks, and the only modifications were made by intermediaries trusted by the receiving service, the receiving service may choose to accept the email."
ofcrpls 20 hours ago [-]
[flagged]
cowlevel 18 hours ago [-]
Sounds like Gmail is the one blocking it. Stop forwarding it to Gmail and set up email directly on the address.
NooneAtAll5 1 days ago [-]
huh
maybe someone was too lazy to set up "inbound block list" and just did a total blackout instead?
cowlevel 18 hours ago [-]
It sounds like Gmail is seeing 3000 emails a day coming from foo@bar.com, some of which are different kinds of spam, and reasonably concludes they are a spammer.
cyrusmg 11 hours ago [-]
Since yesterday my email started getting blocked. Does anyone know what's going on ?
5.4.1 smtp; 550 5.4.1 Recipient address rejected: Access denied.
For more information see https://aka.ms/…ors
<redacted>.eurprd02.prod.outlook.com 2026-11-08T19:48:58.651Z <redacted>]
dwm 10 hours ago [-]
You could consider following the URL in the bounce message. Or searching online for the particular error code, which quickly turns up:
- I checked online and they do have this email address listed on their pages
- This affected 2 separate domains served by Microsoft
- I sent them an inquiry email now from my @gmail.com and no bounce was returned so far
EDIT: Also gmail got the error response, so I guess it's really up to the outlook server these unrelated entities use...
jeroenhd 7 hours ago [-]
Check blocklists for your domain and IP address (and many ASN if you're sending to certain MS servers). The DMARC change has a specific error message ("Message lacks SPF/DKIM/DMARC Auth Records").
Or whoever you're emailing has blocked you for some reason; perhaps your email was marked as spam before, or you/your mail server/your automated tooling has ignored bounces and has crossed a mail server threshold.
esikich 1 days ago [-]
As they should. You should have done this 5 years ago. Takes like 10 minutes. Gmail has been rejecting them for years at this point.
xmddmx 1 days ago [-]
"Google has been rejecting them for years..."
Not true, at least in my experiences.
I have a bunch of email accounts which have SPF and DKIM, but are missing the DMARC line - I've had no deliverability problems at all, until this weekend, and now only with Outlook. Emails to Gmail accounts go through just fine.
The combination of:
√ Valid SPF
√ Valid DKIM signature
X Missing DMARC policy
Is clearly ambiguous. Since a DMARC of "p=none" (in the context of valid SPF and DKIM) really adds no information, so interpreting "missing DMARC" as "p=none" seems reasonable. Sounds like Microsoft was taking that approach until this weekend.
I wonder if there's an actual written standard?
jared_stewart 1 days ago [-]
Under RFC 7489 [1], a domain with no DMARC record simply has no DMARC policy, the receiver is able to enforce whatever policy it likes.
Most receivers have chosen to treat this as p=none for the last decade (Microsoft included). This is changing to now so that mail with no record is simply refused. Nothing in the standard prohibits this.
a DMARC of p=none might be seen as ambiguous - SPF and DKIM have their own jobs and they work. However, the point of DMARC is not a new way of enforcing mail authentication. Instead it is a way of making certain that the mail is internally consistent and furthermore provides two additional things.
1. it indicates if the domain owner has thoroughly gotten their mail to authenticate (in which case they adopt a p=reject), and
2. it provides a feedback mechanism that allows the domain owner to know if they are seeing authentication and deliverability problems in such a way that they can fix those broken mail flows.
Googling around this started at least a year ago, but I worked at an MSP 3 years ago when it was first announced and we started getting customers into compliance. This wasn't something out of the blue.
origini 11 hours ago [-]
I don't get the Email thing anyway.
I had an email server and configured everything by the book. Still some scammer were able to send emails which looked like they came from me, so i got responds back.
If not even this was fixed...
whh 11 hours ago [-]
That's what DMARC and DKIM can help with. If you have `p=reject` then anything failing your DKIM check will be rejected by the recipient mail server (if it supports DMARC)
wbkang 1 days ago [-]
This is a good thing for the actual email users. The volume of really obvious “spam” emails were through the roof that it became quite tedious to rescue legit emails. It’s not like setting up DMARC is hard either.
cowlevel 18 hours ago [-]
If it's not hard, what stops spammers from doing it?
physhster 1 days ago [-]
Tangentially-related: Gmail has started sending completely legitimate emails to spam. DMARC/SPF/DKIM (2048 bits) all properly configured of course so there has to be something else that isn't documented.
codethief 1 days ago [-]
They have been doing that for years. A long time ago there was a submission here on HN about some Ivy League college urging college applicants to provide something other than a Gmail address because application-related emails (including acceptances!) would frequently not get through.
Astronaut3315 23 hours ago [-]
Started? My Gmail spam filter has been broken for several years now. Extremely obvious spam regularly ends up in the primary inbox and critical, fully legitimate messages get buried in spam. It’s a major reason why I left for another provider.
chrismorgan 19 hours ago [-]
Gmail send their own service notifications to spam.
netik 1 days ago [-]
This has been going on for much longer than stated here - we had domain mismatch issues with outlook going back years and our policy was p=none. They’re very sensitive and mailing lists with forwarding are heavily impacted.
tzury 8 hours ago [-]
the problem is Gmail accepting emails from domains that have no MX records!
Even lazy spammers, who didn't even bother to create MX records for their fake, auto-generated domain, are getting into Gmail (Spam folder mostly, yet, why not reject it entirely?)
nottorp 13 hours ago [-]
I gave up last month and set up the outgoing email for my personal domain to go through the free tier of smtp2go.
Receiving is still self hosted.
saagarjha 1 days ago [-]
Mail security non-expert here, is this going to affect people who use alternative addresses for their Gmail account?
gushie 1 days ago [-]
It affected my google workspace account
saagarjha 1 days ago [-]
Do you know if it’ll affect my (personal) account? I run everything through a normal Gmail account and have forwarding for incoming email and an alias for outgoing stuff
MrDOS 8 hours ago [-]
If you're using Gmail's “Send As” feature to use a different SMTP server for outgoing mail, then yes, you must have a proper DMARC TXT record configured on the domain you send from (even if it's just `v=DMARC1; p=none`).
It shouldn't affect you. DMARC policies apply to the authenticated domain, which is Gmail.
jonah 1 days ago [-]
I had an email kicked back to me from Hotmail this past week complaining about missing DMARC. I fixed that and subsequent messages went through fine.
27bstroke6 1 days ago [-]
I’ve been anticipating something like this for a while; the number of folks who don’t have their email-related DNS settings in order is remarkably high.
alrtd82 20 hours ago [-]
Rejecting emails from some domains. Why would emails “to” these domains also bounce back?
That's an old announcement about a different change. As far as I can tell this one is completely out of the blue. I'm shocked by the number of people in this thread advocating for spontaneous changes without any warning.
hedgehog 1 days ago [-]
That says for "high volume senders" but they now apply the rules regardless of volume.
jared_stewart 1 days ago [-]
Yes, this is an older announcement from last year. Yahoo and Google did the same at that time.
The failure associated with that announcement is different. It is 5.7.515.
This new failure mode is "5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records (AS9031519)", I haven't seen any formal announcement on my end. The important thing to know about 5.7.1 is that it represents a few different failure modes, the AS9031519 is the important bit and it indicates that the domain lacks a DMARC record.
ranger_danger 1 days ago [-]
Is there any actual evidence of this outside of this one company's AI-generated article?
jared_stewart 1 days ago [-]
There's been ample evidence of this, many different blogs, notification emails etc.
My mail provider, MXroute, sent me a notification of the issue early yesterday. There is commentary from various DMARC providers (Suped and PowerDMARC). This is a real thing.
It does not matter which host you are using, this has nothing to do with the hosting provider. It has everything to do with having your domain correctly set up on DNS so that anybody receiving mail will know how to authenticate it. Microsoft has apparently advanced a policy that if you don't even try you don't get to send.
IMO this is the right call, I've seen plenty of spoofing attacks where the attacker took advantage of nonexistent policy on non-sending domains. You might think that if you don't have an MX record the domain can't be used to send mail, that is wrong. The MX record only tells others where to send your mail, it says nothing about whether the domain can send mail itself.
majorchord 1 days ago [-]
Ample evidence that the policy now extends to low-volume senders? Could you provide even one example?
hedgehog 17 hours ago [-]
There seem to be some just in these comments, including me, so yes.
Tomte 1 days ago [-]
I got a bounce on a mail from my personal Fastmail account (with my own domain) the day before yesterday.
I had SPF/DKIM set up, just not DMARC. Did that yesterday and don‘t see the point. My policy is "none".
jared_stewart 1 days ago [-]
The point is to have a DMARC record, setting it to none doesn't really do much of anything for you though. If you really wanted to take advantage of it you will need a DMARC monitoring solution - the market seems to typically price these around $10/month for small-ish domains (though there are a lot of caveats). I'm trying to build a reasonable free option that maybe isn't enough to get a domain to a reject policy, but should be enough for you to maintain a reject policy.
The truth is that there are amply "non-sending" domains out there which ignore DMARC and allow abuse. Stopping the assumption of no policy mean p=none prevents this abuse from persisting.
cowlevel 18 hours ago [-]
How does having a record with no policy make the internet safer?
ranger_danger 6 hours ago [-]
How does making driving license exams harder make the roads safer?
stavros 1 days ago [-]
I was hit by this twenty minutes ago. I don't disagree with the policy, but I wish my provider had warned me so I could add the headers. I already had DKIM and SPF, but not DMARC.
schappim 21 hours ago [-]
Didn't gmail already roll the same thing out in 2024?
aetherspawn 1 days ago [-]
If BIMI was in any way scalable it would actually provide a way for an external signer to say “yeah we trust these guys, you should deliver this”.
I haven’t really seen BIMI for less than practically $1000/year and most clients still don’t check it.
BSDobelix 4 hours ago [-]
You Guy's cannot imagine how happy i am that administration is a lost "art", i have 23 mail-servers for customers (different "clouds" from A to V plus some Colo-Servers) mostly the same setup (*BSD,rspamd,opensmtp,dovecot, blablabla), none of those mails get rejected or marked as spam by any of the "big" ones.
The secret sauce? I will not tell you ;)
KwanEsq 11 hours ago [-]
And have Microsoft started checking DMARC correctly yet?
We discovered when we set up a third-party to send via Amazon SES with one of our domains at the start of 2025 that Microsoft didn't correctly check DKIM alignment, and would incorrectly fail valid emails. The issue, so far as I could tell at the time, was that if an email had multiple (in our case 2) DKIM signatures, Microsoft's handling seemed to be non-deterministic, sometimes checking one signature, sometimes the other, and sometimes both. Of course, those times when it only checked one signature and that wasn't the one for the sending domain, it would then fail the alignment check, even though there was a perfectly valid and aligned signature right there it had just decided to ignore.
I raised it with Microsoft support at the time, but they were unsurprisingly useless, I think the most constructive thing they said was "just add the Amazon SES IPs to your SPF record", which, uh, no.
In the end, IIRC, we ended up setting up the third party to sign into a 365 email account on our domain we created for them so they could send through MS's infrastructure and avoid all that. So no idea what their DMARC checking is like these days, but I'd assume the same, if not worse.
cloudie78 1 days ago [-]
DMARC has been around for a while now. I know it’s fashionable to bash on Micro$oft and they rightfully deserve it.
Just not for this.
Krei-se 1 days ago [-]
You can hate on outlook.com for a couple of reasons.
But this is not one of them.
jmuguy 7 hours ago [-]
Seriously, in fact I would say this is rare instance of Microsoft handling email in a way that makes sense.
ourmandave 1 days ago [-]
What if I include the header string, "DMARC and Jalad at Tanagra."
protocolture 23 hours ago [-]
DKIM, its signature verified.
M2Ys4U 12 hours ago [-]
SPF when the alignment fell
Beijinger 21 hours ago [-]
Stop bitching guys, you have never dealt with t-online.de (T-Mobile)
Deutsche Telekom is a regional monopoly that abuses its position in every possible way. It's like Comcast but even worse. Best thing you can do is forget they exist and if someone really wants to contact you they'll find another way.
alrtd82 20 hours ago [-]
Mail admins had 20+ years to fix config.
Not saying that outlook is properly config, but it’s well overdue using solutions designed to reduce spam.
InsidiousWombat 9 hours ago [-]
DMARC does basically nothing. Certainly nothing that DKIM doesn't already do. Users just get phished by email that's not in their own company domain but something similar (or even completely random)
cowlevel 18 hours ago [-]
Does DMARC reduce spam?
thundoe 14 hours ago [-]
[dead]
mapontosevenths 24 hours ago [-]
Email was invented in 1965. It needs to be replaced with something that doesn't try to bolt security on as a lazy afterthought 30-40 years later.
cowlevel 18 hours ago [-]
We have everything we need to define email 2.0 with mandatory security, the problem is all the older installations that support 1.0 that everyone still expects to talk to.
New protocols only solved this by cutting compatibility. Signal can be E2EE because you can't send a message to an email address with it. Email can also be E2EE, but how do you know the recipient supports it?
mapontosevenths 10 hours ago [-]
It shouldn't BE backwards compatible. That's the Microsoft problem. They can't innovate because they have 40 years of legacy holding them back. Email might be the only situation that's worse. I don't want another new layer over the top like DMARC, and I don't want to try to "fix it." It can't be fixed, it's just a bad design.
I want something fundamentally new that doesn't stink of 70's era pre-security thinking.
A group of heavy hitters needs to just form a working group and propose Email 2.0. As long as it's supported by the biggest vendors and companies and they don't go all "IPv6: It's better because it's complicated!" on it people will sign up because it will be able to offer MUCH more in terms of features, usability, security, ease of hosting, etc.
patatero 18 hours ago [-]
What about Matrix?
mapontosevenths 10 hours ago [-]
I like Matrix, but I'm not sure it's really a direct email replacement. I think it could become one with sufficient work, but it's not there right now.
isaachinman 23 hours ago [-]
Sorry to break it to you, but email isn't going anywhere anytime soon.
dzink 1 days ago [-]
Yahoo is too.
SoftTalker 1 days ago [-]
Yahoo has randomly rejected emails for decades. In my experience it's probably the worst among the mainstream providers.
shevy-java 12 hours ago [-]
> That rule is aimed at marketers and bulk senders, and most small businesses rightly assumed it didn't apply to them.
This would be naive. It currently means that Microsoft censors and
decides what you can see in the first place. I do not recall having
given Microsoft such a permission. On the other hand I don't use
Microsoft for email anyway (though, unfortunately, one local university
here does, which is super-annoying. Europe is unable to think strategically
here).
alfiedotwtf 14 hours ago [-]
It’s 2026.. having been at a few email companies for years, this time I would agree with Outlook on this one
globular-toast 15 hours ago [-]
I've got the DMARC record on my domain, but it does seem very silly. Why couldn't the spec just make `p=None` the default?
TwoNineFive 17 hours ago [-]
For anyone running their own mail server, Microsoft has an authorization system to let you "authorize" your mail server IPs to talk with Microsoft's mail servers.
It's stupid, but not terribly difficult to set up and authorize.
Like most people who run their own mail, I have had repeated problems with Microsoft in particular, who treats small mail server operators like crap.
This post reminded me that I had gotten some email requesting me to "Re-attest Your Network Access". I went in, clicked a few things, and I'm good for another year or whatever.
Its not "one header" to fix. SPF and DKIM must be implemented.
bawolff 22 hours ago [-]
If you have no spf or dkim your emails have been getting rejected for a very long time.
(dmarc only requires one of spf or dkim, not both, but it is a good idea to use both)
apparent 17 hours ago [-]
Not IME. I just added all 3, after not having any noticeable email issues for years.
jeroenhd 10 hours ago [-]
Unfortunately, SPF and DKIM become optional once you send enough email for a mail server to trust you. You could've never bothered to update your email to the futuristic year of 2015 and still made your way into every inbox without ever knowing you forgot something.
almost 1 days ago [-]
Yeah thanks Microsoft. Really appreciate having to mitigate this for hundreds of customers on a weekend. Nice one!
esikich 1 days ago [-]
You should have done this for your customers years ago, yikes.
urbandw311er 1 days ago [-]
I suspect that he/she means they runs a mail server and it was up to his customers to comply, but now they’ve had to deal with the fallout from their customers not complying.
esikich 1 days ago [-]
Cool, charge them for it. That's what IT support is.
almost 1 days ago [-]
The customers have to do it themselves since they control their domains. I recommend doing everything correctly but also understand that this stuff is pretty hard for people just trying to run a small business. But if it makes you happy to feel smug you can carry on assuming.
esikich 1 days ago [-]
My assumption is that they were in control of the domains. If not, it isn't their problem and if anything it's billable hours, aka their job.
jrhite 18 hours ago [-]
[flagged]
davisr 1 days ago [-]
I noticed this when it happened, but I do have a valid DMARC entry (albeit p=quarantine).
Email is dead. Unfortunately any replacement for it would be owned by Meta or MS or whatever.
cowlevel 18 hours ago [-]
The assumption of a single shared medium is dead.
When you talk about a single entity to single entity connection it can be any protocol. Email, Matrix, WhatsApp, SMS... Discord... Instagram. All of them work especially if you whitelist the other party.
What doesn't work any more is assuming that everyone is using the same thing. Back when email was invented it was the only computer-based communication protocol - I don't remember whether it came before or after USENET - I'm assuming before. If you wanted to send a message to someone you sent it to their email address. Now things aren't so clear.
daneel_w 1 days ago [-]
It's possibly yet another issue relating to the long streak of problems seen the recent months by primarily self-hosters trying to reach people and businesses behind Outlook servers. The past few weeks a lot of my e-mails to friends and family using Hotmail have gone missing. All envelopes were OKd by Outlook servers, nothing bounced, e-mails just gone. My setup is clean, my network is clean.
SoftTalker 1 days ago [-]
I'm fine with providers imposing some default level of spam protection but as a user I'd like the option to disable it, even better if I can disable it per domain or sender. The old technique of adding the sender to your contacts doesn't work reliably anymore.
daneel_w 1 days ago [-]
"The old technique of adding the sender to your contacts doesn't work reliably anymore."
An Outlook user first reaching out to you, and you replying and including the unique message-ID of their original envelope in your headers, doesn't affect anything either. Absurd. The whole situation is complete dog shit.
pamcake 1 days ago [-]
"First time?"
It's not months it's years.
daneel_w 1 days ago [-]
Anecdotal. I've self-hosted for many years but didn't run into these issues with O365 until this year. But not surprised to hear it.
cowlevel 18 hours ago [-]
They used to just drop all messages from domains not on their whitelist and to get whitelisted you needed to have a Microsoft account and open a support ticket.
dwm 1 days ago [-]
They're not rejecting them quietly. They're sending 5xx permanent delivery failures.
lelandfe 1 days ago [-]
The title may mean it in the sense of being unannounced
mailroute 8 hours ago [-]
Author here. Microsoft did announce sender rules last year, but those rules aren't what is bouncing mail now.
What started on November 5 is a different rejection, 550 5.7.1 "Message lacks SPF/DKIM/DMARC Auth Records", and it reaches small, low-volume domains. Nobody has found a Microsoft announcement of it. That's what "quietly" means.
The Outlook.com postmaster announcements page still ends with the 2025 high-volume rule:
On Microsoft's own Q&A forum, the "rolled out last year" answer came from an Independent Advisor (a volunteer, not Microsoft staff), who added 18 minutes later: "I haven't been able to find any official information from Microsoft confirming that SPF, DKIM, and DMARC are now hard requirements for senders who don't meet the 5,000 emails per day threshold."
If there's a Microsoft notice I've missed, link it and I'll correct the post.
TwoNineFive 1 days ago [-]
"Quietly" in the title is an AI slopspam pattern. It's an over-used teenager hyperbolic crutch word on par with "literally", "actually", "honestly" and similar.
Sometimes it's use is appropriate, but not in this case. Microsoft announced this change loudly, multiple times, starting more than a year ago. I seem to recall one of those announcements being discussed here on HN. Even the article links to it's own previous announcements, so "quietly" here is stupid rage bait to justify a blogspam advert.
dwm 15 hours ago [-]
The word "quietly" has now been dropped from the link title, but still appears on the original.
nottorp 13 hours ago [-]
Real men do not review their articles, they post them on HN and have the whole world review them :)
mailroute 8 hours ago [-]
[dead]
ltchurik 6 hours ago [-]
[flagged]
arbor-group 9 hours ago [-]
[flagged]
xmddmx 1 days ago [-]
"Since November 5, 2026, Microsoft's consumer mail service has been turning away some of the email from domains that don't publish a DMARC record. If your company emails customers, vendors or applicants with outlook.com, hotmail.com, live.com or msn.com addresses, some of that mail may be bouncing right now. Nobody announced it. The fix is one DNS record."
I'm personally seeing this with some email systems I manage - email sent from a domain that has proper SPF and DKIM signatures, but had no DMARC record started bouncing this weekend.
ahmedzakey 6 hours ago [-]
[flagged]
mcgram 20 hours ago [-]
[flagged]
drrajvanshi 15 hours ago [-]
[flagged]
ravivarmat 16 hours ago [-]
[dead]
excannuk 21 hours ago [-]
[dead]
minfazhai 21 hours ago [-]
[flagged]
nishanmiranda 19 hours ago [-]
[dead]
octoberfranklin 1 days ago [-]
> The fix is one DNS record.
Oh god the slop.
Only an LLM would describe DMARC as just "one DNS record".
accelbred 19 hours ago [-]
I literally had to copy paste one dns record to enable it.
jared_stewart 1 days ago [-]
lol DMARC is one record.
It doesn't have to be just one record, but it doesn't have to be more than one record either.
gnabgib 1 days ago [-]
DMARC is layered across (/is useless without) two other protocols (SPF, DKIM), both of which also require DNS records.. there's no way to DMARC with one record.. unless you're excluding those SPF and DKIM records in your count. You /could/ DMARC with two records: DMARC+SPF, or DMARK+DKIM but it's ill-advised - use all three. (Ignoring host hierarchy/cname delegation, you can have far more records)
bawolff 22 hours ago [-]
Were you previously sending email without either DKIM or SPF?
Because i doubt that has worked at all in the last decade.
gnabgib 22 hours ago [-]
Are you replying to the wrong comment? No on all counts.
bawolff 21 hours ago [-]
Then setting up DMARC is only one record because you already had the other records.
jared_stewart 1 days ago [-]
I suppose I'm splitting hairs.
Yes, a proper email authentication stack has DMARC + SPF + DKIM. But each of these is a separate protocol.
This also doesn't take into consideration the other protocols that have arisen BIMI, APRF, MTA-STS / TLS-RPT and are at even lower levels of adoption.
gnabgib 1 days ago [-]
MTA-STS is useful (but it's about helping receivers by demanding mail is sent encrypted, not senders with delivery).
BIMI is a pay-to-spam protocol that helps senders, you can add a rule to postfix to mark it as such.
APRF is a draft, and likewise helps senders, not receivers.. not sure why anyone would want to adopt this standard. A little closer to DMARC reports, but sharing PI that you owe no sending server.
cowlevel 18 hours ago [-]
Do they literally just need the DMARC record to exist though, or do they need it to actually say something? Do you need DKIM? I found that SPF is very easy but DKIM is a royal pain.
Outlook.com and similar are an anathema to email. This is why they tell you not to run a mail server .
On the other hand rejecting domains without dmarc is fine. Just not happy it is silent.
I bet Microsoft is single-handedly responsible for 80+% of complaints about email being impossible to host.
In a federated / pseudo-decentralized network, any provider with 10+% of captive users has an outsized leverage on the entire ecosystem. You don't need a monopoly; as long as you have a monopoly on just a few users that others absolutely need to be able to interact with, you can dictate terms to everybody.
I wish I could just wholesale block gmail.com like people used to do with the early webmail providers.
I think that implies having an actual google account to do that, which is absurd.
They are the reason I dropped self-hosting my mails. They were silently dropping some of my mails depending on the day I sent them. If they were at least sent to the spam folder, it would be easier to communicate with their users. And since a lot of their users are not technical at all, it's complicated to explain them the issue.
It's absurd in every way. I was trying to get it to stop spamming maillist traffic. It's impossible. Global level filters enacted as admin to not spam check are ignored.
Based on my broad experience, I’d comfortably rank Microsoft as the worst of the major email providers. (I am owner poste.io)
Yes, that may turn some users away, but they would complain and leave anyway, because they don't receive emails from your server. On the other hand, that's how one can contribute to unwinding ms's share of email accounts.
I haven’t productionized this setup (I send maybe a dozen emails a year) but it worked for me ad hoc a couple years back, when I had to send a mail to an Outlook-hosted address and they blackholed everything I tried to send while 250 OKing me.
I ran a SaaS up until recently. Emailing users notifications for events was just a normal part of the app. Users got upset when the emails didn't come through. So then I had to be email tech support for something I had no control over. Lovely.
It's always people self-hosting mail on a shared server in Moldova (because they think it makes them cool) that are complaining.
Which with cheap models like Jev as spam classifiers, this can now become a reality.
The problem is, Google and Microsoft have monopolized the entire email market, so their esoteric deliverability mysticism from 2007 still persists (basically blanket bans on entire IP spaces, locking out anybody trying to send emails on their own).
Email naturally followed this evolution.
Switch Moldova to almost any country (or even a state that isn't California or Washington), and it's the same story everywhere
You shouldn't own your car or your house, give them to all the corporations as well.
As soon as you want to do business with Outlook's customers, you play by their rules.
"They're allowed to do it" is one of those things that doesn't really bear saying so much because that's already been implicitly established. Nobody is claiming what they're doing is illegal, so how does this add anything of value? Who is still unaware that corporations will use their size and market control to their benefit?
"Their rules" seems to be turning into "you spend money to another corporation that we trust".
I've never even had the key to mine. I've lived here over a decade.
With LLMs on the other side trying to make spam less detectable by cheap models like Jev?
It's funny when people assume benefits from some tech go one way and baddies will surely never use it...
https://www.mimar.rs/blog/a-journey-of-my-mx-server-to-new-r...
And yes, it's cool not to have to let scum read your private communications :D
It should be the other way around though.. More people should run their own mail servers so that centralized players cannot control what should be a decentralized communication protocol.
Four hours later, I got the same message by email. I thought he was back - nope. An email sent at 10am that was delivered at 4pm showed it was from 2pm until I looked at the header and saw sent at 10am and just... chilling out for 4 hours. DMARC was set up for them just fine.
I've had the same issue with my own custom domain, with DMARC set up. A year later, it finally got bumped up to some sort of "trusted" domain for that one place and my emails get delivered the same day now.
Mildly infuriating for emails containing OTP codes "valid for 10 minutes".
Yes, no one should not have DKIM or DMARC but holy yikes when neither side wants to actually give in to help the customer.
It turns out that whoever has the most power is the most powerful. This is why distributed/decentralized systems cannot singlehandedly free us from tyranny, and why I find people who spend all their time preaching decentralized systems to be quite silly. We don't need better systems (well maybe we do but,,,), we need better education and awareness of how billionaires manipulate us; this goes beyond software.
Mail, then emails, then home phones, then cell phones, then texts, then social media have been gradually rendered less and less usable by bad actors systematically abusing every single tool we try to use to communicate with one another to steal from us, lie to us, and manipulate our beliefs, and we'll just keep inventing and discarding new ways of communicating until we reckon with this.
The only question is how many years the lazy network-effects monopolies (like Google, Microsoft, Verizon, etc) will hold this back from happening.
The optimist in me says this will unlock pathways to true decentralization of push communication protocols (like SMTP) instead of only have decentralization of pull-oriented protocols (like HTTP).
AI becoming faster empowers attackers far more than it empowers defenders. We're seeing this in every discipline and every corner of the software industry.
I'll never pay for email so your options are either outlook or Gmail and I don't trust Google.
But we won't.
So that people would vote for the government to manipulate them instead?
Honestly, I hate outlook as much as you do, but I'd still prefer it to Max
https://en.wikipedia.org/wiki/Max_(app)
Selfhosted email is likely easier now than it ever was before.
Oh man, please tag me if you're ever the lead on any project so I know to stay far away from it.
This is not Microsoft's fault. The building's on fire and they're locking out the arsonists.
I was working for Microsoft when outlook.com launched and got a good email address that was my primary for more than a decade.
I had so many issues with things getting silently dropped with no recourse (2FA codes, account recovery mails, etc.) on so many sites that I finally gave up, reversed the stream, and had Outlook forward to GMail instead of vice versa. A few months after that, I realized that all my Outlook got was an enormous volume (hundreds of day) a spam and that all legitimate mail was going to my other accounts, so I turned it off entirely and haven't read that mailbox in over a year.
This is not unique to Microsoft and really the source's problem — they did something to get blocked in the first place.
Add in the fact that you're almost certainly not the only one impacted, and that they have no interest in fixing it, it screams incompetence on the source's part.
Been there, done that, good luck explaining the problem to the app's first-level support in the Philippines because it's not in their script.
> and had Outlook forward to GMail
Till the day GMail hits you with the "We couldn't verify it's you" bullshit and locks you out of your account forever. Good luck getting support from Google, the word is not in their lexicon.
I've never encountered this issue with GMail. Delivery just works. I'm trying to think of the last false-positive spam flag I've had with GMail, and I've definitely never had mail be entirely dropped.
This is also true of Microsoft though.
Stop being so ignorant
I have access to a fairly large dataset of known bad hosting providers, but most people don't. So how do you tell the difference between getting a good deal and "this is cheap because it's sketchy as all hell".
We also don't block all of Vietnam, or all Jio customers in India, even if we know that 20% of bot traffic is from those two alone.
Wait until this guy realizes that all spam these days comes from Azure ASNs, and abuses cross-tenant issues as well as a simple "Fwd: ..." and "Re: ..." tricks to bypass Microsoft Outlook spam filters.
Experience shows that the walls will get taller and the moats will get deeper.
The solution is allow only communications that are demonstrably not spam and not unwanted.
There have been lots of proposals to this effect but maybe you have to put up two cents in a crypto wallet, which the other person can claim if the mail is unwanted. If someone takes your two cents, you remove them from your lists ASAP. The receiver doesn't benefit meaningfully from the 2c so they are unlikely to claim it. The sender is only damaged if a lot of different people claim the 2 cents. Maybe a few domains are default whitelisted even if they don't put up 2 cents, to protect against entities that are important but would be frequently spite-claimed (IRS, courts, and other similar). If you use a provider that doesn't whitelist, fine, but you're going to miss those emails.
Maybe the top 'spite claim' users are published and it becomes difficult to get people to agree to put up money to talk to you.
This reduces spam to the level of junk mail, which is still not totally trivial but is orders of magnitude more manageable.
There is and it's the same as other protocols including proprietary ones - a sender address whitelist.
There's no proprietary protocol that solved spam either.
Seems they are the disease not the cure
Lately I've also been getting a lot from compromised MS365 accounts.
It seems insane that gmail doesnt provide a way to automatically send a mail (eg based on domain, keywords, etc) to spam. I know theres block sender but for example aliexpress uses a different name for every email so that's useless.
What this is called is survivorship bias. The question I would ask is how much mail are you not seeing at all because it's dropped at the edge first thing because it's IP block listed?
Next, how much spam are you seeing from them because they and Google are the largest providers on Earth? Kind of like selecting a random person from the population in the US and going "look, it's a white guy". Yea, that's how statistics works.
Lastly, because the are good at blocking spam at the edge, then that's the last bastion of attack for spammers to put their efforts in if they want any return at all.
Self-hosting allows me to use a different receiving address for each entity I contact, so I know exactly who put me on spam lists and if it gets bad I can route that address to the garbage bin.
Anecdotes are not a great thing to run mail servers on, broad statistics are.
These entities communicate via plain old mail, that costs more than 2 cents already.
We have dozens of different ways to send E2EE messages to each other, with realtime publish-subscribe, and yet billions of dollars are spent trying to duct tape email. Who cares if Outlook/Gmail/Icloud use IMAP or Websocket? If the interface looks the same to the end user will they really care?
Experience shows that the walls will get taller and the moats will get deeper.
Protocols aren't proprietary by definition. It's a protocol. Anyone can implement it.
The people working on outlook.com are just talentless amateurs - the rest knows how to do it right. It's a shame it's so widely used.
Most of them wouldn't even care probably...
What about tencent.com, foxmail.com, or qq.com?
User signs up, uses @outlook. Your app declines it and explains that they block with no way to remedy, and explain they are a bad vendor.
Emails would be accepted by Outlook.com, but would never deliver. We had SPF/DKIM/DMARC and full reporting. They RBL'ed us with no remedy.
We told the customer to not use outlook.com BECAUSE we told them we could not guarantee any delivery of messages.
Means you're not using your email seriously. For example, to send CVs in response to job postings.
I send up to 20 email per day to people who have issues with their package build scripts, and I have no idea whether they ignore me because they stopped using the distro or because mail got dropped.
You should be able to see this on your DMARC dashboard
Fortunate for those running their own servers is that they actually still get all the cool emails from people not complying.
At the most you need to use an external service for delivery (usually because you have problems with MS) but you can still run your own server with no difficulties once you do that.
That said, DMARC is required by a lot of people now, so I do not think this particular issue is a problem.
I have been self hosting my my personal email (and for family). Few problems so far other than delivery to MS and I have recently moved a domain I use for work email over.
Oddly enough the MS problems come from hotmail, but not other services. If that is a problem, then pay a bit to have email delivered.
Good for Microsoft customers and I don't care one bit for the lazy people who have to late-patch now.
Go to https://mail-tester.com. Send a test email. If you don't get 10/10, fix your shit.
DMARC applies not on your mail server, inbound or outbound, but on the server that is receiving your mail (which may in fact be your mail server).
That server will look at how the mail authenticates and decide if it should allow the mail to proceed, it (for the most part) will then tell you whether or not it allowed the mail. This is how you will know you might have a deliverability problem before your customers do.
If you're wanting to know about deliverability (particularly for this Microsoft case), my company (Alesian Security) has a free check at https://alesiansecurity.com/try?tab=deliverability
It's been a while, but monitoring DMARC seemed pointless once you got things started. If my outbound mail fails to validate, I've asked the receivers to bounce it, and I should be able to see that on my own system.
Otherwise, I'm just getting reports about spoofed spam or people who need to adjust their mail forwarding, but I can't do anything about either.
But it provides a safe guard against accidentally broken mail flows as your email stack evolves over time which is where it pays dividends.
I would love to say that it would have alerted you ahead of time to this particular event, but given that it's the fix here you would never have seen it.
Also why they do non-standard stuff like accepting mail but then simply not delivering it, rather than bouncing it.
"Reputation scores" and blacklists / greylists started in late 1990s / early 2000s as multiple grassroots efforts when spam started to overwhelm systems. Gmail did not exist, outlook.com did not exist, it was easy and expected to run your own SMTP (which I did). And it was very unpleasant.
DMARC appeared 10 if not 15 years ago. There's no reason for a sane MTA configuration not to have it.
- it was a way to outsource the mail server administration and already free in our corporate package
Which is pretty much all I have from the corporate side. On the personal or small business side its most often
- I don't really care that much about running my own stuff
- I needed a personal email address
All these are valid reasons/motivations but none explicitly argue that email messaging should become proprietary.
Some can affordably deliver to Microsoft because they aggressively police what they are actually sending on their customers' behalf; others don't get involved and you end up having to spend a fortune on a dedicated IP.
The DMARC thing is just another part of this; one of my clients discovered this silent failure themselves a few weeks back and addressed this.
Too many companies run on incredibly frail email configurations (while at the same time asserting that an hour of downtime on their email is a catastrophic business risk).
Configuring your SPF wrong but everything still sort of working because DMARC doesn't explicityly say anything can be a feature. I guess the time may have finally come for those companies to pay decades of technical debt.
It doesn't prevent spoofing, it doesn't say which IPs are authorized to send on behalf of a domain, it doesn't sign messages. Spoofed messages are still sendable.
Can you explain the benefit of only accepting email if Microsoft knows that you may or may not accept emails about scammers unsuccessfully spoofing your email domain? (Note, there's nothing you can do if they do tell you.)
Don't confuse DMARC with DKIM or SPF; DMARC doesn't actually do anything for email security.
"Oh, please, don't ignore the other two ways I told you to ignore unauthorized messages" shouldn't need a knob.
You get an email without a DKIM signature from me.
Is that because I do not use DKIM and do not sign my emails or because the message is forged and not from me at all?
You cannot tell. There is a single SPF record that you can look up to see if SPF is configured. It's just a TXT record on the domain. But there is no standard DKIM record. A DKIM signed email tells you what key identifier it used and you have to use that to look up the DKIM key at <key identifier>._domainkey.<sender domain>. When the email has no DKIM signature you cannot tell if that's because the sender domain does not use DKIM or if it does have a DKIM key record but it was not used, potentially because the email is forged.
Or do you think it's critical to support mail that doesn't have dkim?
Setting a DMARC policy that allows unsigned emails is easier than configuring DMARC signing including key management. It's just adding a DNS record. Although large senders should of course do DKIM and it's not that hard either
But I'm not arguing with you about whatever Outlook did.
DMARC doesn't introduce a new security mechanism by itself, but it fixed a few bad security flaws in SPF and DKIM. Without DMARC, SPF and DKIM do not add meaningful security.
DMARC updated and formalized how receivers should handle authorization and authentication of inbound email by adding the alignment requirement. Alignment ties the SPF and/or DKIM domain to the rfc5322.From domain. This also allows receivers to use domain reputation rather than IP-reputation.
SPF by itself has a bad design flaw that completely breaks any security that SPF was supposed to provide. By adding DMARC this security hole is fixed. (Although SPF is still horribly unreliable, it should be considered legacy at this point, don't rely on SPF).
DKIM benefits from DMARC alignment requirement too. DMARC ties the rfc5322.From domain to the DKIM signing domain, which makes DKIM practical for sender authorization, not just authentication.
gmail runs with p=none
so tell me what benefits that has over having no dmarc record at all ?
The the existence of a DMARC assertion record in the DNS changes how the MTA (the receiving system) assesses the authentication of the message and authorization of the sender with SPF and/or DKIM, as per rfc7489 (and now also rfc9989).
No DMARC results in the MTA falling back to the original assessment method as defined in the original SPF and DKIM RFCs. These RFCs have design flaws and don't define the assessment flow all that well, they leave a lot up to the MTA's digression/interpretation.
So, the existence of a DMARC record with p=none is fundamentally different over not publishing a DMARC assertion record at all. It's just that with p=none you don't enforce the MTA to reject the email if it fails authentication/authorization, you're leaving it up to the MTAs digression.
So how does them enforcing requiring a p=none record change that ?
https://ciphercue.com/blog/dmarc-enforcement-gap-rua-fragmen...
https://news.ycombinator.com/item?id=49081783
I have MCP servers for the creation of domains, DNS records with DNSSEC, and email accounts with SPF, DKIM and DMARC. I'm sure if someone wants to be a professional spammer today, DMARC is not a differentiator.
Company sys admins have likely got all sorts of other issues to worry about, and the occasional report of an email not getting through is likely low on their to-investigate list.
Having said that, I self host a mail server, and have all those things setup correctly, and my workplace uses Outlook, and I've not had issues with delivery, so it's not a particularly difficult bar to jump.
I had kinda assumed that a lot of providers would start rejecting domains without DMARC support. I'm surprised it's happening this late.
When I ran that server, outlook.com was also the only one that would blackhole my email for no known reason. Support was unhelpful and also could not point to any reason. I've since given up, but for a short time it was glorious, email to family would not leave the lan and we could send attachments of arbitrary size.
[0] https://news.ycombinator.com/item?id=7708882
Is there a risk some people on this thread are mixing up DKIM and DMARC?
DKIM = proving that an email was sent from a specific domain using cryptography. Good for spam fighting and deliverability.
DMARC = telling receivers how to handle mail that fails authentication.
DMARC is primarily useful for large, complex organizations where email admins may not be aware of everyone inside the org who is sending mail that advertises the domain in the From header, or organizations that might be targeted by impersonation attacks (e.g. phishing). Being able to tell recipients "yes we absolutely have our act together so feel free to reject or spamfolder unauthenticated email" is great for killing phishing campaigns, and being able to request reports is great for finding that one sales org that signed up for a guerrilla marketing SaaS that's impersonating them.
But for small personal domains the value isn't that high.
Back then, I didn’t use Terraform or anything like that, but I had text files with logs that described the DNS setup in detail so I could fix things. By grepping through the logs, I’m able to put a definitive bound on when I added DMARC—it was no later than June 2016, over 10 years ago.
At the time I thought, “Obviously, we should all be setting this up, because recipients will start rejecting mail from insecure domains, if they don’t already.” This was also back when I self-hosted email. I eventually stopped doing that because I thought it was too time-consuming.
>But for small personal domains the value isn't that high.
I don't understand the resistance. It benefits the entire mail ecosystem, not just mass senders.
SPF used to be niche thing, then everyone realised it's a good idea and it became more-or-less mandatory. Same with DKIM. Now it has happened to DMARC as well.
No. DMARC is about if the from address has to match the address used in dkim/spf
DMARC is primarily about "alignment" (switching SPF from caring about the envelope sender to instead using the from header). Yes, it does also tangentially address those other points, but the primary reason it was adopted was to prevent spoofing of from headers (where in original spf that was a non-goal)
A specification exists since 2012, 14 years ago. 10 years ago it was already old.
10 years is nothing. I'm sure there's still millions of companies globally who still aren't properly signing mail with DMARC.
That's pretty much all email is good for these days. Even in business, Slack/Teams/Mattermost has replaced a lot of 2000s email communication.
No, you will never be contacting your bank over Instagram DMs or getting hotel confirmations via Facebook or dealing with governments over Youtube.
Nobody sends physical mail to each other anymore either, yet last mile delivery is as important as ever.
[0]: As in: They accepted the email just fine (according to the logs) but it still didn't end up in the recipient's mailbox.
When I see in my logs that the e-mail has been successfully delivered to their MTA then I don't have a problem.
(If this happens to you, don't admit that you know Microsoft drops your emails, or you'll be liable again!)
Email is, I think, among the most distributed popular online services, and there's a ton of stuff that's legacy, self-managed, or otherwise janky. Supporting SPF, DKIM, and DMARC does put a burden on independent operators, but is it an undue or unreasonable one in the current landscape? Or is it just the new cost of doing business?
That said checking for these things is a good idea, the only problem I see is dropping the mail on the floor, rather than rejecting it at SMTP time - at least that lets the self-hosting users who haven't got things configured know their email is being rejected, and to pick up the phone instead.
There's nothing worse than sending an email, it being accepted, and then later discarded with no clue to either sender or recipient.
Maybe 1 in 5 emails I get is spam, and because I use a different address with every sender I know who sold "my" address to a spam list.
Yes. In the first place, this should not even be a thing. Two corporations should not be in control of who can send e-mail. If they want to mark not having DMARC as spam, mark it as spam, or better yet flag it with a specific warning about the domain, but these games with refusing to deliver are just bullshit and essentially force a monopoly where other e-mail providers cannot compete because their e-mails aren't delivered.
We are literally talking about a situation where this is not happening! And the problem is that it's not just this. Once you give them a license to police e-mail, they start policing e-mail for all kinds of arbitrary and inscrutable reasons. If this were going to be done, it should really be formalized as an industry standard by an independent consortium, not up to the whims of Microsoogle.
DMARC, DKIM and the rest are industry standards set through an independent consortium (it's called the MAAWG iirc)
En contraire, I think not delivering mail is the fastest way to adoption. People will use an old system for as long as it works. It now does not anymore.
Maybe you're right that just enforcing it is the way, but I don't agree with doing that with no heads up.
We have seen a massive erosion of the latter aspect of the web in the past few years, and I think it's useful to frame conversations in terms of that loss. The web used to be fun, and now it's become, more than ever, a professional enterprise. You often can't stand up a website without having to buy into Cloudflare's DDoS protection or something equivalent. I think this is absurd, and it's not the only such case, though these changes are obviously reactions to how usage of the web's evolved over the years.
I wonder if we can get the old web back in some way, shape, or form, cause I think we've lost something with the corporatization of the internet.
And for what it's worth, yeah, I think grandma should be able to run a mail server. Why not?
Although there seems that there hasn't been any communication which is the bad thing here. However, nobody looks at those and sending detailed emails back seems like a good enough solution.
This stops disguising yourself as a legitimate service.
Allowing basically ~whatever, but proving the sender address is an obviously good approach to me.
These days, hosting a proper mail server isn't really that hard, thanks to Stalwart https://stalw.art/. I did it to my Talos Linux cluster located on LA and utilizing idle resources. It is pretty great
> The sender gets a bounce
?
It's quiet only if the server accepts it and then deletes it on their end without notifying the sender, but if your mail provider shreds your mail that's then also your provider's responsibility and not the sender's
I had a legal dispute once where a shop didn't provide warranty on a product. They took the product in but then it was indefinitely in repair. Long story short, it ended up being helpful that I have email server logs that show every transaction, so that I could say "on date+time the email was delivered to IP address X, which was registered as the mail exchanger for your domain, and your server took the email with status code XYZ Queued <ID> For Delivery." Would have been interesting to hear what a judge has to say about it but they simply agreed to give the full purchase price back after that
Afaik that's not what Microsoft/Hotmail does though: since it rejects noncompliant setups (as well as a lot of legitimate email, unfortunately), the sender gets a delivery failure notification
Sounds like kind of a hack:
"ARC was devised to solve this problem by giving intermediate servers a way to sign the original message's validation results. Even if the SPF and DKIM validation fail, the receiving service can choose to validate the ARC chain. If it indicates that the original message passed the SPF and DKIM checks, and the only modifications were made by intermediaries trusted by the receiving service, the receiving service may choose to accept the email."
maybe someone was too lazy to set up "inbound block list" and just did a total blackout instead?
https://learn.microsoft.com/en-us/troubleshoot/exchange/emai...
Some additional context:
- I checked online and they do have this email address listed on their pages
- This affected 2 separate domains served by Microsoft
- I sent them an inquiry email now from my @gmail.com and no bounce was returned so far
EDIT: Also gmail got the error response, so I guess it's really up to the outlook server these unrelated entities use...
Or whoever you're emailing has blocked you for some reason; perhaps your email was marked as spam before, or you/your mail server/your automated tooling has ignored bounces and has crossed a mail server threshold.
Not true, at least in my experiences.
I have a bunch of email accounts which have SPF and DKIM, but are missing the DMARC line - I've had no deliverability problems at all, until this weekend, and now only with Outlook. Emails to Gmail accounts go through just fine.
The combination of: √ Valid SPF √ Valid DKIM signature X Missing DMARC policy
Is clearly ambiguous. Since a DMARC of "p=none" (in the context of valid SPF and DKIM) really adds no information, so interpreting "missing DMARC" as "p=none" seems reasonable. Sounds like Microsoft was taking that approach until this weekend.
I wonder if there's an actual written standard?
Most receivers have chosen to treat this as p=none for the last decade (Microsoft included). This is changing to now so that mail with no record is simply refused. Nothing in the standard prohibits this.
a DMARC of p=none might be seen as ambiguous - SPF and DKIM have their own jobs and they work. However, the point of DMARC is not a new way of enforcing mail authentication. Instead it is a way of making certain that the mail is internally consistent and furthermore provides two additional things.
1. it indicates if the domain owner has thoroughly gotten their mail to authenticate (in which case they adopt a p=reject), and
2. it provides a feedback mechanism that allows the domain owner to know if they are seeing authentication and deliverability problems in such a way that they can fix those broken mail flows.
[1] https://www.rfc-editor.org/info/rfc7489/
I had an email server and configured everything by the book. Still some scammer were able to send emails which looked like they came from me, so i got responds back.
If not even this was fixed...
Even lazy spammers, who didn't even bother to create MX records for their fake, auto-generated domain, are getting into Gmail (Spam folder mostly, yet, why not reject it entirely?)
Receiving is still self hosted.
However, it is worth mentioning that Gmail is fully dropping the ability to use a non-Gmail SMTP server as of January: https://support.google.com/mail/answer/22370.
They did: https://techcommunity.microsoft.com/blog/microsoftdefenderfo...
And it appears to be further documented here:
https://learn.microsoft.com/en-us/defender-office-365/anti-p...
https://learn.microsoft.com/en-us/defender-office-365/email-...
And other sites were reporting about it for at least a year and a half:
https://powerdmarc.com/dmarc-outlook-email-authentication/ (see #4)
https://www.mailreach.co/blog/outlook-dmarc-requirements
That's an old announcement about a different change. As far as I can tell this one is completely out of the blue. I'm shocked by the number of people in this thread advocating for spontaneous changes without any warning.
The failure associated with that announcement is different. It is 5.7.515.
This new failure mode is "5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records (AS9031519)", I haven't seen any formal announcement on my end. The important thing to know about 5.7.1 is that it represents a few different failure modes, the AS9031519 is the important bit and it indicates that the domain lacks a DMARC record.
This thread duplicates the first observations of this which showed up here yesterday at https://news.ycombinator.com/item?id=50404161
My mail provider, MXroute, sent me a notification of the issue early yesterday. There is commentary from various DMARC providers (Suped and PowerDMARC). This is a real thing.
It does not matter which host you are using, this has nothing to do with the hosting provider. It has everything to do with having your domain correctly set up on DNS so that anybody receiving mail will know how to authenticate it. Microsoft has apparently advanced a policy that if you don't even try you don't get to send.
IMO this is the right call, I've seen plenty of spoofing attacks where the attacker took advantage of nonexistent policy on non-sending domains. You might think that if you don't have an MX record the domain can't be used to send mail, that is wrong. The MX record only tells others where to send your mail, it says nothing about whether the domain can send mail itself.
I had SPF/DKIM set up, just not DMARC. Did that yesterday and don‘t see the point. My policy is "none".
The truth is that there are amply "non-sending" domains out there which ignore DMARC and allow abuse. Stopping the assumption of no policy mean p=none prevents this abuse from persisting.
I haven’t really seen BIMI for less than practically $1000/year and most clients still don’t check it.
The secret sauce? I will not tell you ;)
We discovered when we set up a third-party to send via Amazon SES with one of our domains at the start of 2025 that Microsoft didn't correctly check DKIM alignment, and would incorrectly fail valid emails. The issue, so far as I could tell at the time, was that if an email had multiple (in our case 2) DKIM signatures, Microsoft's handling seemed to be non-deterministic, sometimes checking one signature, sometimes the other, and sometimes both. Of course, those times when it only checked one signature and that wasn't the one for the sending domain, it would then fail the alignment check, even though there was a perfectly valid and aligned signature right there it had just decided to ignore.
I raised it with Microsoft support at the time, but they were unsurprisingly useless, I think the most constructive thing they said was "just add the Amazon SES IPs to your SPF record", which, uh, no.
In the end, IIRC, we ended up setting up the third party to sign into a 365 email account on our domain we created for them so they could send through MS's infrastructure and avoid all that. So no idea what their DMARC checking is like these days, but I'd assume the same, if not worse.
Just not for this.
But this is not one of them.
https://telekomhilft-telekom-de.translate.goog/conversations...
New protocols only solved this by cutting compatibility. Signal can be E2EE because you can't send a message to an email address with it. Email can also be E2EE, but how do you know the recipient supports it?
I want something fundamentally new that doesn't stink of 70's era pre-security thinking.
A group of heavy hitters needs to just form a working group and propose Email 2.0. As long as it's supported by the biggest vendors and companies and they don't go all "IPv6: It's better because it's complicated!" on it people will sign up because it will be able to offer MUCH more in terms of features, usability, security, ease of hosting, etc.
This would be naive. It currently means that Microsoft censors and decides what you can see in the first place. I do not recall having given Microsoft such a permission. On the other hand I don't use Microsoft for email anyway (though, unfortunately, one local university here does, which is super-annoying. Europe is unable to think strategically here).
It's stupid, but not terribly difficult to set up and authorize.
Like most people who run their own mail, I have had repeated problems with Microsoft in particular, who treats small mail server operators like crap.
This post reminded me that I had gotten some email requesting me to "Re-attest Your Network Access". I went in, clicked a few things, and I'm good for another year or whatever.
https://substrate.office.com/ip-domain-management-snds/snds
https://www.litmus.com/blog/what-is-microsoft-snds-why-your-...
(dmarc only requires one of spf or dkim, not both, but it is a good idea to use both)
https://mastodon.social/@davisr/117570496362439342
When you talk about a single entity to single entity connection it can be any protocol. Email, Matrix, WhatsApp, SMS... Discord... Instagram. All of them work especially if you whitelist the other party.
What doesn't work any more is assuming that everyone is using the same thing. Back when email was invented it was the only computer-based communication protocol - I don't remember whether it came before or after USENET - I'm assuming before. If you wanted to send a message to someone you sent it to their email address. Now things aren't so clear.
An Outlook user first reaching out to you, and you replying and including the unique message-ID of their original envelope in your headers, doesn't affect anything either. Absurd. The whole situation is complete dog shit.
It's not months it's years.
The April 2025 announcement covers domains that send more than 5,000 messages a day to Outlook.com. It took effect May 5, 2025, and its rejections come back as 550 5.7.515: https://techcommunity.microsoft.com/blog/microsoftdefenderfo...
What started on November 5 is a different rejection, 550 5.7.1 "Message lacks SPF/DKIM/DMARC Auth Records", and it reaches small, low-volume domains. Nobody has found a Microsoft announcement of it. That's what "quietly" means.
The Outlook.com postmaster announcements page still ends with the 2025 high-volume rule:
https://sendersupport.olc.protection.outlook.com/pm/
On Microsoft's own Q&A forum, the "rolled out last year" answer came from an Independent Advisor (a volunteer, not Microsoft staff), who added 18 minutes later: "I haven't been able to find any official information from Microsoft confirming that SPF, DKIM, and DMARC are now hard requirements for senders who don't meet the 5,000 emails per day threshold."
https://learn.microsoft.com/en-us/answers/questions/6063930/...
In another thread on November 8: "I cannot find any official information from Microsoft acknowledging this issue."
https://learn.microsoft.com/en-us/answers/questions/6064999/...
If there's a Microsoft notice I've missed, link it and I'll correct the post.
Sometimes it's use is appropriate, but not in this case. Microsoft announced this change loudly, multiple times, starting more than a year ago. I seem to recall one of those announcements being discussed here on HN. Even the article links to it's own previous announcements, so "quietly" here is stupid rage bait to justify a blogspam advert.
I'm personally seeing this with some email systems I manage - email sent from a domain that has proper SPF and DKIM signatures, but had no DMARC record started bouncing this weekend.
Oh god the slop.
Only an LLM would describe DMARC as just "one DNS record".
It doesn't have to be just one record, but it doesn't have to be more than one record either.
Because i doubt that has worked at all in the last decade.
Yes, a proper email authentication stack has DMARC + SPF + DKIM. But each of these is a separate protocol.
This also doesn't take into consideration the other protocols that have arisen BIMI, APRF, MTA-STS / TLS-RPT and are at even lower levels of adoption.
BIMI is a pay-to-spam protocol that helps senders, you can add a rule to postfix to mark it as such.
APRF is a draft, and likewise helps senders, not receivers.. not sure why anyone would want to adopt this standard. A little closer to DMARC reports, but sharing PI that you owe no sending server.