Outlook.com is also rejecting mail based on blocklists that are not public and you essentialy cannot get yourself out. My VPS provider is pretty much entirely blocked and their regular blocklist process says we are golden so nothing to unblock.
Outlook.com and similar are an anathema to email. This is why they tell you not to run a mail server .
On the other hand rejecting domains without dmarc is fine. Just not happy it is silent.
outlook.com and O365 are horrible to deliver to. We regularly get issues where we sent an email it was accepted by O365 but was never delivered to the mailbox. We have one person working at least half the time on resolving stuff like that. And that's from a respectably maintained SES egress with good reputation, DMARC, DKIM configured.
There is a trick. Sign up with them, configure custom domain, but don’t set your MX records. On your MTA, route mail that goes to Outlook/Hotmail to go through their MSA with your Outlook credentials and headers stripped as if submitted directly by user. Outlook gets mail through their own MSA it trusts, rest of the world talks to your mail system directly. Replies still go to your MXes.
I haven’t productionized this setup (I send maybe a dozen emails a year) but it worked for me ad hoc a couple years back, when I had to send a mail to an Outlook-hosted address and they blackholed everything I tried to send while 250 OKing me.
Self hosting mail on a shared server in Moldova is basically the entire idea behind email (and the internet).
Which with cheap models like Jev as spam classifiers, this can now become a reality.
The problem is, Google and Microsoft have monopolized the entire email market, so their esoteric deliverability mysticism from 2007 still persists (basically blanket bans on entire IP spaces, locking out anybody trying to send emails on their own).
People used to have party lines and leave their doors unlocked too, but it turns out the world is filled with bad actors and other assorted shitty people.
This is one thing I find more on Hacker News than most other discussion sites. Any topic about annoying or bad behaviour by corporations eventually devolves to "they're allowed to do it".
"They're allowed to do it" is one of those things that doesn't really bear saying so much because that's already been implicitly established. Nobody is claiming what they're doing is illegal, so how does this add anything of value? Who is still unaware that corporations will use their size and market control to their benefit?
I've had several times where mail from custom domains associated with a business were delivered hours late by Outlook. Time sensitive emails. A guy coming to my office for a meeting called me and said he was downstairs and having an issue with security. Went down and swiped him in.
Four hours later, I got the same message by email. I thought he was back - nope. An email sent at 10am that was delivered at 4pm showed it was from 2pm until I looked at the header and saw sent at 10am and just... chilling out for 4 hours. DMARC was set up for them just fine.
I've had the same issue with my own custom domain, with DMARC set up. A year later, it finally got bumped up to some sort of "trusted" domain for that one place and my emails get delivered the same day now.
> Outlook.com and similar are an anathema to email. This is why they tell you not to run a mail server .
It turns out that whoever has the most power is the most powerful. This is why distributed/decentralized systems cannot singlehandedly free us from tyranny, and why I find people who spend all their time preaching decentralized systems to be quite silly. We don't need better systems (well maybe we do but,,,), we need better education and awareness of how billionaires manipulate us; this goes beyond software.
Complain all you want about the monopolists, and I do think you're right to do so, but a lot of their power comes from and is aimed at defeating the overwhelming flood of spam.
Mail, then emails, then home phones, then cell phones, then texts, then social media have been gradually rendered less and less usable by bad actors systematically abusing every single tool we try to use to communicate with one another to steal from us, lie to us, and manipulate our beliefs, and we'll just keep inventing and discarding new ways of communicating until we reckon with this.
With cheaper AI classification models coming out every day now, the spam problem is on the cusp of basically being solved in every communication channel.
The only question is how many years the lazy network-effects monopolies (like Google, Microsoft, Verizon, etc) will hold this back from happening.
The optimist in me says this will unlock pathways to true decentralization of push communication protocols (like SMTP) instead of only have decentralization of pull-oriented protocols (like HTTP).
Generation is, and always will be, cheaper and easier to do well than classification.
AI becoming faster empowers attackers far more than it empowers defenders. We're seeing this in every discipline and every corner of the software industry.
Decentralization is not a bulletproof solution. It is a mitigation. Until someone gets 50 percent of market share. Then they can run havoc on the ecosystem with their own customized system.
Pretty sure this or part of this just burned me. Icing on the cake is Nintendo will also ban hammer your email if it rejects some or all of their emails - including their dumptruck of marketing junk. The only and I mean only resolution to this is to basically move your Nintendo account to a different email completely. Absolutely unreal on both sides.
Yes, no one should not have DKIM or DMARC but holy yikes when neither side wants to actually give in to help the customer.
I was viciously mean in my communication with the Outlook team when they said they “couldn’t” remove me from the blocklist. I pointed out that, as the operator of a perfectly compliant secure server their inability to deliver my mail is a technical failure on their end and one which I will be contacting their supervisor about and they somehow managed to scrabble together the heroic ability to delete my row from a table. Never back down from these bastards.
Requiring DMARC may be good, but Outlook's approach is awful.
I was working for Microsoft when outlook.com launched and got a good email address that was my primary for more than a decade.
I had so many issues with things getting silently dropped with no recourse (2FA codes, account recovery mails, etc.) on so many sites that I finally gave up, reversed the stream, and had Outlook forward to GMail instead of vice versa. A few months after that, I realized that all my Outlook got was an enormous volume (hundreds of day) a spam and that all legitimate mail was going to my other accounts, so I turned it off entirely and haven't read that mailbox in over a year.
> I had so many issues with things getting silently dropped with no recourse (2FA codes, account recovery mails, etc.) on so many sites
This is not unique to Microsoft and really the source's problem — they did something to get blocked in the first place.
Add in the fact that you're almost certainly not the only one impacted, and that they have no interest in fixing it, it screams incompetence on the source's part.
Been there, done that, good luck explaining the problem to the app's first-level support in the Philippines because it's not in their script.
> and had Outlook forward to GMail
Till the day GMail hits you with the "We couldn't verify it's you" bullshit and locks you out of your account forever. Good luck getting support from Google, the word is not in their lexicon.
> This is not unique to Microsoft and really the source's problem — they did something to get blocked in the first place.
I've never encountered this issue with GMail. Delivery just works. I'm trying to think of the last false-positive spam flag I've had with GMail, and I've definitely never had mail be entirely dropped.
Just put codex in a continuous goal loop to keep you off the blacklists...give it whatever email / creds it needs to make the appropriate requests and make the needed changes (ofc tell it the guardrails it should follow).
Selfhosted email is likely easier now than it ever was before.
Because the protocol is flawed at its foundation - there is no good way to make sure that the person sending you something is a person and sending content you'd want to interact with. If the big providers weren't doing this stuff, we'd whine about the enormous amount of spam.
The solution is allow only communications that are demonstrably not spam and not unwanted.
There have been lots of proposals to this effect but maybe you have to put up two cents in a crypto wallet, which the other person can claim if the mail is unwanted. If someone takes your two cents, you remove them from your lists ASAP. The receiver doesn't benefit meaningfully from the 2c so they are unlikely to claim it. The sender is only damaged if a lot of different people claim the 2 cents. Maybe a few domains are default whitelisted even if they don't put up 2 cents, to protect against entities that are important but would be frequently spite-claimed (IRS, courts, and other similar). If you use a provider that doesn't whitelist, fine, but you're going to miss those emails.
Maybe the top 'spite claim' users are published and it becomes difficult to get people to agree to put up money to talk to you.
This reduces spam to the level of junk mail, which is still not totally trivial but is orders of magnitude more manageable.
> the protocol is flawed at its foundation - there is no good way to make sure that the person sending you something is a person and sending content you'd want to interact with.
There is and it's the same as other protocols including proprietary ones - a sender address whitelist.
There's no proprietary protocol that solved spam either.
Mine isn't from those email hosts, but it from google cloud or Azure typically (not AWS for whatever reason). Related, the gmail spam filter is terrible.
It seems insane that gmail doesnt provide a way to automatically send a mail (eg based on domain, keywords, etc) to spam. I know theres block sender but for example aliexpress uses a different name for every email so that's useless.
What this is called is survivorship bias. The question I would ask is how much mail are you not seeing at all because it's dropped at the edge first thing because it's IP block listed?
Next, how much spam are you seeing from them because they and Google are the largest providers on Earth? Kind of like selecting a random person from the population in the US and going "look, it's a white guy". Yea, that's how statistics works.
Lastly, because the are good at blocking spam at the edge, then that's the last bastion of attack for spammers to put their efforts in if they want any return at all.
I self-host and don't have a spam filter. Spam makes up about 1 in 5 messages I receive. It's always the same spam campaigns that would be easily filtered with a few regexes.
Self-hosting allows me to use a different receiving address for each entity I contact, so I know exactly who put me on spam lists and if it gets bad I can route that address to the garbage bin.
A web forum's users, who love nothing more than using the "flag" button to stomp out comments they don't like, are indignant upon discovering the world's third largest email provider has a "flag" button of their own.
Sounds more like using outlook.com is a mistake. I've been running my own mail server for over 20 years and outlook.com is literally the only domain I have had problems with, and this is the only reason that I now send via Scaleway's free transactional email service.
The people working on outlook.com are just talentless amateurs - the rest knows how to do it right. It's a shame it's so widely used.
I don't disagree, but what are your options when a giant portion of the population uses O365 and outlook.com? How are you going to get them to stop using it, so that legit emails from user-owned servers are not silently rejected?
It depends on the nature of the transaction. If the user needs the email more than you do, you just remind them Outlook deletes your messages, and they'll find a way, and in the long term usage of Outlook will decrease.
I've also been running my own server for over 20 years, but do note that the big players may block their senders from delivering mail to your server. This happened to me with GMail around 6-7 years ago, until I configured DMARC and/or DKIM and/or SPF to their liking. As far as I know, they don't do a press release when they update their rules.
I have a perfect score in google postmaster tools on dkim, spf and 0 spam reports. They still send all emails to spam. They will even do this if you are replying to the user who contacted you. Same experience for my friend running an indie festival. These days you pretty much have to alert gmail users by some other means (like if signing up on a website) that they have to check spam and whitelist you since it appears gmail would rather block legit emails than allow a single possible spam through.
That may be so, but you can't control what mail service your recipients use. So whether or not it's a bad idea, it can be your problem. That said I don't agree with OP that self-hosting mail is a bad idea.
Seems to work for many websites. But only if your users aren't giving you money, because it's 50/50 whether they'll use a different email address or give up entirely.
>Always? If emails are not answered you'll usually notice unless you're a Spammer
Means you're not using your email seriously. For example, to send CVs in response to job postings.
I send up to 20 email per day to people who have issues with their package build scripts, and I have no idea whether they ignore me because they stopped using the distro or because mail got dropped.
At the most you need to use an external service for delivery (usually because you have problems with MS) but you can still run your own server with no difficulties once you do that.
That said, DMARC is required by a lot of people now, so I do not think this particular issue is a problem.
I have been self hosting my my personal email (and for family). Few problems so far other than delivery to MS and I have recently moved a domain I use for work email over.
Oddly enough the MS problems come from hotmail, but not other services. If that is a problem, then pay a bit to have email delivered.
It's not enough. I have a domain that I had a very long time but it is on an undesirable tld. I got it long before it was problematic. Outlook always puts my mail in the SPAM folder even though I have done everything I could. I even deliver through a trusted provider. Not on any spam list. DMARC, DKIM, SPF all set up. No dice.
I kind of have to agree. DMARC is not new. It's useful and helps make email safer. It's not even hard to set up. There's just no reason for any legitimate mail provider not to use it. Same for people who are technical enough to run their own mail servers.
"Lazy people"? I only heard about this because a customer complained. Am I supposed to go around the Internet, checking what each mail server will allow or deny?
This seems overly dismissive especially for individuals who send emails from custom domains at low volumes. DMARC has previously been seen to only be really needed for high-volume senders. The mail testing service linked still gives 10/10 for emails received without DMARC (but with SPF and DKIK). My email is setup via Fastmail and I followed all the recommendations they provided (which didn’t include DMARC)
I just tried this out now with an email from my personal domain that I have configured to send via my gmail account. I got a 10/10, but DMARC does not seem to be required for this. It shows a yellow checkbox for me on this, the same as it shows for me not having an unsubscribe button, which hardly gives the impression of it being necessary, given that I would not expect an unsubscribe button to make sense for most people manually sending emails to their customers from corporate email accounts.
To be fair, DMARC has been required for a very long time. IIRC Google warned about 2 years ago circa that non-compliant emails would land in spam or be null-routed. And the DMARC noise started even before that.
Gmail only requires DMARC for senders that send >5000 emails per day. Below that it's not required. That rule only appeared in 2024 so I wouldn't say it's been required for a very long time. Perhaps you're thinking of DKIM, which is different.
You don't have to, this is the key reason to have a DMARC monitoring service. It will tell you when there's a deliverability issue with some particular receiver.
DMARC applies not on your mail server, inbound or outbound, but on the server that is receiving your mail (which may in fact be your mail server).
That server will look at how the mail authenticates and decide if it should allow the mail to proceed, it (for the most part) will then tell you whether or not it allowed the mail. This is how you will know you might have a deliverability problem before your customers do.
> You don't have to, this is the key reason to have a DMARC monitoring service. It will tell you when there's a deliverability issue with some particular receiver.
It's been a while, but monitoring DMARC seemed pointless once you got things started. If my outbound mail fails to validate, I've asked the receivers to bounce it, and I should be able to see that on my own system.
Otherwise, I'm just getting reports about spoofed spam or people who need to adjust their mail forwarding, but I can't do anything about either.
right, if you're at a reject status DMARC monitoring is (and should be) boring.
But it provides a safe guard against accidentally broken mail flows as your email stack evolves over time which is where it pays dividends.
I would love to say that it would have alerted you ahead of time to this particular event, but given that it's the fix here you would never have seen it.
As a company we realised about 12 months ago that email can no longer be considered a reliable method of communication. I understand the reasoning but the result is the result. Many new clients we deal with have whitelists on and we have to pester our clients to add us to their lists. Not a great experience for anyone. I think we should consider email pretty much moribund at this point.
It can be reliable, but requires an explicit agreement between the two parties. When my server connects to your server and sends a message, that part is reliable enough. If your server decides to delete the message after receiving it, that's entirely on you. You could configure it to never delete messages from me and then it's fine. The problem is that in reality nobody does this, so your vendors and customers get treated identically to random spammers.
It is literally one of the last free and open channels on the Internet – I suggest you work on supporting its use and keeping it that way rather than moving to something controlled for profit or data harvesting.
It being free and open is exactly what the big providers can't stand and why they are coming up with ever more "standards" that are complex to configure as well as "reputation" scores that are hard for small senders to clear.
Also why they do non-standard stuff like accepting mail but then simply not delivering it, rather than bouncing it.
"Reputation scores" and blacklists / greylists started in late 1990s / early 2000s as multiple grassroots efforts when spam started to overwhelm systems. Gmail did not exist, outlook.com did not exist, it was easy and expected to run your own SMTP (which I did). And it was very unpleasant.
DMARC appeared 10 if not 15 years ago. There's no reason for a sane MTA configuration not to have it.
Calling it a "free and open channel" when 80% of consumers are on Microsoft/Google addresses that control who can deliver e-mail is laughable. It's dead, Jim.
Strengthen your contracts / terms of service. Make it their responsibility to configure their email systems properly so they receive emails sent from your domains.
If reliable means the message gets through no matter what, then it's good that no channel is reliable. Such a channel will inevitably be used for spam and attention grabbing.
If running a mail server is central to your business, you should keep up with best practices. If not, 2 days of non-delivery aren't important, just resend.
Delivery to Microsoft's products has been patchy for several years. I am not remotely an email deliverability expert but I have made different SMTP service choices based on how companies approach shared-IP sending plans.
Some can affordably deliver to Microsoft because they aggressively police what they are actually sending on their customers' behalf; others don't get involved and you end up having to spend a fortune on a dedicated IP.
The DMARC thing is just another part of this; one of my clients discovered this silent failure themselves a few weeks back and addressed this.
DMARC is a DNS record that says "send emails about spoofed messages here", or optionally "I don't need you to tell me that scammers exist on the internet".
It doesn't prevent spoofing, it doesn't say which IPs are authorized to send on behalf of a domain, it doesn't sign messages. Spoofed messages are still sendable.
Can you explain the benefit of only accepting email if Microsoft knows that you may or may not accept emails about scammers unsuccessfully spoofing your email domain? (Note, there's nothing you can do if they do tell you.)
Don't confuse DMARC with DKIM or SPF; DMARC doesn't actually do anything for email security.
That is not true. Reports are just one of the features of DMARC. The policy which allows you to instruct senders what to do with unauthenticated emails is the much more relevant part an when the receiver follows it, it very much does prevent spoofing.
And what should a provider do if the dmarc policy says that none of the dkim or dmarc records should matter? What was the point of spf saying what servers could send, or dkim specifying signing keys?
"Oh, please, don't ignore the other two ways I told you to ignore unauthorized messages" shouldn't need a knob.
You get an email without a DKIM signature from me.
Is that because I do not use DKIM and do not sign my emails or because the message is forged and not from me at all?
You cannot tell. There is a single SPF record that you can look up to see if SPF is configured. It's just a TXT record on the domain. But there is no standard DKIM record. A DKIM signed email tells you what key identifier it used and you have to use that to look up the DKIM key at <key identifier>._domainkey.<sender domain>. When the email has no DKIM signature you cannot tell if that's because the sender domain does not use DKIM or if it does have a DKIM key record but it was not used, potentially because the email is forged.
You'll have a bad time if you just drop all emails without DKIM. There are many large senders that do not care about well established email standards and you will drop important emails.
I have MCP servers for the creation of domains, DNS records with DNSSEC, and email accounts with SPF, DKIM and DMARC. I'm sure if someone wants to be a professional spammer today, DMARC is not a differentiator.
It's an interesting argument. The fact this article exists is somewhat proof that it is a differentiator. The flipside, however, is that spammers very specifically require their emails to get to add many mailboxes as possible, so their motivation is greater to make their emails service compatible.
Company sys admins have likely got all sorts of other issues to worry about, and the occasional report of an email not getting through is likely low on their to-investigate list.
Having said that, I self host a mail server, and have all those things setup correctly, and my workplace uses Outlook, and I've not had issues with delivery, so it's not a particularly difficult bar to jump.
What? How does it prove it's a differentiator for someone who wants to be a spammer, which is what the comment you replied to made a claim about? As far as I can tell, it's evidence (not proof) that Microsoft thinks that they will reduce spam by requiring it, which in turn is circumstantial evidence (definitely not proof) that spammers might have to spend some amount of effort to start using DMARC. I don't understand how you can conclude that it would be onerous for them to do so indefinitely; it seems equally plausible that they might have just not bothered to do it before now but will be able to start doing it without much cost.
Outlook.com has quietly dropped[0] emails from certain domains/IPs for years, even with SPF/DKIM/DMARC all properly set up and no history of spam. As someone who's administering their own mail server, Outlook has been the bane of my existence.
[0]: As in: They accepted the email just fine (according to the logs) but it still didn't end up in the recipient's mailbox.
"Quietly" in the title is an AI slopspam pattern. It's an over-used teenager hyperbolic crutch word on par with "literally", "actually", "honestly" and similar.
Sometimes it's use is appropriate, but not in this case. Microsoft announced this change loudly, multiple times, starting more than a year ago. I seem to recall one of those announcements being discussed here on HN. Even the article links to it's own previous announcements, so "quietly" here is stupid rage bait to justify a blogspam advert.
This was my second hackernews submit [0]! So, not even https in 2014 :)
When I ran that server, outlook.com was also the only one that would blackhole my email for no known reason. Support was unhelpful and also could not point to any reason. I've since given up, but for a short time it was glorious, email to family would not leave the lan and we could send attachments of arbitrary size.
You adopted it the moment it was announced? Really?
Is there a risk some people on this thread are mixing up DKIM and DMARC?
DKIM = proving that an email was sent from a specific domain using cryptography. Good for spam fighting and deliverability.
DMARC = telling receivers how to handle mail that fails authentication.
DMARC is primarily useful for large, complex organizations where email admins may not be aware of everyone inside the org who is sending mail that advertises the domain in the From header, or organizations that might be targeted by impersonation attacks (e.g. phishing). Being able to tell recipients "yes we absolutely have our act together so feel free to reject or spamfolder unauthenticated email" is great for killing phishing campaigns, and being able to request reports is great for finding that one sales org that signed up for a guerrilla marketing SaaS that's impersonating them.
But for small personal domains the value isn't that high.
I added DMARC and DKIM together, around the same time as some particular life events 10 years ago. Just now, I cross-checked the information against the commits in my Git repos.
Back then, I didn’t use Terraform or anything like that, but I had text files with logs that described the DNS setup in detail so I could fix things. By grepping through the logs, I’m able to put a definitive bound on when I added DMARC—it was no later than June 2016, over 10 years ago.
At the time I thought, “Obviously, we should all be setting this up, because recipients will start rejecting mail from insecure domains, if they don’t already.” This was also back when I self-hosted email. I eventually stopped doing that because I thought it was too time-consuming.
No DMARC is about telling receivers which of SPF/DKIM are valid, what to do with it when it fails, and where to send a report to. Oh look.. like Mike said.
DMARC is primarily about "alignment" (switching SPF from caring about the envelope sender to instead using the from header). Yes, it does also tangentially address those other points, but the primary reason it was adopted was to prevent spoofing of from headers (where in original spf that was a non-goal)
This is interesting. At some point, I think it'll be desirable to give increasing positive weight to emails with the DPF/DKIM/DMARC trifecta configured, since those are least likely to be problem emails (spam or phishing), but I wonder what the best avenue is to actually make that the default. It's almost certainly not this kind of unannounced cutoff.
Email is, I think, among the most distributed popular online services, and there's a ton of stuff that's legacy, self-managed, or otherwise janky. Supporting SPF, DKIM, and DMARC does put a burden on independent operators, but is it an undue or unreasonable one in the current landscape? Or is it just the new cost of doing business?
It seems like 90% of the spam I receive (on my google account) is sent from google addresses, so it will have valid SPF/DKIM/DMARC setup.
That said checking for these things is a good idea, the only problem I see is dropping the mail on the floor, rather than rejecting it at SMTP time - at least that lets the self-hosting users who haven't got things configured know their email is being rejected, and to pick up the phone instead.
There's nothing worse than sending an email, it being accepted, and then later discarded with no clue to either sender or recipient.
My server doesn't reject anyone, but does greylisting. That's a default setting in Postfix. It means the first time an IP address connects it gets a temporary error. If it retries later the message is accepted. That's the only anti-spam measure I have.
Maybe 1 in 5 emails I get is spam, and because I use a different address with every sender I know who sold "my" address to a spam list.
> but is it an undue or unreasonable one in the current landscape
Yes. In the first place, this should not even be a thing. Two corporations should not be in control of who can send e-mail. If they want to mark not having DMARC as spam, mark it as spam, or better yet flag it with a specific warning about the domain, but these games with refusing to deliver are just bullshit and essentially force a monopoly where other e-mail providers cannot compete because their e-mails aren't delivered.
No, not delivering is much better. You get a clean error message that tells you exactly what to do, it can be fixed in minutes. Spamfoldering email for not having DMARC would be a mistake, it might be years before low volume senders notice and figure out what's wrong (if they ever do).
> You get a clean error message that tells you exactly what to do
We are literally talking about a situation where this is not happening! And the problem is that it's not just this. Once you give them a license to police e-mail, they start policing e-mail for all kinds of arbitrary and inscrutable reasons. If this were going to be done, it should really be formalized as an industry standard by an independent consortium, not up to the whims of Microsoogle.
> I wonder what the best avenue is to actually make that the default. It's almost certainly not this kind of unannounced cutoff.
En contraire, I think not delivering mail is the fastest way to adoption. People will use an old system for as long as it works. It now does not anymore.
I don't know. I think this disenfranchises a lot of independent operators, and the blow of that could at least be softened by making a highly-visible public announcement about it a few months ahead of time.
Maybe you're right that just enforcing it is the way, but I don't agree with doing that with no heads up.
Most spam I get is from Google, Microsoft and Amazon. We should pressure those to start dealing with the problem. Right now they are conveniently ignoring it.
None of them are a good 'Is this spam?' heuristic, though. All they do is ensure the sending domain isn't forged, but most spam, even phishing emails, doesn't really rely on that. Spammers are much more motivated than average to jump through the hoops necessary to set it up, as well. Any anti-spam signal needs to be much more expensive for spammers than regular senders.
Requiring HTTPS was very unreasonable. You have so many more moving parts that can go wrong, and a business relationship with a CA (even if it's Let's Encrypt). We only tolerate this because the alternative is worse.
You can literally just Google a 3 step guide for any provider. What are you even arguing? That security for infra shouldn't be a thing? Should grandma be able to run a mail server? What's your point?
I'm arguing that with a system as distributed as email, there will certainly be people who won't do this upgrade; I'm highlighting the contrast between the need for this set of technologies (SPF, DKIM, DMARC) and the utility of an old-school open web where the barrier to entry is low and anyone can participate.
We have seen a massive erosion of the latter aspect of the web in the past few years, and I think it's useful to frame conversations in terms of that loss. The web used to be fun, and now it's become, more than ever, a professional enterprise. You often can't stand up a website without having to buy into Cloudflare's DDoS protection or something equivalent. I think this is absurd, and it's not the only such case, though these changes are obviously reactions to how usage of the web's evolved over the years.
I wonder if we can get the old web back in some way, shape, or form, cause I think we've lost something with the corporatization of the internet.
And for what it's worth, yeah, I think grandma should be able to run a mail server. Why not?
I thought they've been doing this for years, along with gmail/etc. I basically just added setting up the correct DNS records as part of business when sending emails externally.
I actually totally agree with this. There's too much risk involved with scams disguised as legitimate services because the developers of said service couldn't be bothered to add 1 or 2 dns records.
Although there seems that there hasn't been any communication which is the bad thing here. However, nobody looks at those and sending detailed emails back seems like a good enough solution.
Unfortunately, the people abusing these are very persistent and adding more checks will just increase the sophistication of such attacks which works against the interests of the target.
This stops disguising yourself as a legitimate service.
I don't know what "v=DMARC1; p=none;" is proving to anyone when DKIM and SPF are already aligned but sure whatever. Just wish they'd given some warning!
Agreed. There's no additional verity provided by adding a DNS record with a static line of text. Reminds me of airport security theater: meaningless hoops for citizens to jump thru under the guise of stopping bad actors.
The only mistake people make here is to accept that the problem is on their end even after Microsoft has accepted the e-mail but silently discarded it. This leads to the customer impression that the mistake happens on their end and not on Microsoft's.
When I see in my logs that the e-mail has been successfully delivered to their MTA then I don't have a problem.
Yep. Let's say for example you were sending a legally important email saying you did something, and your customer tried to sue you over not sending the email. If you sent it and the customer's agent (Microsoft) dropped it, that's a problem between the customer and their agent, and you are not liable.
(If this happens to you, don't admit that you know Microsoft drops your emails, or you'll be liable again!)
I have the opposite problem. I have a 3-letter email address, so for ease of giving out the email address, I use it, while having it forwarded to my Gmail. Somewhere around 2019, emails from legitimate services, especially password reset/OTP codes, stopped landing in my inbox or even junk because my address is so high up the chain of spammers. Nebula was the first to confirm this for me and work out of band to re-enable access to my account - their emails to me were bouncing. But ever since that happened, I’ve slowly moved back to giving my Gmail.
"ARC was devised to solve this problem by giving intermediate servers a way to sign the original message's validation results. Even if the SPF and DKIM validation fail, the receiving service can choose to validate the ARC chain. If it indicates that the original message passed the SPF and DKIM checks, and the only modifications were made by intermediaries trusted by the receiving service, the receiving service may choose to accept the email."
It sounds like Gmail is seeing 3000 emails a day coming from foo@bar.com, some of which are different kinds of spam, and reasonably concludes they are a spammer.
I self-host my email system and rarely send any outbound email. Occasionally I receive emails from individual users. Users on Microsoft’s email service can send emails to me, but my replies are rejected outright. This doesn’t happen with Gmail or other email providers.
On an unrelated but frustrating "silent behaviour" note, I hate how Outlook rewrites URLs to add their "safe links" domain indirection. Just show me the damn raw URL!
I have a bunch of email accounts which have SPF and DKIM, but are missing the DMARC line - I've had no deliverability problems at all, until this weekend, and now only with Outlook. Emails to Gmail accounts go through just fine.
The combination of:
√ Valid SPF
√ Valid DKIM signature
X Missing DMARC policy
Is clearly ambiguous. Since a DMARC of "p=none" (in the context of valid SPF and DKIM) really adds no information, so interpreting "missing DMARC" as "p=none" seems reasonable. Sounds like Microsoft was taking that approach until this weekend.
Under RFC 7489 [1], a domain with no DMARC record simply has no DMARC policy, the receiver is able to enforce whatever policy it likes.
Most receivers have chosen to treat this as p=none for the last decade (Microsoft included). This is changing to now so that mail with no record is simply refused. Nothing in the standard prohibits this.
a DMARC of p=none might be seen as ambiguous - SPF and DKIM have their own jobs and they work. However, the point of DMARC is not a new way of enforcing mail authentication. Instead it is a way of making certain that the mail is internally consistent and furthermore provides two additional things.
1. it indicates if the domain owner has thoroughly gotten their mail to authenticate (in which case they adopt a p=reject), and
2. it provides a feedback mechanism that allows the domain owner to know if they are seeing authentication and deliverability problems in such a way that they can fix those broken mail flows.
Googling around this started at least a year ago, but I worked at an MSP 3 years ago when it was first announced and we started getting customers into compliance. This wasn't something out of the blue.
This is a good thing for the actual email users. The volume of really obvious “spam” emails were through the roof that it became quite tedious to rescue legit emails. It’s not like setting up DMARC is hard either.
Tangentially-related: Gmail has started sending completely legitimate emails to spam. DMARC/SPF/DKIM (2048 bits) all properly configured of course so there has to be something else that isn't documented.
They have been doing that for years. A long time ago there was a submission here on HN about some Ivy League college urging college applicants to provide something other than a Gmail address because application-related emails (including acceptances!) would frequently not get through.
Started? My Gmail spam filter has been broken for several years now. Extremely obvious spam regularly ends up in the primary inbox and critical, fully legitimate messages get buried in spam. It’s a major reason why I left for another provider.
My first thought as well: how does one quietly reject email? Skimmed the comments and clearly it's not quietly. Saved a click...
It's quiet only if the server accepts it and then deletes it on their end without notifying the sender, but if your mail provider shreds your mail that's then also your provider's responsibility and not the sender's
Replying to all inbound messages with a bounce is an old idea. The theory was that legitimate senders would validate their address and get added to a white list. The scheme didn't work for the same reason captchas don't work.
This has been going on for much longer than stated here - we had domain mismatch issues with outlook going back years and our policy was p=none. They’re very sensitive and mailing lists with forwarding are heavily impacted.
Do you know if it’ll affect my (personal) account? I run everything through a normal Gmail account and have forwarding for incoming email and an alias for outgoing stuff
We have everything we need to define email 2.0 with mandatory security, the problem is all the older installations that support 1.0 that everyone still expects to talk to.
New protocols only solved this by cutting compatibility. Signal can be E2EE because you can't send a message to an email address with it. Email can also be E2EE, but how do you know the recipient supports it?
Deutsche Telekom is a regional monopoly that abuses its position in every possible way. It's like Comcast but even worse. Best thing you can do is forget they exist and if someone really wants to contact you they'll find another way.
I’ve been anticipating something like this for a while; the number of folks who don’t have their email-related DNS settings in order is remarkably high.
That's an old announcement about a different change. As far as I can tell this one is completely out of the blue. I'm shocked by the number of people in this thread advocating for spontaneous changes without any warning.
Yes, this is an older announcement from last year. Yahoo and Google did the same at that time.
The failure associated with that announcement is different. It is 5.7.515.
This new failure mode is "5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records (AS9031519)", I haven't seen any formal announcement on my end. The important thing to know about 5.7.1 is that it represents a few different failure modes, the AS9031519 is the important bit and it indicates that the domain lacks a DMARC record.
My mail provider, MXroute, sent me a notification of the issue early yesterday. There is commentary from various DMARC providers (Suped and PowerDMARC). This is a real thing.
It does not matter which host you are using, this has nothing to do with the hosting provider. It has everything to do with having your domain correctly set up on DNS so that anybody receiving mail will know how to authenticate it. Microsoft has apparently advanced a policy that if you don't even try you don't get to send.
IMO this is the right call, I've seen plenty of spoofing attacks where the attacker took advantage of nonexistent policy on non-sending domains. You might think that if you don't have an MX record the domain can't be used to send mail, that is wrong. The MX record only tells others where to send your mail, it says nothing about whether the domain can send mail itself.
The point is to have a DMARC record, setting it to none doesn't really do much of anything for you though. If you really wanted to take advantage of it you will need a DMARC monitoring solution - the market seems to typically price these around $10/month for small-ish domains (though there are a lot of caveats). I'm trying to build a reasonable free option that maybe isn't enough to get a domain to a reject policy, but should be enough for you to maintain a reject policy.
The truth is that there are amply "non-sending" domains out there which ignore DMARC and allow abuse. Stopping the assumption of no policy mean p=none prevents this abuse from persisting.
I was hit by this twenty minutes ago. I don't disagree with the policy, but I wish my provider had warned me so I could add the headers. I already had DKIM and SPF, but not DMARC.
I suspect that he/she means they runs a mail server and it was up to his customers to comply, but now they’ve had to deal with the fallout from their customers not complying.
The customers have to do it themselves since they control their domains. I recommend doing everything correctly but also understand that this stuff is pretty hard for people just trying to run a small business. But if it makes you happy to feel smug you can carry on assuming.
When you talk about a single entity to single entity connection it can be any protocol. Email, Matrix, WhatsApp, SMS... Discord... Instagram. All of them work especially if you whitelist the other party.
What doesn't work any more is assuming that everyone is using the same thing. Back when email was invented it was the only computer-based communication protocol - I don't remember whether it came before or after USENET - I'm assuming before. If you wanted to send a message to someone you sent it to their email address. Now things aren't so clear.
It's possibly yet another issue relating to the long streak of problems seen the recent months by primarily self-hosters trying to reach people and businesses behind Outlook servers. The past few weeks a lot of my e-mails to friends and family using Hotmail have gone missing. All envelopes were OKd by Outlook servers, nothing bounced, e-mails just gone. My setup is clean, my network is clean.
I'm fine with providers imposing some default level of spam protection but as a user I'd like the option to disable it, even better if I can disable it per domain or sender. The old technique of adding the sender to your contacts doesn't work reliably anymore.
"The old technique of adding the sender to your contacts doesn't work reliably anymore."
An Outlook user first reaching out to you, and you replying and including the unique message-ID of their original envelope in your headers, doesn't affect anything either. Absurd. The whole situation is complete dog shit.
They used to just drop all messages from domains not on their whitelist and to get whitelisted you needed to have a Microsoft account and open a support ticket.
Do they literally just need the DMARC record to exist though, or do they need it to actually say something? Do you need DKIM? I found that SPF is very easy but DKIM is a royal pain.
DMARC is layered across (/is useless without) two other protocols (SPF, DKIM), both of which also require DNS records.. there's no way to DMARC with one record.. unless you're excluding those SPF and DKIM records in your count. You /could/ DMARC with two records: DMARC+SPF, or DMARK+DKIM but it's ill-advised - use all three. (Ignoring host hierarchy/cname delegation, you can have far more records)
MTA-STS is useful (but it's about helping receivers by demanding mail is sent encrypted, not senders with delivery).
BIMI is a pay-to-spam protocol that helps senders, you can add a rule to postfix to mark it as such.
APRF is a draft, and likewise helps senders, not receivers.. not sure why anyone would want to adopt this standard. A little closer to DMARC reports, but sharing PI that you owe no sending server.
"Since November 5, 2026, Microsoft's consumer mail service has been turning away some of the email from domains that don't publish a DMARC record. If your company emails customers, vendors or applicants with outlook.com, hotmail.com, live.com or msn.com addresses, some of that mail may be bouncing right now. Nobody announced it. The fix is one DNS record."
I'm personally seeing this with some email systems I manage - email sent from a domain that has proper SPF and DKIM signatures, but had no DMARC record started bouncing this weekend.
Outlook.com is also rejecting mail based on blocklists that are not public and you essentialy cannot get yourself out. My VPS provider is pretty much entirely blocked and their regular blocklist process says we are golden so nothing to unblock.
Outlook.com and similar are an anathema to email. This is why they tell you not to run a mail server .
On the other hand rejecting domains without dmarc is fine. Just not happy it is silent.
outlook.com and O365 are horrible to deliver to. We regularly get issues where we sent an email it was accepted by O365 but was never delivered to the mailbox. We have one person working at least half the time on resolving stuff like that. And that's from a respectably maintained SES egress with good reputation, DMARC, DKIM configured.
There is a trick. Sign up with them, configure custom domain, but don’t set your MX records. On your MTA, route mail that goes to Outlook/Hotmail to go through their MSA with your Outlook credentials and headers stripped as if submitted directly by user. Outlook gets mail through their own MSA it trusts, rest of the world talks to your mail system directly. Replies still go to your MXes.
I haven’t productionized this setup (I send maybe a dozen emails a year) but it worked for me ad hoc a couple years back, when I had to send a mail to an Outlook-hosted address and they blackholed everything I tried to send while 250 OKing me.
What's the nature of your operation? If they're not giving you money then you're within your rights to say "sorry, don't use outlook"
Funny, they have no problem handling mail for essentially every Fortune 500 company and others large and small.
It's always people self-hosting mail on a shared server in Moldova (because they think it makes them cool) that are complaining.
Self hosting mail on a shared server in Moldova is basically the entire idea behind email (and the internet).
Which with cheap models like Jev as spam classifiers, this can now become a reality.
The problem is, Google and Microsoft have monopolized the entire email market, so their esoteric deliverability mysticism from 2007 still persists (basically blanket bans on entire IP spaces, locking out anybody trying to send emails on their own).
People used to have party lines and leave their doors unlocked too, but it turns out the world is filled with bad actors and other assorted shitty people.
Email naturally followed this evolution.
So naturally everyone should just leave e-mail to be run by all the corporations.
You shouldn't own your car or your house, give them to all the corporations as well.
Nothing is stopping you and your three friends from running your own SMTP servers and emailing each other.
As soon as you want to do business with Outlook's customers, you play by their rules.
This is one thing I find more on Hacker News than most other discussion sites. Any topic about annoying or bad behaviour by corporations eventually devolves to "they're allowed to do it".
"They're allowed to do it" is one of those things that doesn't really bear saying so much because that's already been implicitly established. Nobody is claiming what they're doing is illegal, so how does this add anything of value? Who is still unaware that corporations will use their size and market control to their benefit?
Some of us still leave our doors unlocked, too.
I've never even had the key to mine. I've lived here over a decade.
> Which with cheap models like Jev as spam classifiers, this can now become a reality.
With LLMs on the other side trying to make spam less detectable by cheap models like Jev?
It's funny when people assume benefits from some tech go one way and baddies will surely never use it...
Maybe because every Fortune 500 company (and 99% of all large companies / orgs worldwide) uses O365 / Exchange / GSuite?
Nope, people self-hosting mail on their own hardware from their own basement in Serbia ;)
https://www.mimar.rs/blog/a-journey-of-my-mx-server-to-new-r...
And yes, it's cool not to have to let scum read your private communications :D
I've had several times where mail from custom domains associated with a business were delivered hours late by Outlook. Time sensitive emails. A guy coming to my office for a meeting called me and said he was downstairs and having an issue with security. Went down and swiped him in.
Four hours later, I got the same message by email. I thought he was back - nope. An email sent at 10am that was delivered at 4pm showed it was from 2pm until I looked at the header and saw sent at 10am and just... chilling out for 4 hours. DMARC was set up for them just fine.
I've had the same issue with my own custom domain, with DMARC set up. A year later, it finally got bumped up to some sort of "trusted" domain for that one place and my emails get delivered the same day now.
Which VPS provider out of curiosity?
> Outlook.com and similar are an anathema to email. This is why they tell you not to run a mail server .
It turns out that whoever has the most power is the most powerful. This is why distributed/decentralized systems cannot singlehandedly free us from tyranny, and why I find people who spend all their time preaching decentralized systems to be quite silly. We don't need better systems (well maybe we do but,,,), we need better education and awareness of how billionaires manipulate us; this goes beyond software.
Complain all you want about the monopolists, and I do think you're right to do so, but a lot of their power comes from and is aimed at defeating the overwhelming flood of spam.
Mail, then emails, then home phones, then cell phones, then texts, then social media have been gradually rendered less and less usable by bad actors systematically abusing every single tool we try to use to communicate with one another to steal from us, lie to us, and manipulate our beliefs, and we'll just keep inventing and discarding new ways of communicating until we reckon with this.
With cheaper AI classification models coming out every day now, the spam problem is on the cusp of basically being solved in every communication channel.
The only question is how many years the lazy network-effects monopolies (like Google, Microsoft, Verizon, etc) will hold this back from happening.
The optimist in me says this will unlock pathways to true decentralization of push communication protocols (like SMTP) instead of only have decentralization of pull-oriented protocols (like HTTP).
On the contrary, with cheaper AI generation the spam problem becomes harder by the day.
classification != generation
Generation is, and always will be, cheaper and easier to do well than classification.
AI becoming faster empowers attackers far more than it empowers defenders. We're seeing this in every discipline and every corner of the software industry.
"Two years from now, spam will be solved." - Bill Gates at the World Economic Forum, in 2004
I don't think anyone believes it will "singlehandedly free us from tyranny", it's one component for a healthy ecosystem.
Decentralization is not a bulletproof solution. It is a mitigation. Until someone gets 50 percent of market share. Then they can run havoc on the ecosystem with their own customized system.
We could tax billionaires and use the money for a Manhattan Project to stamp out fraud, abuse, and corruption.
But we won't.
>we need better education and awareness of how billionaires manipulate us
So that people would vote for the government to manipulate them instead?
Honestly, I hate outlook as much as you do, but I'd still prefer it to Max
https://en.wikipedia.org/wiki/Max_(app)
Pretty sure this or part of this just burned me. Icing on the cake is Nintendo will also ban hammer your email if it rejects some or all of their emails - including their dumptruck of marketing junk. The only and I mean only resolution to this is to basically move your Nintendo account to a different email completely. Absolutely unreal on both sides.
Yes, no one should not have DKIM or DMARC but holy yikes when neither side wants to actually give in to help the customer.
I was viciously mean in my communication with the Outlook team when they said they “couldn’t” remove me from the blocklist. I pointed out that, as the operator of a perfectly compliant secure server their inability to deliver my mail is a technical failure on their end and one which I will be contacting their supervisor about and they somehow managed to scrabble together the heroic ability to delete my row from a table. Never back down from these bastards.
Maybe don't self-host mail on a shitty $1/month VPS where 99% of the tenants are spammer scum?
This is not Microsoft's fault. The building's on fire and they're locking out the arsonists.
Requiring DMARC may be good, but Outlook's approach is awful.
I was working for Microsoft when outlook.com launched and got a good email address that was my primary for more than a decade.
I had so many issues with things getting silently dropped with no recourse (2FA codes, account recovery mails, etc.) on so many sites that I finally gave up, reversed the stream, and had Outlook forward to GMail instead of vice versa. A few months after that, I realized that all my Outlook got was an enormous volume (hundreds of day) a spam and that all legitimate mail was going to my other accounts, so I turned it off entirely and haven't read that mailbox in over a year.
> I had so many issues with things getting silently dropped with no recourse (2FA codes, account recovery mails, etc.) on so many sites
This is not unique to Microsoft and really the source's problem — they did something to get blocked in the first place.
Add in the fact that you're almost certainly not the only one impacted, and that they have no interest in fixing it, it screams incompetence on the source's part.
Been there, done that, good luck explaining the problem to the app's first-level support in the Philippines because it's not in their script.
> and had Outlook forward to GMail
Till the day GMail hits you with the "We couldn't verify it's you" bullshit and locks you out of your account forever. Good luck getting support from Google, the word is not in their lexicon.
> This is not unique to Microsoft and really the source's problem — they did something to get blocked in the first place.
I've never encountered this issue with GMail. Delivery just works. I'm trying to think of the last false-positive spam flag I've had with GMail, and I've definitely never had mail be entirely dropped.
I've had a lot of that.
Just put codex in a continuous goal loop to keep you off the blacklists...give it whatever email / creds it needs to make the appropriate requests and make the needed changes (ofc tell it the guardrails it should follow).
Selfhosted email is likely easier now than it ever was before.
Using self hosted email service is a big mistake in 2026.
Why are we so willingly ceding one of the few widely used free and open protocols to a handful of $mega-billion providers?
Experience shows that the walls will get taller and the moats will get deeper.
Because the noise is so loud now that people are basically just coping with the stresses of work life by taking the easy path in the home life.
Because the protocol is flawed at its foundation - there is no good way to make sure that the person sending you something is a person and sending content you'd want to interact with. If the big providers weren't doing this stuff, we'd whine about the enormous amount of spam.
The solution is allow only communications that are demonstrably not spam and not unwanted.
There have been lots of proposals to this effect but maybe you have to put up two cents in a crypto wallet, which the other person can claim if the mail is unwanted. If someone takes your two cents, you remove them from your lists ASAP. The receiver doesn't benefit meaningfully from the 2c so they are unlikely to claim it. The sender is only damaged if a lot of different people claim the 2 cents. Maybe a few domains are default whitelisted even if they don't put up 2 cents, to protect against entities that are important but would be frequently spite-claimed (IRS, courts, and other similar). If you use a provider that doesn't whitelist, fine, but you're going to miss those emails.
Maybe the top 'spite claim' users are published and it becomes difficult to get people to agree to put up money to talk to you.
This reduces spam to the level of junk mail, which is still not totally trivial but is orders of magnitude more manageable.
> the protocol is flawed at its foundation - there is no good way to make sure that the person sending you something is a person and sending content you'd want to interact with.
There is and it's the same as other protocols including proprietary ones - a sender address whitelist.
There's no proprietary protocol that solved spam either.
Nearly all the spam I get has an email address from those providers.
Seems they are the disease not the cure
Mine isn't from those email hosts, but it from google cloud or Azure typically (not AWS for whatever reason). Related, the gmail spam filter is terrible.
Most of my spam is from gmail addresses. Why Google hasn't figured out how to stop the fake Norton renewal notices is just mind-boggling.
Lately I've also been getting a lot from compromised MS365 accounts.
>Related, the gmail spam filter is terrible.
It seems insane that gmail doesnt provide a way to automatically send a mail (eg based on domain, keywords, etc) to spam. I know theres block sender but for example aliexpress uses a different name for every email so that's useless.
I think you misunderstand the disease.
What this is called is survivorship bias. The question I would ask is how much mail are you not seeing at all because it's dropped at the edge first thing because it's IP block listed?
Next, how much spam are you seeing from them because they and Google are the largest providers on Earth? Kind of like selecting a random person from the population in the US and going "look, it's a white guy". Yea, that's how statistics works.
Lastly, because the are good at blocking spam at the edge, then that's the last bastion of attack for spammers to put their efforts in if they want any return at all.
I self-host and don't have a spam filter. Spam makes up about 1 in 5 messages I receive. It's always the same spam campaigns that would be easily filtered with a few regexes.
Self-hosting allows me to use a different receiving address for each entity I contact, so I know exactly who put me on spam lists and if it gets bad I can route that address to the garbage bin.
Sorry but bastions are defensive.
Spam is a super solved problem though and I'd rather have false negative spam than email oligarchy.
> frequently spite-claimed (IRS, courts, and other similar)
These entities communicate via plain old mail, that costs more than 2 cents already.
A web forum's users, who love nothing more than using the "flag" button to stomp out comments they don't like, are indignant upon discovering the world's third largest email provider has a "flag" button of their own.
Third? What's second, Yahoo? I know Gmail is first.
Sounds more like using outlook.com is a mistake. I've been running my own mail server for over 20 years and outlook.com is literally the only domain I have had problems with, and this is the only reason that I now send via Scaleway's free transactional email service.
The people working on outlook.com are just talentless amateurs - the rest knows how to do it right. It's a shame it's so widely used.
>I've been running my own mail server for over 20 years and outlook.com is literally the only domain I have had problems with
What about tencent.com, foxmail.com, or qq.com?
I don't disagree, but what are your options when a giant portion of the population uses O365 and outlook.com? How are you going to get them to stop using it, so that legit emails from user-owned servers are not silently rejected?
Most of them wouldn't even care probably...
It depends on the nature of the transaction. If the user needs the email more than you do, you just remind them Outlook deletes your messages, and they'll find a way, and in the long term usage of Outlook will decrease.
I use a sending service. I would prefer not having to, but at least all inbound email goes directly to my server.
I've also been running my own server for over 20 years, but do note that the big players may block their senders from delivering mail to your server. This happened to me with GMail around 6-7 years ago, until I configured DMARC and/or DKIM and/or SPF to their liking. As far as I know, they don't do a press release when they update their rules.
I have a perfect score in google postmaster tools on dkim, spf and 0 spam reports. They still send all emails to spam. They will even do this if you are replying to the user who contacted you. Same experience for my friend running an indie festival. These days you pretty much have to alert gmail users by some other means (like if signing up on a website) that they have to check spam and whitelist you since it appears gmail would rather block legit emails than allow a single possible spam through.
Alt take: Using a Microsoft-hosted email service is a big mistake in 2026...
That may be so, but you can't control what mail service your recipients use. So whether or not it's a bad idea, it can be your problem. That said I don't agree with OP that self-hosting mail is a bad idea.
Yes you can.
User signs up, uses @outlook. Your app declines it and explains that they block with no way to remedy, and explain they are a bad vendor.
Deeply unserious take.
Seems to work for many websites. But only if your users aren't giving you money, because it's 50/50 whether they'll use a different email address or give up entirely.
As unserious as you claim, we had this exact problem.
Emails would be accepted by Outlook.com, but would never deliver. We had SPF/DKIM/DMARC and full reporting. They RBL'ed us with no remedy.
We told the customer to not use outlook.com BECAUSE we told them we could not guarantee any delivery of messages.
Lol if you do that, your service is just going to have a small minority of people and most people will just not bother using your app/service entirely
Most people aren't using Outlook. If your users mostly are, then this solution doesn't work for you. But it does work for many people.
You can take my email server from my cold, dead hands.
Proudly self-hosting since 2001. My mail server is in my basement. Do not know what you are talking about.
How often would you be able to detect acceptance-but-non-delivery of your emails to office.com-hosted emails?
Always? If emails are not answered you'll usually notice unless you're a Spammer
>Always? If emails are not answered you'll usually notice unless you're a Spammer
Means you're not using your email seriously. For example, to send CVs in response to job postings.
I send up to 20 email per day to people who have issues with their package build scripts, and I have no idea whether they ignore me because they stopped using the distro or because mail got dropped.
MS live/hotmail/outlook would silently drop - although not for this DMARC, that gets a straight bounce.
> How often would you be able to detect acceptance-but-non-delivery of your emails to office.com-hosted emails?
You should be able to see this on your DMARC dashboard
Why?
At the most you need to use an external service for delivery (usually because you have problems with MS) but you can still run your own server with no difficulties once you do that.
That said, DMARC is required by a lot of people now, so I do not think this particular issue is a problem.
I have been self hosting my my personal email (and for family). Few problems so far other than delivery to MS and I have recently moved a domain I use for work email over.
Oddly enough the MS problems come from hotmail, but not other services. If that is a problem, then pay a bit to have email delivered.
It's not enough. I have a domain that I had a very long time but it is on an undesirable tld. I got it long before it was problematic. Outlook always puts my mail in the SPAM folder even though I have done everything I could. I even deliver through a trusted provider. Not on any spam list. DMARC, DKIM, SPF all set up. No dice.
I've never had a problem not having dmarc. DMARC doesn't really mean anything. The security comes from DKIM (or SPF, but that's garbage)
This is what google and microsoft want the make you think for obvious reasons.
Fortunate for those running their own servers is that they actually still get all the cool emails from people not complying.
Sounds like something every mail sender should have done already.
Good for Microsoft customers and I don't care one bit for the lazy people who have to late-patch now.
I kind of have to agree. DMARC is not new. It's useful and helps make email safer. It's not even hard to set up. There's just no reason for any legitimate mail provider not to use it. Same for people who are technical enough to run their own mail servers.
"Lazy people"? I only heard about this because a customer complained. Am I supposed to go around the Internet, checking what each mail server will allow or deny?
No. You're supposed to understand how mail works on the Internet, and configure it correctly so that everyone else accepts it.
Go to https://mail-tester.com. Send a test email. If you don't get 10/10, fix your shit.
This seems overly dismissive especially for individuals who send emails from custom domains at low volumes. DMARC has previously been seen to only be really needed for high-volume senders. The mail testing service linked still gives 10/10 for emails received without DMARC (but with SPF and DKIK). My email is setup via Fastmail and I followed all the recommendations they provided (which didn’t include DMARC)
I just tried this out now with an email from my personal domain that I have configured to send via my gmail account. I got a 10/10, but DMARC does not seem to be required for this. It shows a yellow checkbox for me on this, the same as it shows for me not having an unsubscribe button, which hardly gives the impression of it being necessary, given that I would not expect an unsubscribe button to make sense for most people manually sending emails to their customers from corporate email accounts.
This service is not accurate, it cannot handle multiple dkim keys.
Not enough. O365 still discard/lose e-mails.
To be fair, DMARC has been required for a very long time. IIRC Google warned about 2 years ago circa that non-compliant emails would land in spam or be null-routed. And the DMARC noise started even before that.
Gmail only requires DMARC for senders that send >5000 emails per day. Below that it's not required. That rule only appeared in 2024 so I wouldn't say it's been required for a very long time. Perhaps you're thinking of DKIM, which is different.
You don't have to, this is the key reason to have a DMARC monitoring service. It will tell you when there's a deliverability issue with some particular receiver.
DMARC applies not on your mail server, inbound or outbound, but on the server that is receiving your mail (which may in fact be your mail server).
That server will look at how the mail authenticates and decide if it should allow the mail to proceed, it (for the most part) will then tell you whether or not it allowed the mail. This is how you will know you might have a deliverability problem before your customers do.
If you're wanting to know about deliverability (particularly for this Microsoft case), my company (Alesian Security) has a free check at https://alesiansecurity.com/try?tab=deliverability
> You don't have to, this is the key reason to have a DMARC monitoring service. It will tell you when there's a deliverability issue with some particular receiver.
It's been a while, but monitoring DMARC seemed pointless once you got things started. If my outbound mail fails to validate, I've asked the receivers to bounce it, and I should be able to see that on my own system.
Otherwise, I'm just getting reports about spoofed spam or people who need to adjust their mail forwarding, but I can't do anything about either.
right, if you're at a reject status DMARC monitoring is (and should be) boring.
But it provides a safe guard against accidentally broken mail flows as your email stack evolves over time which is where it pays dividends.
I would love to say that it would have alerted you ahead of time to this particular event, but given that it's the fix here you would never have seen it.
As a company we realised about 12 months ago that email can no longer be considered a reliable method of communication. I understand the reasoning but the result is the result. Many new clients we deal with have whitelists on and we have to pester our clients to add us to their lists. Not a great experience for anyone. I think we should consider email pretty much moribund at this point.
It can be reliable, but requires an explicit agreement between the two parties. When my server connects to your server and sends a message, that part is reliable enough. If your server decides to delete the message after receiving it, that's entirely on you. You could configure it to never delete messages from me and then it's fine. The problem is that in reality nobody does this, so your vendors and customers get treated identically to random spammers.
It is literally one of the last free and open channels on the Internet – I suggest you work on supporting its use and keeping it that way rather than moving to something controlled for profit or data harvesting.
It being free and open is exactly what the big providers can't stand and why they are coming up with ever more "standards" that are complex to configure as well as "reputation" scores that are hard for small senders to clear.
Also why they do non-standard stuff like accepting mail but then simply not delivering it, rather than bouncing it.
DMARC is not hard.
"Reputation scores" and blacklists / greylists started in late 1990s / early 2000s as multiple grassroots efforts when spam started to overwhelm systems. Gmail did not exist, outlook.com did not exist, it was easy and expected to run your own SMTP (which I did). And it was very unpleasant.
DMARC appeared 10 if not 15 years ago. There's no reason for a sane MTA configuration not to have it.
Outlook.com is a rebranding of Hotmail.com which absolutely did exist in the 90’s.
Microsoft has provided free email addresses to the public for decades.
There is no such thing as a free and open channel on the internet that will not suffer the tragedy of the commons.
Calling it a "free and open channel" when 80% of consumers are on Microsoft/Google addresses that control who can deliver e-mail is laughable. It's dead, Jim.
Fair point - I meant free in the sense that the protocol is open. I didn’t mean that it’s not under threat.
You seem to miss the point WHY customers go there. I, for one, switched when I realized Google filters spam effectively.
That WHY seems to only address a very small slice of the market. Some other WHYs I've encountered
- it was a way to outsource the mail server administration and already free in our corporate package
Which is pretty much all I have from the corporate side. On the personal or small business side its most often
- I don't really care that much about running my own stuff
- I needed a personal email address
All these are valid reasons/motivations but none explicitly argue that email messaging should become proprietary.
Strengthen your contracts / terms of service. Make it their responsibility to configure their email systems properly so they receive emails sent from your domains.
So what have you switched to instead?
Postal mail still works.
Spoiler alert: no method of communication is reliable anymore. All of them are controlled by companies that will route your messages to spam.
If reliable means the message gets through no matter what, then it's good that no channel is reliable. Such a channel will inevitably be used for spam and attention grabbing.
If running a mail server is central to your business, you should keep up with best practices. If not, 2 days of non-delivery aren't important, just resend.
Delivery to Microsoft's products has been patchy for several years. I am not remotely an email deliverability expert but I have made different SMTP service choices based on how companies approach shared-IP sending plans.
Some can affordably deliver to Microsoft because they aggressively police what they are actually sending on their customers' behalf; others don't get involved and you end up having to spend a fortune on a dedicated IP.
The DMARC thing is just another part of this; one of my clients discovered this silent failure themselves a few weeks back and addressed this.
DMARC is a DNS record that says "send emails about spoofed messages here", or optionally "I don't need you to tell me that scammers exist on the internet".
It doesn't prevent spoofing, it doesn't say which IPs are authorized to send on behalf of a domain, it doesn't sign messages. Spoofed messages are still sendable.
Can you explain the benefit of only accepting email if Microsoft knows that you may or may not accept emails about scammers unsuccessfully spoofing your email domain? (Note, there's nothing you can do if they do tell you.)
Don't confuse DMARC with DKIM or SPF; DMARC doesn't actually do anything for email security.
That is not true. Reports are just one of the features of DMARC. The policy which allows you to instruct senders what to do with unauthenticated emails is the much more relevant part an when the receiver follows it, it very much does prevent spoofing.
And what should a provider do if the dmarc policy says that none of the dkim or dmarc records should matter? What was the point of spf saying what servers could send, or dkim specifying signing keys?
"Oh, please, don't ignore the other two ways I told you to ignore unauthorized messages" shouldn't need a knob.
You are a mail server.
You get an email without a DKIM signature from me.
Is that because I do not use DKIM and do not sign my emails or because the message is forged and not from me at all?
You cannot tell. There is a single SPF record that you can look up to see if SPF is configured. It's just a TXT record on the domain. But there is no standard DKIM record. A DKIM signed email tells you what key identifier it used and you have to use that to look up the DKIM key at <key identifier>._domainkey.<sender domain>. When the email has no DKIM signature you cannot tell if that's because the sender domain does not use DKIM or if it does have a DKIM key record but it was not used, potentially because the email is forged.
Right. And if you mandate dkim, as seems to be the case with servers that demand dmarc, what's the issue? You reject the emails where dkim isn't set.
Or do you think it's critical to support mail that doesn't have dkim?
You'll have a bad time if you just drop all emails without DKIM. There are many large senders that do not care about well established email standards and you will drop important emails.
These are the same senders that are correctly configuring DMARC?
DMARC gives you 20 reminders that you have sent an email, just incase you had forgotten.
lol, what a bunch of bs.
gmail runs with p=none
so tell me what benefits that has over having no dmarc record at all ?
Yeah, and people who don't switch to Dvorak are lazy, too!
https://ciphercue.com/blog/dmarc-enforcement-gap-rua-fragmen...
https://news.ycombinator.com/item?id=49081783
I have MCP servers for the creation of domains, DNS records with DNSSEC, and email accounts with SPF, DKIM and DMARC. I'm sure if someone wants to be a professional spammer today, DMARC is not a differentiator.
It's an interesting argument. The fact this article exists is somewhat proof that it is a differentiator. The flipside, however, is that spammers very specifically require their emails to get to add many mailboxes as possible, so their motivation is greater to make their emails service compatible.
Company sys admins have likely got all sorts of other issues to worry about, and the occasional report of an email not getting through is likely low on their to-investigate list.
Having said that, I self host a mail server, and have all those things setup correctly, and my workplace uses Outlook, and I've not had issues with delivery, so it's not a particularly difficult bar to jump.
What? How does it prove it's a differentiator for someone who wants to be a spammer, which is what the comment you replied to made a claim about? As far as I can tell, it's evidence (not proof) that Microsoft thinks that they will reduce spam by requiring it, which in turn is circumstantial evidence (definitely not proof) that spammers might have to spend some amount of effort to start using DMARC. I don't understand how you can conclude that it would be onerous for them to do so indefinitely; it seems equally plausible that they might have just not bothered to do it before now but will be able to start doing it without much cost.
Outlook.com has quietly dropped[0] emails from certain domains/IPs for years, even with SPF/DKIM/DMARC all properly set up and no history of spam. As someone who's administering their own mail server, Outlook has been the bane of my existence.
[0]: As in: They accepted the email just fine (according to the logs) but it still didn't end up in the recipient's mailbox.
They're not rejecting them quietly. They're sending 5xx permanent delivery failures.
The title may mean it in the sense of being unannounced
"Quietly" in the title is an AI slopspam pattern. It's an over-used teenager hyperbolic crutch word on par with "literally", "actually", "honestly" and similar.
Sometimes it's use is appropriate, but not in this case. Microsoft announced this change loudly, multiple times, starting more than a year ago. I seem to recall one of those announcements being discussed here on HN. Even the article links to it's own previous announcements, so "quietly" here is stupid rage bait to justify a blogspam advert.
I set up DMARC on my personal domain so long ago I can't even remember when I did it. 10 years+?
I had kinda assumed that a lot of providers would start rejecting domains without DMARC support. I'm surprised it's happening this late.
This was my second hackernews submit [0]! So, not even https in 2014 :)
When I ran that server, outlook.com was also the only one that would blackhole my email for no known reason. Support was unhelpful and also could not point to any reason. I've since given up, but for a short time it was glorious, email to family would not leave the lan and we could send attachments of arbitrary size.
[0] https://news.ycombinator.com/item?id=7708882
Email is the largest social network on earth (8.3 Billion addresses)
10 years is nothing. I'm sure there's still millions of companies globally who still aren't properly signing mail with DMARC.
You adopted it the moment it was announced? Really?
Is there a risk some people on this thread are mixing up DKIM and DMARC?
DKIM = proving that an email was sent from a specific domain using cryptography. Good for spam fighting and deliverability.
DMARC = telling receivers how to handle mail that fails authentication.
DMARC is primarily useful for large, complex organizations where email admins may not be aware of everyone inside the org who is sending mail that advertises the domain in the From header, or organizations that might be targeted by impersonation attacks (e.g. phishing). Being able to tell recipients "yes we absolutely have our act together so feel free to reject or spamfolder unauthenticated email" is great for killing phishing campaigns, and being able to request reports is great for finding that one sales org that signed up for a guerrilla marketing SaaS that's impersonating them.
But for small personal domains the value isn't that high.
I added DMARC and DKIM together, around the same time as some particular life events 10 years ago. Just now, I cross-checked the information against the commits in my Git repos.
Back then, I didn’t use Terraform or anything like that, but I had text files with logs that described the DNS setup in detail so I could fix things. By grepping through the logs, I’m able to put a definitive bound on when I added DMARC—it was no later than June 2016, over 10 years ago.
At the time I thought, “Obviously, we should all be setting this up, because recipients will start rejecting mail from insecure domains, if they don’t already.” This was also back when I self-hosted email. I eventually stopped doing that because I thought it was too time-consuming.
> DMARC = telling receivers how to handle mail that fails authentication.
No. DMARC is about if the from address has to match the address used in dkim/spf
No DMARC is about telling receivers which of SPF/DKIM are valid, what to do with it when it fails, and where to send a report to. Oh look.. like Mike said.
To be clear, I am saying this is incorrect.
DMARC is primarily about "alignment" (switching SPF from caring about the envelope sender to instead using the from header). Yes, it does also tangentially address those other points, but the primary reason it was adopted was to prevent spoofing of from headers (where in original spf that was a non-goal)
> You adopted it the moment it was announced? Really?
A specification exists since 2012, 14 years ago. 10 years ago it was already old.
This is interesting. At some point, I think it'll be desirable to give increasing positive weight to emails with the DPF/DKIM/DMARC trifecta configured, since those are least likely to be problem emails (spam or phishing), but I wonder what the best avenue is to actually make that the default. It's almost certainly not this kind of unannounced cutoff.
Email is, I think, among the most distributed popular online services, and there's a ton of stuff that's legacy, self-managed, or otherwise janky. Supporting SPF, DKIM, and DMARC does put a burden on independent operators, but is it an undue or unreasonable one in the current landscape? Or is it just the new cost of doing business?
It seems like 90% of the spam I receive (on my google account) is sent from google addresses, so it will have valid SPF/DKIM/DMARC setup.
That said checking for these things is a good idea, the only problem I see is dropping the mail on the floor, rather than rejecting it at SMTP time - at least that lets the self-hosting users who haven't got things configured know their email is being rejected, and to pick up the phone instead.
There's nothing worse than sending an email, it being accepted, and then later discarded with no clue to either sender or recipient.
Selection bias: you don’t see the spam that get rejected at HELO.
My server doesn't reject anyone, but does greylisting. That's a default setting in Postfix. It means the first time an IP address connects it gets a temporary error. If it retries later the message is accepted. That's the only anti-spam measure I have.
Maybe 1 in 5 emails I get is spam, and because I use a different address with every sender I know who sold "my" address to a spam list.
> but is it an undue or unreasonable one in the current landscape
Yes. In the first place, this should not even be a thing. Two corporations should not be in control of who can send e-mail. If they want to mark not having DMARC as spam, mark it as spam, or better yet flag it with a specific warning about the domain, but these games with refusing to deliver are just bullshit and essentially force a monopoly where other e-mail providers cannot compete because their e-mails aren't delivered.
No, not delivering is much better. You get a clean error message that tells you exactly what to do, it can be fixed in minutes. Spamfoldering email for not having DMARC would be a mistake, it might be years before low volume senders notice and figure out what's wrong (if they ever do).
> You get a clean error message that tells you exactly what to do
We are literally talking about a situation where this is not happening! And the problem is that it's not just this. Once you give them a license to police e-mail, they start policing e-mail for all kinds of arbitrary and inscrutable reasons. If this were going to be done, it should really be formalized as an industry standard by an independent consortium, not up to the whims of Microsoogle.
Are we? Microsoft is bouncing emails with instructions on what to do.
DMARC, DKIM and the rest are industry standards set through an independent consortium (it's called the MAAWG iirc)
> I wonder what the best avenue is to actually make that the default. It's almost certainly not this kind of unannounced cutoff.
En contraire, I think not delivering mail is the fastest way to adoption. People will use an old system for as long as it works. It now does not anymore.
I don't know. I think this disenfranchises a lot of independent operators, and the blow of that could at least be softened by making a highly-visible public announcement about it a few months ahead of time.
Maybe you're right that just enforcing it is the way, but I don't agree with doing that with no heads up.
Most spam I get is from Google, Microsoft and Amazon. We should pressure those to start dealing with the problem. Right now they are conveniently ignoring it.
None of them are a good 'Is this spam?' heuristic, though. All they do is ensure the sending domain isn't forged, but most spam, even phishing emails, doesn't really rely on that. Spammers are much more motivated than average to jump through the hoops necessary to set it up, as well. Any anti-spam signal needs to be much more expensive for spammers than regular senders.
I could be naive, but I don't see how this would be any more unreasonable than requiring HTTPS
Requiring HTTPS was very unreasonable. You have so many more moving parts that can go wrong, and a business relationship with a CA (even if it's Let's Encrypt). We only tolerate this because the alternative is worse.
There's no burden whatsoever. It's a one time setup that takes like 15 minutes.
That is a burden definitionally, though; and that's to say nothing of the effort required to understand the technology and its impacts on operations.
You can literally just Google a 3 step guide for any provider. What are you even arguing? That security for infra shouldn't be a thing? Should grandma be able to run a mail server? What's your point?
I'm arguing that with a system as distributed as email, there will certainly be people who won't do this upgrade; I'm highlighting the contrast between the need for this set of technologies (SPF, DKIM, DMARC) and the utility of an old-school open web where the barrier to entry is low and anyone can participate.
We have seen a massive erosion of the latter aspect of the web in the past few years, and I think it's useful to frame conversations in terms of that loss. The web used to be fun, and now it's become, more than ever, a professional enterprise. You often can't stand up a website without having to buy into Cloudflare's DDoS protection or something equivalent. I think this is absurd, and it's not the only such case, though these changes are obviously reactions to how usage of the web's evolved over the years.
I wonder if we can get the old web back in some way, shape, or form, cause I think we've lost something with the corporatization of the internet.
And for what it's worth, yeah, I think grandma should be able to run a mail server. Why not?
I thought they've been doing this for years, along with gmail/etc. I basically just added setting up the correct DNS records as part of business when sending emails externally.
You can send an email through mail-tester to see what you might be missing. https://mail-tester.com/
I actually totally agree with this. There's too much risk involved with scams disguised as legitimate services because the developers of said service couldn't be bothered to add 1 or 2 dns records.
Although there seems that there hasn't been any communication which is the bad thing here. However, nobody looks at those and sending detailed emails back seems like a good enough solution.
Maybe they should also work on what their users are sending as well.
Unfortunately, the people abusing these are very persistent and adding more checks will just increase the sophistication of such attacks which works against the interests of the target.
This stops disguising yourself as a legitimate service.
Charge for the service. How much spam do you get from Fastmail?
If they did that you’d decry censorship.
Allowing basically ~whatever, but proving the sender address is an obviously good approach to me.
I don't know what "v=DMARC1; p=none;" is proving to anyone when DKIM and SPF are already aligned but sure whatever. Just wish they'd given some warning!
email is weird, without this it doesn't perform the checks at all
Agreed. There's no additional verity provided by adding a DNS record with a static line of text. Reminds me of airport security theater: meaningless hoops for citizens to jump thru under the guise of stopping bad actors.
The only mistake people make here is to accept that the problem is on their end even after Microsoft has accepted the e-mail but silently discarded it. This leads to the customer impression that the mistake happens on their end and not on Microsoft's.
When I see in my logs that the e-mail has been successfully delivered to their MTA then I don't have a problem.
Yep. Let's say for example you were sending a legally important email saying you did something, and your customer tried to sue you over not sending the email. If you sent it and the customer's agent (Microsoft) dropped it, that's a problem between the customer and their agent, and you are not liable.
(If this happens to you, don't admit that you know Microsoft drops your emails, or you'll be liable again!)
I have the opposite problem. I have a 3-letter email address, so for ease of giving out the email address, I use it, while having it forwarded to my Gmail. Somewhere around 2019, emails from legitimate services, especially password reset/OTP codes, stopped landing in my inbox or even junk because my address is so high up the chain of spammers. Nebula was the first to confirm this for me and work out of band to re-enable access to my account - their emails to me were bouncing. But ever since that happened, I’ve slowly moved back to giving my Gmail.
Sounds like Gmail is the one blocking it. Stop forwarding it to Gmail and set up email directly on the address.
There's something called ARC https://en.wikipedia.org/wiki/Authenticated_Received_Chain which is supposed to handle forwarded emails, but no idea how it works in practice.
Sounds like kind of a hack:
"ARC was devised to solve this problem by giving intermediate servers a way to sign the original message's validation results. Even if the SPF and DKIM validation fail, the receiving service can choose to validate the ARC chain. If it indicates that the original message passed the SPF and DKIM checks, and the only modifications were made by intermediaries trusted by the receiving service, the receiving service may choose to accept the email."
huh
maybe someone was too lazy to set up "inbound block list" and just did a total blackout instead?
It sounds like Gmail is seeing 3000 emails a day coming from foo@bar.com, some of which are different kinds of spam, and reasonably concludes they are a spammer.
I self-host my email system and rarely send any outbound email. Occasionally I receive emails from individual users. Users on Microsoft’s email service can send emails to me, but my replies are rejected outright. This doesn’t happen with Gmail or other email providers.
On an unrelated but frustrating "silent behaviour" note, I hate how Outlook rewrites URLs to add their "safe links" domain indirection. Just show me the damn raw URL!
As they should. You should have done this 5 years ago. Takes like 10 minutes. Gmail has been rejecting them for years at this point.
"Google has been rejecting them for years..."
Not true, at least in my experiences.
I have a bunch of email accounts which have SPF and DKIM, but are missing the DMARC line - I've had no deliverability problems at all, until this weekend, and now only with Outlook. Emails to Gmail accounts go through just fine.
The combination of: √ Valid SPF √ Valid DKIM signature X Missing DMARC policy
Is clearly ambiguous. Since a DMARC of "p=none" (in the context of valid SPF and DKIM) really adds no information, so interpreting "missing DMARC" as "p=none" seems reasonable. Sounds like Microsoft was taking that approach until this weekend.
I wonder if there's an actual written standard?
Under RFC 7489 [1], a domain with no DMARC record simply has no DMARC policy, the receiver is able to enforce whatever policy it likes.
Most receivers have chosen to treat this as p=none for the last decade (Microsoft included). This is changing to now so that mail with no record is simply refused. Nothing in the standard prohibits this.
a DMARC of p=none might be seen as ambiguous - SPF and DKIM have their own jobs and they work. However, the point of DMARC is not a new way of enforcing mail authentication. Instead it is a way of making certain that the mail is internally consistent and furthermore provides two additional things.
1. it indicates if the domain owner has thoroughly gotten their mail to authenticate (in which case they adopt a p=reject), and
2. it provides a feedback mechanism that allows the domain owner to know if they are seeing authentication and deliverability problems in such a way that they can fix those broken mail flows.
[1] https://www.rfc-editor.org/info/rfc7489/
Googling around this started at least a year ago, but I worked at an MSP 3 years ago when it was first announced and we started getting customers into compliance. This wasn't something out of the blue.
This is a good thing for the actual email users. The volume of really obvious “spam” emails were through the roof that it became quite tedious to rescue legit emails. It’s not like setting up DMARC is hard either.
If it's not hard, what stops spammers from doing it?
Mail admins had 20+ years to fix config. Not saying that outlook is properly config, but it’s well overdue using solutions designed to reduce spam.
Does DMARC reduce spam?
Tangentially-related: Gmail has started sending completely legitimate emails to spam. DMARC/SPF/DKIM (2048 bits) all properly configured of course so there has to be something else that isn't documented.
They have been doing that for years. A long time ago there was a submission here on HN about some Ivy League college urging college applicants to provide something other than a Gmail address because application-related emails (including acceptances!) would frequently not get through.
Started? My Gmail spam filter has been broken for several years now. Extremely obvious spam regularly ends up in the primary inbox and critical, fully legitimate messages get buried in spam. It’s a major reason why I left for another provider.
Gmail send their own service notifications to spam.
> Quietly Rejecting Email
> The sender gets a bounce
?
"quietly" is a sign that an LLM wrote it
My first thought as well: how does one quietly reject email? Skimmed the comments and clearly it's not quietly. Saved a click...
It's quiet only if the server accepts it and then deletes it on their end without notifying the sender, but if your mail provider shreds your mail that's then also your provider's responsibility and not the sender's
Replying to all inbound messages with a bounce is an old idea. The theory was that legitimate senders would validate their address and get added to a white list. The scheme didn't work for the same reason captchas don't work.
This has been going on for much longer than stated here - we had domain mismatch issues with outlook going back years and our policy was p=none. They’re very sensitive and mailing lists with forwarding are heavily impacted.
Rejecting emails from some domains. Why would emails “to” these domains also bounce back?
Mail security non-expert here, is this going to affect people who use alternative addresses for their Gmail account?
It affected my google workspace account
Do you know if it’ll affect my (personal) account? I run everything through a normal Gmail account and have forwarding for incoming email and an alias for outgoing stuff
It shouldn't affect you. DMARC policies apply to the authenticated domain, which is Gmail.
Email was invented in 1965. It needs to be replaced with something that doesn't try to bolt security on as a lazy afterthought 30-40 years later.
We have everything we need to define email 2.0 with mandatory security, the problem is all the older installations that support 1.0 that everyone still expects to talk to.
New protocols only solved this by cutting compatibility. Signal can be E2EE because you can't send a message to an email address with it. Email can also be E2EE, but how do you know the recipient supports it?
What about Matrix?
Sorry to break it to you, but email isn't going anywhere anytime soon.
Didn't gmail already roll the same thing out in 2024?
DMARC has been around for a while now. I know it’s fashionable to bash on Micro$oft and they rightfully deserve it.
Just not for this.
What if I include the header string, "DMARC and Jalad at Tanagra."
DKIM, its signature verified.
Stop bitching guys, you have never dealt with t-online.de (T-Mobile)
https://telekomhilft-telekom-de.translate.goog/conversations...
Deutsche Telekom is a regional monopoly that abuses its position in every possible way. It's like Comcast but even worse. Best thing you can do is forget they exist and if someone really wants to contact you they'll find another way.
You can hate on outlook.com for a couple of reasons.
But this is not one of them.
I had an email kicked back to me from Hotmail this past week complaining about missing DMARC. I fixed that and subsequent messages went through fine.
I’ve been anticipating something like this for a while; the number of folks who don’t have their email-related DNS settings in order is remarkably high.
> Nobody announced it
They did: https://techcommunity.microsoft.com/blog/microsoftdefenderfo...
And it appears to be further documented here:
https://learn.microsoft.com/en-us/defender-office-365/anti-p...
https://learn.microsoft.com/en-us/defender-office-365/email-...
And other sites were reporting about it for at least a year and a half:
https://powerdmarc.com/dmarc-outlook-email-authentication/ (see #4)
https://www.mailreach.co/blog/outlook-dmarc-requirements
> For domains sending over 5,000 emails per day
That's an old announcement about a different change. As far as I can tell this one is completely out of the blue. I'm shocked by the number of people in this thread advocating for spontaneous changes without any warning.
That says for "high volume senders" but they now apply the rules regardless of volume.
Yes, this is an older announcement from last year. Yahoo and Google did the same at that time.
The failure associated with that announcement is different. It is 5.7.515.
This new failure mode is "5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records (AS9031519)", I haven't seen any formal announcement on my end. The important thing to know about 5.7.1 is that it represents a few different failure modes, the AS9031519 is the important bit and it indicates that the domain lacks a DMARC record.
Is there any actual evidence of this outside of this one company's AI-generated article?
There's been ample evidence of this, many different blogs, notification emails etc.
This thread duplicates the first observations of this which showed up here yesterday at https://news.ycombinator.com/item?id=50404161
My mail provider, MXroute, sent me a notification of the issue early yesterday. There is commentary from various DMARC providers (Suped and PowerDMARC). This is a real thing.
It does not matter which host you are using, this has nothing to do with the hosting provider. It has everything to do with having your domain correctly set up on DNS so that anybody receiving mail will know how to authenticate it. Microsoft has apparently advanced a policy that if you don't even try you don't get to send.
IMO this is the right call, I've seen plenty of spoofing attacks where the attacker took advantage of nonexistent policy on non-sending domains. You might think that if you don't have an MX record the domain can't be used to send mail, that is wrong. The MX record only tells others where to send your mail, it says nothing about whether the domain can send mail itself.
Ample evidence that the policy now extends to low-volume senders? Could you provide even one example?
I got a bounce on a mail from my personal Fastmail account (with my own domain) the day before yesterday.
I had SPF/DKIM set up, just not DMARC. Did that yesterday and don‘t see the point. My policy is "none".
The point is to have a DMARC record, setting it to none doesn't really do much of anything for you though. If you really wanted to take advantage of it you will need a DMARC monitoring solution - the market seems to typically price these around $10/month for small-ish domains (though there are a lot of caveats). I'm trying to build a reasonable free option that maybe isn't enough to get a domain to a reject policy, but should be enough for you to maintain a reject policy.
The truth is that there are amply "non-sending" domains out there which ignore DMARC and allow abuse. Stopping the assumption of no policy mean p=none prevents this abuse from persisting.
How does having a record with no policy make the internet safer?
If BIMI was in any way scalable it would actually provide a way for an external signer to say “yeah we trust these guys, you should deliver this”.
I haven’t really seen BIMI for less than practically $1000/year and most clients still don’t check it.
I was hit by this twenty minutes ago. I don't disagree with the policy, but I wish my provider had warned me so I could add the headers. I already had DKIM and SPF, but not DMARC.
Yahoo is too.
Yahoo has randomly rejected emails for decades. In my experience it's probably the worst among the mainstream providers.
Yeah thanks Microsoft. Really appreciate having to mitigate this for hundreds of customers on a weekend. Nice one!
You should have done this for your customers years ago, yikes.
I suspect that he/she means they runs a mail server and it was up to his customers to comply, but now they’ve had to deal with the fallout from their customers not complying.
Cool, charge them for it. That's what IT support is.
The customers have to do it themselves since they control their domains. I recommend doing everything correctly but also understand that this stuff is pretty hard for people just trying to run a small business. But if it makes you happy to feel smug you can carry on assuming.
My assumption is that they were in control of the domains. If not, it isn't their problem and if anything it's billable hours, aka their job.
Email is dead. Unfortunately any replacement for it would be owned by Meta or MS or whatever.
The assumption of a single shared medium is dead.
When you talk about a single entity to single entity connection it can be any protocol. Email, Matrix, WhatsApp, SMS... Discord... Instagram. All of them work especially if you whitelist the other party.
What doesn't work any more is assuming that everyone is using the same thing. Back when email was invented it was the only computer-based communication protocol - I don't remember whether it came before or after USENET - I'm assuming before. If you wanted to send a message to someone you sent it to their email address. Now things aren't so clear.
Its not "one header" to fix. SPF and DKIM must be implemented.
If you have no spf or dkim your emails have been getting rejected for a very long time.
(dmarc only requires one of spf or dkim, not both, but it is a good idea to use both)
I noticed this when it happened, but I do have a valid DMARC entry (albeit p=quarantine).
https://mastodon.social/@davisr/117570496362439342
It's possibly yet another issue relating to the long streak of problems seen the recent months by primarily self-hosters trying to reach people and businesses behind Outlook servers. The past few weeks a lot of my e-mails to friends and family using Hotmail have gone missing. All envelopes were OKd by Outlook servers, nothing bounced, e-mails just gone. My setup is clean, my network is clean.
I'm fine with providers imposing some default level of spam protection but as a user I'd like the option to disable it, even better if I can disable it per domain or sender. The old technique of adding the sender to your contacts doesn't work reliably anymore.
"The old technique of adding the sender to your contacts doesn't work reliably anymore."
An Outlook user first reaching out to you, and you replying and including the unique message-ID of their original envelope in your headers, doesn't affect anything either. Absurd. The whole situation is complete dog shit.
"First time?"
It's not months it's years.
Anecdotal. I've self-hosted for many years but didn't run into these issues with O365 until this year. But not surprised to hear it.
They used to just drop all messages from domains not on their whitelist and to get whitelisted you needed to have a Microsoft account and open a support ticket.
> The fix is one DNS record.
Oh god the slop.
Only an LLM would describe DMARC as just "one DNS record".
I literally had to copy paste one dns record to enable it.
lol DMARC is one record.
It doesn't have to be just one record, but it doesn't have to be more than one record either.
Do they literally just need the DMARC record to exist though, or do they need it to actually say something? Do you need DKIM? I found that SPF is very easy but DKIM is a royal pain.
DMARC is layered across (/is useless without) two other protocols (SPF, DKIM), both of which also require DNS records.. there's no way to DMARC with one record.. unless you're excluding those SPF and DKIM records in your count. You /could/ DMARC with two records: DMARC+SPF, or DMARK+DKIM but it's ill-advised - use all three. (Ignoring host hierarchy/cname delegation, you can have far more records)
Were you previously sending email without either DKIM or SPF?
Because i doubt that has worked at all in the last decade.
Are you replying to the wrong comment? No on all counts.
Then setting up DMARC is only one record because you already had the other records.
I suppose I'm splitting hairs.
Yes, a proper email authentication stack has DMARC + SPF + DKIM. But each of these is a separate protocol.
This also doesn't take into consideration the other protocols that have arisen BIMI, APRF, MTA-STS / TLS-RPT and are at even lower levels of adoption.
MTA-STS is useful (but it's about helping receivers by demanding mail is sent encrypted, not senders with delivery).
BIMI is a pay-to-spam protocol that helps senders, you can add a rule to postfix to mark it as such.
APRF is a draft, and likewise helps senders, not receivers.. not sure why anyone would want to adopt this standard. A little closer to DMARC reports, but sharing PI that you owe no sending server.
"Since November 5, 2026, Microsoft's consumer mail service has been turning away some of the email from domains that don't publish a DMARC record. If your company emails customers, vendors or applicants with outlook.com, hotmail.com, live.com or msn.com addresses, some of that mail may be bouncing right now. Nobody announced it. The fix is one DNS record."
I'm personally seeing this with some email systems I manage - email sent from a domain that has proper SPF and DKIM signatures, but had no DMARC record started bouncing this weekend.