I thought they've been doing this for years, along with gmail/etc. I basically just added setting up the correct DNS records as part of business when sending emails externally.
This is interesting. At some point, I think it'll be desirable to give increasing positive weight to emails with the DPF/DKIM/DMARC trifecta configured, since those are least likely to be problem emails (spam or phishing), but I wonder what the best avenue is to actually make that the default. It's almost certainly not this kind of unannounced cutoff.
Email is, I think, among the most distributed popular online services, and there's a ton of stuff that's legacy, self-managed, or otherwise janky. Supporting SPF, DKIM, and DMARC does put a burden on independent operators, but is it an undue or unreasonable one in the current landscape? Or is it just the new cost of doing business?
It seems like 90% of the spam I receive (on my google account) is sent from google addresses, so it will have valid SPF/DKIM/DMARC setup.
That said checking for these things is a good idea, the only problem I see is dropping the mail on the floor, rather than rejecting it at SMTP time - at least that lets the self-hosting users who haven't got things configured know their email is being rejected, and to pick up the phone instead.
There's nothing worse than sending an email, it being accepted, and then later discarded with no clue to either sender or recipient.
> but is it an undue or unreasonable one in the current landscape
Yes. In the first place, this should not even be a thing. Two corporations should not be in control of who can send e-mail. If they want to mark not having DMARC as spam, mark it as spam, or better yet flag it with a specific warning about the domain, but these games with refusing to deliver are just bullshit and essentially force a monopoly where other e-mail providers cannot compete because their e-mails aren't delivered.
> I wonder what the best avenue is to actually make that the default. It's almost certainly not this kind of unannounced cutoff.
En contraire, I think not delivering mail is the fastest way to adoption. People will use an old system for as long as it works. It now does not anymore.
I actually totally agree with this. There's too much risk involved with scams disguised as legitimate services because the developers of said service couldn't be bothered to add 1 or 2 dns records.
Although there seems that there hasn't been any communication which is the bad thing here. However, nobody looks at those and sending detailed emails back seems like a good enough solution.
Unfortunately, the people abusing these are very persistent and adding more checks will just increase the sophistication of such attacks which works against the interests of the target.
This stops disgusting yourself as a legitimate service.
I don't know what "v=DMARC1; p=none;" is proving to anyone when DKIM and SPF are already aligned but sure whatever. Just wish they'd given some warning!
I’ve been anticipating something like this for a while; the number of folks who don’t have their email-related DNS settings in order is remarkably high.
It's possibly yet another issue relating to the long streak of problems seen the recent months by primarily self-hosters trying to reach people and businesses behind Outlook servers. The past few weeks a lot of my e-mail to friends and family using Hotmail have gone missing. Submits were OKd by Outlook servers, nothing bounced, e-mails just gone. My setup is clean, my network is clean.
"Since November 5, 2026, Microsoft's consumer mail service has been turning away some of the email from domains that don't publish a DMARC record. If your company emails customers, vendors or applicants with outlook.com, hotmail.com, live.com or msn.com addresses, some of that mail may be bouncing right now. Nobody announced it. The fix is one DNS record."
I'm personally seeing this with some email systems I manage - email sent from a domain that has proper SPF and DKIM signatures, but had no DMARC record started bouncing this weekend.
Good for Microsoft customers and I don't care one bit for the lazy people who have to late-patch now.
Email is, I think, among the most distributed popular online services, and there's a ton of stuff that's legacy, self-managed, or otherwise janky. Supporting SPF, DKIM, and DMARC does put a burden on independent operators, but is it an undue or unreasonable one in the current landscape? Or is it just the new cost of doing business?
That said checking for these things is a good idea, the only problem I see is dropping the mail on the floor, rather than rejecting it at SMTP time - at least that lets the self-hosting users who haven't got things configured know their email is being rejected, and to pick up the phone instead.
There's nothing worse than sending an email, it being accepted, and then later discarded with no clue to either sender or recipient.
Yes. In the first place, this should not even be a thing. Two corporations should not be in control of who can send e-mail. If they want to mark not having DMARC as spam, mark it as spam, or better yet flag it with a specific warning about the domain, but these games with refusing to deliver are just bullshit and essentially force a monopoly where other e-mail providers cannot compete because their e-mails aren't delivered.
En contraire, I think not delivering mail is the fastest way to adoption. People will use an old system for as long as it works. It now does not anymore.
Although there seems that there hasn't been any communication which is the bad thing here. However, nobody looks at those and sending detailed emails back seems like a good enough solution.
This stops disgusting yourself as a legitimate service.
https://mastodon.social/@davisr/117570496362439342
I'm personally seeing this with some email systems I manage - email sent from a domain that has proper SPF and DKIM signatures, but had no DMARC record started bouncing this weekend.