We've just created a lot of DMARC records to ensure our customers' emails still get delivered despite Microsoft's latest nonsense https://www.mythic-beasts.com/blog/2026/11/09/microsoft-are-rejecting-your-mail/
2 Boosts
0 Likes
@beasts Thanks - this bit me on two domains at the weekend and I lost an hour or so to fixing it - I appreciate you doing this for other customers too.
Apologies for the random useless ask for free consulting.
I should try to sort out my DKIM again because despite following the, random, tutorials it still is not right.
However setting DMARC to 'none' sounds like an easy DNS win.
1)Do I just add DMARC=none as a TXT and give it a useful name?[1]
or
2)Do I wait until MSoft dick about and send them a moan? [2]
[1]Subservient
[2]Assuming I can find the <non-webform> contact details of whoever has the brane cell at the time..
@workingusername You need a TXT recorded called "_dmarc" with data "v=DMARC1;p=none;"
https://www.mythic-beasts.com/support/hosting/mail/spf#sec-dmarc
Like this?
In my TXT records.
Sorry for the thick but I am.
I am also prone to doing copy and paste stuff from randoms on the internet but given you are Mythic Beasts, on Mastodon and I saw your post from someone I trust I hope I am good.
Does,
v=DMARC1;p=PissOffMS;
work?
OK. That might be silly but their AI might be learning.
2 media files
@beasts https://www.theregister.com/applications/2026/11/09/outlookcom-bounces-legit-emails-as-microsofts-authentication-crackdown-goes-sideways/5308428
🤡
"Copilot, please make my email system supah sekure uwu, don't make mistakes, make the changes really REALLY good"
one of the problem with running an email server these days is that microsoft, google, and yahoo can do whatever they want and if you want to send email to any of their email users (which is a good chunk of all personal emails), you just have to dance to their tune.
while it can be done (i've been running my own email for years), it does mean that you have to pay pretty close attention and keep informed of unannounced spasms like this latest round from microsoft.
it's good that you're helping your customers out. this one took a fair number of folks by surprise.
@paul_ipv6 Including Microsoft, it seems. They've now admitted that it was unintentional, but 5 days later, and they still haven't rolled it back.
But you're absolutely right: if we reject our customers' email, that's our problem. If Gmail/Microsoft/Yahoo reject their customers' email, that's our problem.
We're always amazed that so many people use them, given how much legitimate email they reject (or accept and discard), but I guess people literally don't know what they're missing.
@beasts @paul_ipv6
This is really tiny in the grand scheme of things, but I've had a Hotmail account since the previous millennium and recently Google etc. have decided that MS's IP range sends too much spam so most of my emails have been bouncing.
I dread to think how many other folk must be affected by this.
i'm on a mailing list for mail admins, which includes postmasters from the big folks. even the big 3 admit that they don't always know why email to them is rejected or winds up in spam. too many moving parts and too many hands touching mail delivery adjacent code...
doesn't help that the whole SPF/DKIM/DMARC/ARC, etc is still unevenly applied.
@paul_ipv6 I'm sure it's not easy at that scale, but they do seem to treat senders with contempt. Sign-up to Microsoft's SNDS IP reputation tool was broken for *years* because they were hitting the whois ratelimiting. Now it's merely useless.
If you get hit with an S3150 blacklist error, there's absolutely no way to find out what caused the listing, and the de-list tool appears to be broken.
I wonder how many other sysadmins have had to waste time this week working for Microsoft for free.
We also had to set up DKIM for one customer, despite being well below the 5000 emails threshold.
Other, larger, customer domains have been so far unaffected.
Go figure.
🤷
@beasts Emails to my brother are now working again.
@beasts luckily I had fun to do all the recommended antispam measures for my personal mailserver.
So my dmarc policy is even set to reject.
It's only running since June this year but so far I'm very happy. only notice all contacts about the new address goes very slow, because I'm not confident enough and there are so many people, companies, etc. who have my old address.