Outlook.com Is Quietly Rejecting Email from Domains Without DMARC
549 points
• 4 days ago
• Article
Link
从 2026 年 11 月 5 日开始，Microsoft 的消费者电子邮件服务（包括 Outlook.com 、 Hotmail 、 Live 和 MSN）开始静默拒收来自未发布 DMARC 记录的域名的邮件。与以往主要针对高流量批量发送者的要求不同，这项变化会影响普通的小批量发送者，包括小型企业和个人。由于拒收情况并不完全一致，发送者可能会误以为自己的邮件已送达接收者，但实际上，许多邮件会因 550 5.7.1 错误代码被退回。
这次更新的关键问题在于它采取了悄无声息的方式上线。 Microsoft 没有就这一政策变更发布任何官方公告、服务健康通知或相关指导。由于拒收只影响部分已发送的邮件，用户很容易把退信当作临时故障，而不是系统性的身份验证要求。这会对依赖联系个人邮箱的企业造成严重影响：发票、预约确认和客户回复等关键沟通可能会在发送者毫不知情的情况下无法到达。
判断某个域名是否受影响很简单。通过终端命令进行快速 DNS 检查即可确认是否存在 DMARC 记录。如果查询没有返回任何内容，说明该域名容易遭到上述拒收。解决办法相对直接，只需要在域名的 DNS 设置中添加一条 TXT 记录即可。将 DMARC 策略设置为 p=none 是一个相对安全的起点。该记录会告知接收服务器该域名使用 DMARC，但不会触发邮件处理方式的任何实际改变，从而便于平稳过渡到更完善的安全防护。
不过，单靠 DMARC 记录并非"万灵药"。只有当邮件同时符合 SPF 或 DKIM 协议的对齐要求时，DMARC 才会生效。如果域名的发件配置未能通过这些方式完成身份验证，那么 DMARC 记录本身无法阻止投递问题。对于使用专业邮件服务的组织而言，确保 SPF 配置正确，以及 DKIM 签名与 From 地址中的域名保持一致，对于满足新标准至关重要。
从更深层看，Microsoft 的这一步体现了主要邮箱服务提供商的一个普遍趋势：把 DMARC 作为强制性底线，而不是可选的最佳实践。通过要求域名进行身份验证，这些服务提供商旨在打击钓鱼攻击和商业邮件被入侵的风险。尽管当前的落地要求只是简单且不具备限制性的 DMARC 记录，但这一步也为未来更严格的执行政策打下基础，最终让整体邮件生态更安全、也更难被冒充。
Starting November 5, 2026, Microsoft's consumer email services, including Outlook.com, Hotmail, Live, and MSN, began silently rejecting emails from domains that lack a published DMARC record. Unlike previous mandates that targeted high-volume bulk senders, this change affects ordinary, low-volume senders, including small businesses and individuals. Because the rejections are inconsistent, senders may mistakenly believe their email is reaching recipients when, in reality, many messages are bouncing back with a 550 5.7.1 error code.
The problematic aspect of this update is its quiet rollout. Microsoft has provided no official announcement, service-health notice, or guidance regarding this policy change. Because the rejection only hits a portion of sent mail, it is easy for users to interpret a bounce as a temporary glitch rather than a systemic authentication requirement. This can have serious consequences for businesses that rely on reaching personal addresses, as critical communications like invoices, appointment confirmations, and client replies may fail to arrive without the sender ever knowing.
Determining if a domain is affected is straightforward. A quick DNS check using a terminal command can confirm if a DMARC record is present. If the check returns no output, the domain is vulnerable to these rejections. The solution is relatively simple, requiring only the addition of a single TXT record to the domain's DNS settings. Implementing a DMARC policy of p=none acts as a safe starting point. This record notifies receiving servers that the domain uses DMARC without triggering any actual changes in how mail is handled, allowing for a smooth transition toward better security.
However, a DMARC record alone is not a silver bullet. DMARC only passes if the email also aligns with either SPF or DKIM protocols. If a domain's sender setup does not correctly authenticate through these methods, the DMARC record will not prevent delivery issues. For organizations using specialized mail services, ensuring that SPF is properly configured and that DKIM signatures match the domain in the From address is essential for compliance with the new standard.
Ultimately, this move by Microsoft reflects a broader trend among major mailbox providers to establish DMARC as a mandatory baseline rather than an optional best practice. By forcing domains to authenticate, these providers aim to combat phishing and business email compromise. While the immediate requirement is a simple, non-restrictive DMARC record, this step serves as the foundation for stronger enforcement policies in the future, ultimately making the broader email ecosystem more secure and harder to impersonate.
372 comments • Comments Link
- 微软已开始拒收缺少 DMARC 记录域名的入站邮件，导致许多此前只依赖 SPF 和 DKIM 的发件人遭遇投递问题。
- 虽然有人认为该政策推出时并未提前披露，但也有人指出，谷歌和雅虎等大型服务提供商多年来一直释放出将身份验证要求收紧的信号，因此这次变化在邮件安全领域属于预期内的演进。
- 大部分不满来自"静默丢弃"（silent drops）：邮件被接收服务器接受却从未送达，而且不向发件人提供任何反馈。
- 对独立运营商来说，维护配置得当的邮件服务器越来越困难，于是有人认为自托管（self-hosting）已难以作为与主流平台用户建立可靠通信的方案。
- 关于 DMARC 的看法存在分歧：一部分人认为它易于部署且是必要的反垃圾邮件手段；另一部分人则批评它不过是"安全剧场"（security theater），对低流量的合法发件人施加了不必要的负担。
- 也有人认为，依赖少数几家大型公司进行邮件托管，使得对这一曾经开放的协议的控制权不断集中，实际上形成一种垄断——只有符合要求的域名才能覆盖大部分用户。
- 为缓解这一问题，有建议是使用第三方事务性邮件服务来承担投递工作，因为这些提供商通常拥有良好声誉和完善基础设施，能更好应对微软等巨头的严格过滤政策。
- 当前反垃圾邮件标准的有效性也引发争议：许多人指出，大量垃圾邮件仍来自主要服务提供商，这说明现有的身份验证检查并未充分触及垃圾邮件的根本来源。
- 另一种常见看法认为，专业的邮件管理需要跟上不断演进的行业标准；未能实施 DMARC 等基础 DNS 记录反映的是管理不善，而不是协议本身的失败。
- 讨论中强调，即便 SPF 、 DKIM 、 DMARC 等安全记录都已部署，投递结果仍可能高度不确定；声誉评分和不透明的黑名单依旧是小型或自托管邮件域名面临的重大障碍。
向强制执行 DMARC 的过渡，反映出大型提供商为打击垃圾邮件和钓鱼攻击而收紧对邮件生态系统控制的更大趋势。尽管这项变化被解释为为让旧协议实现现代化所必需，但它也突显了独立邮件运营商的不稳定处境——他们难以应对主导平台不透明且经常前后不一致的过滤政策。归根结底，这场讨论暴露出两种观点之间的鸿沟越来越深：一种认为这些要求是基本的专业素养，另一种则认为这在以围墙花园（walled-garden）模式为代价，慢慢侵蚀去中心化、自由的通信渠道。 • Microsoft has begun rejecting inbound email from domains that lack a DMARC record, causing deliverability issues for many senders who previously relied solely on SPF and DKIM.
• While some argue this policy was unannounced, others note that major providers like Google and Yahoo have signaled a move toward stricter authentication requirements for years, making the shift an expected evolution in email security.
• A significant portion of the frustration stems from the practice of silent drops, where emails are accepted by the receiving server but never delivered, providing no feedback to the sender.
• Maintaining a properly configured mail server has become increasingly difficult for independent operators, leading some to conclude that self-hosting is no longer viable for reliable communication with users on major platforms.
• Opinions on DMARC are split, with some viewing it as a necessary anti-spam measure that is easy to implement, while others criticize it as security theater that imposes unnecessary burdens on low-volume, legitimate senders.
• Some argue that the reliance on a handful of mega-corporations for email hosting centralizes control over a formerly open protocol, effectively creating a monopoly where only compliant domains can reach the majority of the population.
• Suggestions to mitigate the issue include using third-party transactional email services to handle delivery, as these providers often have the reputation and infrastructure to navigate the strict filtering policies of giants like Microsoft.
• The effectiveness of current anti-spam standards is debated, with many noting that a large volume of spam originates from major providers, suggesting that existing authentication checks do not adequately address the root cause of unsolicited mail.
• A common counter-perspective is that professional email management requires adherence to evolving industry standards, and failing to implement basic DNS records like DMARC reflects poor administrative practice rather than a failure of the protocol.
• Discussions highlighted that even with all security records (SPF, DKIM, DMARC) in place, deliverability can still be unpredictable, with reputation scores and opaque blacklists remaining significant hurdles for smaller or self-hosted mail domains.
The transition toward mandatory DMARC enforcement reflects a broader trend of large providers tightening control over the email ecosystem to combat spam and phishing. While this change is defended as a necessary step to modernize a legacy protocol, it has highlighted the precarious position of independent mail operators who struggle to navigate the opaque and often inconsistent filtering policies of dominant platforms. Ultimately, the discussion underscores a deepening divide between those who view these requirements as essential professional hygiene and those who see them as the slow erosion of a decentralized, free communication channel in favor of a walled-garden approach.