Microsoft is notoriously difficult to get legitimate emails delivered to. Some would say a dark art.
With that said, if you plan to send any quantity of email in 2026 from your own domain or a customer domain -- do expect to configure the trinity of DKIM, SPF, and DMARC. You're allowed to disagree on the philosophy of any one or all of them, but just know that your objections will be unheard by all the major email providers. And until you have all three, you simply can't expect emails to be delivered reliably, and this has been the case for roughly the last 10 years.
Is there any reliable data on this? As the article notes, even Microsoft, notoriously finnicky, was accepting mail without DMARC records just fine up until recently. Google definitely accepts mail without either DMARC or SPF records.
And while I agree with the philosophy of DKIM, SPF was a bad design that only makes sense in the rare cases where
Your domain sends no mail at all
You have a vast network of servers that all send mail uncontrollably, making DKIM impractical
It should not be used for new deployments.
Mail server administration is made worse by the fact that most advice and bad practices are cargo culted scare stories about the strange rituals necessary to appease the mail server gods.
And yes, undoubtedly there are mail server admins somewhere who will drop your mail if your server doesn't have a SPF record, just as there are admins who block and drop on a variety of questionable reasons, such as spam content filters, long-dead RBLs, lack of reverse DNS, etc.
If you make your "best practices" the intersection of the most strict and stupid practices of all mail server administrators in the world, you're obviously better off sending a post card.
DKIM signs the body, preventing the MIME From header from being spoofed. However, the DKIM signature does not have to be from the domain in the From header.
SPF specifies who can use your domain in FROM in the SMTP session.
DMARC requires, even if your policy is "none", that the SMTP session FROM and the MIME From header has the same domain (roughly, depending on if strict or relaxed) and that the DKIM signature is also in the same domain.
Without DMARC, people can still spoof mail from your domain, they just need to provide their own DKIM keys on a domain they control. Without SPF, they can also claim that it was sent from your mail server.
Email runs on ancient protocols, and we keep finding "new" ways they are broken, and kinda paper it over with extensions.
First of all, that requires a mechanistic interpretation of the standards that I don't think any of the large providers abide by.
But even if this were the case, this argues for DMARC, not SPF. SPF does not prevent a spammer from impersonating anyone, it's not applied during the HELO handshake. It's a historical artifact that used to have a limited application in preventing backscatter spam.
Not having an SPF record present actually removes an impersonation vector, as only DKIM records will be used as proof of alignment.
Since requiring the envelope sender and the MIME From to be identical is extremely brittle anyway, we would all be much better off without it.
I consider this bad advice for anyone hoping to get mail delivered.
Mail server administration is made worse by the fact that most advice and bad practices are cargo culted scare stories about the strange rituals necessary to appease the mail server gods.
What I'm saying is experience, not dogma.
And yes, undoubtedly there are mail server admins somewhere who will drop your mail if your server doesn't have a SPF record
Email senders: If you send email to personal Gmail accounts, you must set up email authentication to ensure your email is delivered as expected. All senders must Set up SPF or Set up DKIM. Bulk senders (more than 5,000 messages daily) must Set up SPF, Set up DKIM, and Set up DMARC. Learn more at Email sender guidelines.
Granted, they only require SPF for senders sending more than 5k messages per day. For many companies, this threshold is trivial to hit.
If you're running email for other people it's doubly important to add the trinity of records, because you don't know where your users will be sending mail, and you don't know every provider's esoteric rules for SPF, DKIM, and DMARC.
Microsoft has always been difficult to deal with with regard to email delivery. Not sure it’s still the case but some time ago (when I was still dealing with outbound SMTP) you had to submit a form to the Junk Mail Reporting Program to have any chance of not having your emails screened out (not even sent to Junk!) even if you had SPF, DKIM and DMARC all correctly configured.
What's great is that they have like three different forms for getting removed from different lists, but then they also seem to have some ban lists there are no forms for. :s
Last time I had trouble with them, I couldn't even get to the right forms. Just gave up in the end and told my users (family) to blame Microsoft because I have everything set up correctly and there's not a lot I can do if dickheads are going to dickhead.
They've been blocking my emails for over a decade, from two IPv4 and two IPv6 addresses at Scaleway. The Junk Mail Reporting Program says my IP address is clean, so I have no recourse. SPF, DKIM and DMARC all correctly configured, of course.
They don't have any issue sending me spam, though.
As the post notes, Microsoft mention this was a mistake. A pretty big one!
Microsoft are now rejecting mail without a DMARC policy, but accepting mail with a policy of none. This is a massive and pointless change in their policy for incoming mail
I don't think this would be pointless. Email providers are likely fighting a bunch of decent spam, and keen to raise the baseline for email auth.
Forcing email operators to set a DMARC policy (even "none"):
makes sure all DNS tooling/docs for mail has a section on DMARC, a prereq to further baseline improvements.
might even encourage some email operators to learn about DMARC and set it higher than "none".
It is, if anything, the most gradual step to raising the bar with DMARC.
Use a small provider, then you can't email anyone.
A setup that works most of the time requires at least two accounts (and the Reply-To header)... atlhough big-tech providers can't even get along with themselves so you really need an account on each one...
Every big mail provider is absolutely IMPOSSIBLE to get mail to. I got sick of setting up my own mail server and eventually went to a split IMAP/SMTP setup using third party providers. It works, I guess. I'm using Cloudflare Mail Routing to route to my Gmail account, and then using SMTP2GO to send mail.
Microsoft isn't the only one. DMARC even if sat to none has been a requirement of some large providers for years. Don't want to point at any cause I didn't write it down, but yes set your DMARC record to anything valid. I always guessed it was a bit of a hack to require it (can't imagine this makes such a difference for actual spam compared to dkim and SPF) but yeah that's what some providers did for a pretty long time now.
adriano | 12 hours ago
Microsoft is notoriously difficult to get legitimate emails delivered to. Some would say a dark art.
With that said, if you plan to send any quantity of email in 2026 from your own domain or a customer domain -- do expect to configure the trinity of DKIM, SPF, and DMARC. You're allowed to disagree on the philosophy of any one or all of them, but just know that your objections will be unheard by all the major email providers. And until you have all three, you simply can't expect emails to be delivered reliably, and this has been the case for roughly the last 10 years.
michiel | 9 hours ago
Is there any reliable data on this? As the article notes, even Microsoft, notoriously finnicky, was accepting mail without DMARC records just fine up until recently. Google definitely accepts mail without either DMARC or SPF records.
And while I agree with the philosophy of DKIM, SPF was a bad design that only makes sense in the rare cases where
It should not be used for new deployments.
Mail server administration is made worse by the fact that most advice and bad practices are cargo culted scare stories about the strange rituals necessary to appease the mail server gods.
And yes, undoubtedly there are mail server admins somewhere who will drop your mail if your server doesn't have a SPF record, just as there are admins who block and drop on a variety of questionable reasons, such as spam content filters, long-dead RBLs, lack of reverse DNS, etc.
If you make your "best practices" the intersection of the most strict and stupid practices of all mail server administrators in the world, you're obviously better off sending a post card.
DustyFuzzy | 7 hours ago
Essentially, all three are required, because:
Fromheader from being spoofed. However, the DKIM signature does not have to be from the domain in theFromheader.FROMin the SMTP session.FROMand the MIMEFromheader has the same domain (roughly, depending on if strict or relaxed) and that the DKIM signature is also in the same domain.Without DMARC, people can still spoof mail from your domain, they just need to provide their own DKIM keys on a domain they control. Without SPF, they can also claim that it was sent from your mail server.
Email runs on ancient protocols, and we keep finding "new" ways they are broken, and kinda paper it over with extensions.
michiel | 6 hours ago
First of all, that requires a mechanistic interpretation of the standards that I don't think any of the large providers abide by.
But even if this were the case, this argues for DMARC, not SPF. SPF does not prevent a spammer from impersonating anyone, it's not applied during the HELO handshake. It's a historical artifact that used to have a limited application in preventing backscatter spam.
Not having an SPF record present actually removes an impersonation vector, as only DKIM records will be used as proof of alignment.
Since requiring the envelope sender and the MIME From to be identical is extremely brittle anyway, we would all be much better off without it.
gcupc | an hour ago
While SPF was always useless and potentially harmful, it's still a little ritual you have to do because some people expect you to.
adriano | 12 minutes ago
I consider this bad advice for anyone hoping to get mail delivered.
What I'm saying is experience, not dogma.
Yes, they are named Google (https://knowledge.workspace.google.com/admin/security/set-up-spf), and many others.
Granted, they only require SPF for senders sending more than 5k messages per day. For many companies, this threshold is trivial to hit.
If you're running email for other people it's doubly important to add the trinity of records, because you don't know where your users will be sending mail, and you don't know every provider's esoteric rules for SPF, DKIM, and DMARC.
ceph | 17 hours ago
Microsoft has always been difficult to deal with with regard to email delivery. Not sure it’s still the case but some time ago (when I was still dealing with outbound SMTP) you had to submit a form to the Junk Mail Reporting Program to have any chance of not having your emails screened out (not even sent to Junk!) even if you had SPF, DKIM and DMARC all correctly configured.
remmyfoo | 14 hours ago
What's great is that they have like three different forms for getting removed from different lists, but then they also seem to have some ban lists there are no forms for. :s
zimpenfish | 6 hours ago
Last time I had trouble with them, I couldn't even get to the right forms. Just gave up in the end and told my users (family) to blame Microsoft because I have everything set up correctly and there's not a lot I can do if dickheads are going to dickhead.
val | 3 hours ago
They've been blocking my emails for over a decade, from two IPv4 and two IPv6 addresses at Scaleway. The Junk Mail Reporting Program says my IP address is clean, so I have no recourse. SPF, DKIM and DMARC all correctly configured, of course.
They don't have any issue sending me spam, though.
tuxes | 14 hours ago
As the post notes, Microsoft mention this was a mistake. A pretty big one!
I don't think this would be pointless. Email providers are likely fighting a bunch of decent spam, and keen to raise the baseline for email auth.
Forcing email operators to set a DMARC policy (even "none"):
It is, if anything, the most gradual step to raising the bar with DMARC.
DustyFuzzy | 7 hours ago
Even DMARC set to "none" starts enforcing that the MIME headers, SMTP From, and DKIM domain are aligned. Without DMARC spoofing is still possible.
singpolyma | an hour ago
You can require this is score by this withr without DMARC involvement
classichasclass | 10 hours ago
Which makes one wonder if it was, in fact, actually a mistake and not simply a trial balloon.
maurycy | 17 hours ago
Classic problem of:
A setup that works most of the time requires at least two accounts (and the Reply-To header)... atlhough big-tech providers can't even get along with themselves so you really need an account on each one...
WinnerWind | 2 hours ago
Every big mail provider is absolutely IMPOSSIBLE to get mail to. I got sick of setting up my own mail server and eventually went to a split IMAP/SMTP setup using third party providers. It works, I guess. I'm using Cloudflare Mail Routing to route to my Gmail account, and then using SMTP2GO to send mail.
Modern mail is such a centralized mess.
reezer | 17 hours ago
Microsoft isn't the only one. DMARC even if sat to none has been a requirement of some large providers for years. Don't want to point at any cause I didn't write it down, but yes set your DMARC record to anything valid. I always guessed it was a bit of a hack to require it (can't imagine this makes such a difference for actual spam compared to dkim and SPF) but yeah that's what some providers did for a pretty long time now.
cpurdy | 2 hours ago
I am also rejecting your mail.
-signed: every Interwebs user
adriano | 12 hours ago