Hacker News

Google is no better. It's quite absurd, they even went through the trouble of creating postmaster tools to help you manage your reputation - except that these don't work unless you have fairly high sending rates (I forget, but I think several hundred a day). So essentially they're actively hostile to personal and small business servers.

> I bet Microsoft is single-handedly responsible for 80+% of complaints about email being impossible to host.

They are the reason I dropped self-hosting my mails. They were silently dropping some of my mails depending on the day I sent them. If they were at least sent to the spam folder, it would be easier to communicate with their users. And since a lot of their users are not technical at all, it's complicated to explain them the issue.

Not just email - their identity / SSO system is just as fucked

more like 98%

It's absurd in every way. I was trying to get it to stop spamming maillist traffic. It's impossible. Global level filters enacted as admin to not spam check are ignored.

Don't forget Google! Gmail will hide your email for no reason no matter what you configure on Gmail's side of things. At least Microsoft has a "please remove me from your spam lists" form (that only worked for ipv4 IP addresses last time I tried).

Yahoo were annoying and I'm happy the collapsed solely because of that

I work at a big company that sends alot of emails. And even we have been put in the "bad bad books of o365 bad list", it's an absolute pain to get yourself out of the office 365 defender (I think it's what they call it now?) meanwhile your customers are complaining they arent receiving emails from you.

Email delivery for enterprise accounts has always been more lenient, the assumption being that enterprises do have their own mail filtering software.

There is a trick. Sign up with them, configure custom domain, but don’t set your MX records. On your MTA, route mail that goes to Outlook/Hotmail to go through their MSA with your Outlook credentials and headers stripped as if submitted directly by user. Outlook gets mail through their own MSA it trusts, rest of the world talks to your mail system directly. Replies still go to your MXes.

I haven’t productionized this setup (I send maybe a dozen emails a year) but it worked for me ad hoc a couple years back, when I had to send a mail to an Outlook-hosted address and they blackholed everything I tried to send while 250 OKing me.

I have a small client with a large email list who wants to switch from once a month constant contact newsletters to sending them through SES with a self-hosted Sendy instance. This seemed like a reasonable way to save $10k a year or so. I haven't used SES before for anything. I have run an email server for 30 years and had occasional blacklist headaches, but it's not used for mass mailing of that sort... it's usually several years between problems. Is this a terrible idea to switch, even if it's off a "managed" SES dedicated IP? I don't want to switch them and find out no one on Outlook is getting their mail.

What's the nature of your operation? If they're not giving you money then you're within your rights to say "sorry, don't use outlook"

Funny, they have no problem handling mail for essentially every Fortune 500 company and others large and small.

It's always people self-hosting mail on a shared server in Moldova (because they think it makes them cool) that are complaining.

Got a similar issues with outlook. Emails from some websites were delayed by several hours.

Mildly infuriating for emails containing OTP codes "valid for 10 minutes".

Requiring DMARC may be good, but Outlook's approach is awful.

I was working for Microsoft when outlook.com launched and got a good email address that was my primary for more than a decade.

I had so many issues with things getting silently dropped with no recourse (2FA codes, account recovery mails, etc.) on so many sites that I finally gave up, reversed the stream, and had Outlook forward to GMail instead of vice versa. A few months after that, I realized that all my Outlook got was an enormous volume (hundreds of day) a spam and that all legitimate mail was going to my other accounts, so I turned it off entirely and haven't read that mailbox in over a year.

no matter how much you pay for VPS or which cloud you use you'd get same treatment

Stop being so ignorant

Some hosting providers are known for not caring about the activities of their customers, but in general, how would I know that the other tenants are scum?

I have access to a fairly large dataset of known bad hosting providers, but most people don't. So how do you tell the difference between getting a good deal and "this is cheap because it's sketchy as all hell".

We also don't block all of Vietnam, or all Jio customers in India, even if we know that 20% of bot traffic is from those two alone.

> This is not Microsoft's fault.

Wait until this guy realizes that all spam these days comes from Azure ASNs, and abuses cross-tenant issues as well as a simple "Fwd: ..." and "Re: ..." tricks to bypass Microsoft Outlook spam filters.

Complain all you want about the monopolists, and I do think you're right to do so, but a lot of their power comes from and is aimed at defeating the overwhelming flood of spam.

Mail, then emails, then home phones, then cell phones, then texts, then social media have been gradually rendered less and less usable by bad actors systematically abusing every single tool we try to use to communicate with one another to steal from us, lie to us, and manipulate our beliefs, and we'll just keep inventing and discarding new ways of communicating until we reckon with this.

I don't think anyone believes it will "singlehandedly free us from tyranny", it's one component for a healthy ecosystem.

Decentralization is not a bulletproof solution. It is a mitigation. Until someone gets 50 percent of market share. Then they can run havoc on the ecosystem with their own customized system.

We could tax billionaires and use the money for a Manhattan Project to stamp out fraud, abuse, and corruption.

But we won't.

>we need better education and awareness of how billionaires manipulate us

So that people would vote for the government to manipulate them instead?

Honestly, I hate outlook as much as you do, but I'd still prefer it to Max

https://en.wikipedia.org/wiki/Max_(app)

> give it whatever email / creds it needs

Oh man, please tag me if you're ever the lead on any project so I know to stay far away from it.

Why are we so willingly ceding one of the few widely used free and open protocols to a handful of $mega-billion providers?

Experience shows that the walls will get taller and the moats will get deeper.

Sounds more like using outlook.com is a mistake. I've been running my own mail server for over 20 years and outlook.com is literally the only domain I have had problems with, and this is the only reason that I now send via Scaleway's free transactional email service.

The people working on outlook.com are just talentless amateurs - the rest knows how to do it right. It's a shame it's so widely used.

Alt take: Using a Microsoft-hosted email service is a big mistake in 2026...

You can take my email server from my cold, dead hands.

Proudly self-hosting since 2001. My mail server is in my basement. Do not know what you are talking about.

This is what google and microsoft want the make you think for obvious reasons.

Fortunate for those running their own servers is that they actually still get all the cool emails from people not complying.

Why?

At the most you need to use an external service for delivery (usually because you have problems with MS) but you can still run your own server with no difficulties once you do that.

That said, DMARC is required by a lot of people now, so I do not think this particular issue is a problem.

I have been self hosting my my personal email (and for family). Few problems so far other than delivery to MS and I have recently moved a domain I use for work email over.

Oddly enough the MS problems come from hotmail, but not other services. If that is a problem, then pay a bit to have email delivered.

No. You're supposed to understand how mail works on the Internet, and configure it correctly so that everyone else accepts it.

Go to https://mail-tester.com. Send a test email. If you don't get 10/10, fix your shit.

To be fair, DMARC has been required for a very long time. IIRC Google warned about 2 years ago circa that non-compliant emails would land in spam or be null-routed. And the DMARC noise started even before that.

You don't have to, this is the key reason to have a DMARC monitoring service. It will tell you when there's a deliverability issue with some particular receiver.

DMARC applies not on your mail server, inbound or outbound, but on the server that is receiving your mail (which may in fact be your mail server).

That server will look at how the mail authenticates and decide if it should allow the mail to proceed, it (for the most part) will then tell you whether or not it allowed the mail. This is how you will know you might have a deliverability problem before your customers do.

If you're wanting to know about deliverability (particularly for this Microsoft case), my company (Alesian Security) has a free check at https://alesiansecurity.com/try?tab=deliverability

If running a mail server is central to your business, you should keep up with best practices. If not, 2 days of non-delivery aren't important, just resend.

As a company we realised about 12 months ago that email can no longer be considered a reliable method of communication. I understand the reasoning but the result is the result. Many new clients we deal with have whitelists on and we have to pester our clients to add us to their lists. Not a great experience for anyone. I think we should consider email pretty much moribund at this point.

Delivery to Microsoft's products has been patchy for several years. I am not remotely an email deliverability expert but I have made different SMTP service choices based on how companies approach shared-IP sending plans.

Some can affordably deliver to Microsoft because they aggressively police what they are actually sending on their customers' behalf; others don't get involved and you end up having to spend a fortune on a dedicated IP.

The DMARC thing is just another part of this; one of my clients discovered this silent failure themselves a few weeks back and addressed this.

> Don't confuse DMARC with DKIM or SPF; DMARC doesn't actually do anything for email security.

DMARC doesn't introduce a new security mechanism by itself, but it fixed a few bad security flaws in SPF and DKIM. Without DMARC, SPF and DKIM do not add meaningful security.

DMARC updated and formalized how receivers should handle authorization and authentication of inbound email by adding the alignment requirement. Alignment ties the SPF and/or DKIM domain to the rfc5322.From domain. This also allows receivers to use domain reputation rather than IP-reputation.

SPF by itself has a bad design flaw that completely breaks any security that SPF was supposed to provide. By adding DMARC this security hole is fixed. (Although SPF is still horribly unreliable, it should be considered legacy at this point, don't rely on SPF).

DKIM benefits from DMARC alignment requirement too. DMARC ties the rfc5322.From domain to the DKIM signing domain, which makes DKIM practical for sender authorization, not just authentication.

That is not true. Reports are just one of the features of DMARC. The policy which allows you to instruct senders what to do with unauthenticated emails is the much more relevant part an when the receiver follows it, it very much does prevent spoofing.

DMARC gives you 20 reminders that you have sent an email, just incase you had forgotten.

> so tell me what benefits that has over having no dmarc record at all ?

The the existence of a DMARC assertion record in the DNS changes how the MTA (the receiving system) assesses the authentication of the message and authorization of the sender with SPF and/or DKIM, as per rfc7489 (and now also rfc9989).

No DMARC results in the MTA falling back to the original assessment method as defined in the original SPF and DKIM RFCs. These RFCs have design flaws and don't define the assessment flow all that well, they leave a lot up to the MTA's digression/interpretation.

So, the existence of a DMARC record with p=none is fundamentally different over not publishing a DMARC assertion record at all. It's just that with p=none you don't enforce the MTA to reject the email if it fails authentication/authorization, you're leaving it up to the MTAs digression.

It's an interesting argument. The fact this article exists is somewhat proof that it is a differentiator. The flipside, however, is that spammers very specifically require their emails to get to add many mailboxes as possible, so their motivation is greater to make their emails service compatible.

Company sys admins have likely got all sorts of other issues to worry about, and the occasional report of an email not getting through is likely low on their to-investigate list.

Having said that, I self host a mail server, and have all those things setup correctly, and my workplace uses Outlook, and I've not had issues with delivery, so it's not a particularly difficult bar to jump.

I added DMARC and DKIM together, around the same time as some particular life events 10 years ago. Just now, I cross-checked the information against the commits in my Git repos.

Back then, I didn’t use Terraform or anything like that, but I had text files with logs that described the DNS setup in detail so I could fix things. By grepping through the logs, I’m able to put a definitive bound on when I added DMARC—it was no later than June 2016, over 10 years ago.

At the time I thought, “Obviously, we should all be setting this up, because recipients will start rejecting mail from insecure domains, if they don’t already.” This was also back when I self-hosted email. I eventually stopped doing that because I thought it was too time-consuming.

>DMARC is primarily useful for large, complex organizations

>But for small personal domains the value isn't that high.

I don't understand the resistance. It benefits the entire mail ecosystem, not just mass senders.

SPF used to be niche thing, then everyone realised it's a good idea and it became more-or-less mandatory. Same with DKIM. Now it has happened to DMARC as well.

> DMARC = telling receivers how to handle mail that fails authentication.

No. DMARC is about if the from address has to match the address used in dkim/spf

> You adopted it the moment it was announced? Really?

A specification exists since 2012, 14 years ago. 10 years ago it was already old.

Then it’s dying. I don’t know a single person under 30 who uses email NOT for work

"Quietly" in the title is an AI slopspam pattern. It's an over-used teenager hyperbolic crutch word on par with "literally", "actually", "honestly" and similar.

Sometimes it's use is appropriate, but not in this case. Microsoft announced this change loudly, multiple times, starting more than a year ago. I seem to recall one of those announcements being discussed here on HN. Even the article links to it's own previous announcements, so "quietly" here is stupid rage bait to justify a blogspam advert.

Unfortunately, the people abusing these are very persistent and adding more checks will just increase the sophistication of such attacks which works against the interests of the target.

This stops disguising yourself as a legitimate service.

If they did that you’d decry censorship.

Allowing basically ~whatever, but proving the sender address is an obviously good approach to me.

email is weird, without this it doesn't perform the checks at all

Agreed. There's no additional verity provided by adding a DNS record with a static line of text. Reminds me of airport security theater: meaningless hoops for citizens to jump thru under the guise of stopping bad actors.

Selection bias: you don’t see the spam that get rejected at HELO.

No, not delivering is much better. You get a clean error message that tells you exactly what to do, it can be fixed in minutes. Spamfoldering email for not having DMARC would be a mistake, it might be years before low volume senders notice and figure out what's wrong (if they ever do).

I don't know. I think this disenfranchises a lot of independent operators, and the blow of that could at least be softened by making a highly-visible public announcement about it a few months ahead of time.

Maybe you're right that just enforcing it is the way, but I don't agree with doing that with no heads up.

Requiring HTTPS was very unreasonable. You have so many more moving parts that can go wrong, and a business relationship with a CA (even if it's Let's Encrypt). We only tolerate this because the alternative is worse.

That is a burden definitionally, though; and that's to say nothing of the effort required to understand the technology and its impacts on operations.

Thanks!

Some additional context:

- I checked online and they do have this email address listed on their pages

- This affected 2 separate domains served by Microsoft

- I sent them an inquiry email now from my @gmail.com and no bounce was returned so far

EDIT: Also gmail got the error response, so I guess it's really up to the outlook server these unrelated entities use...

Lots of big email services do quietly reject mail. They successfully accept it but then throw it away (sometimes not even in the spam folder for particularly high span scores).

Replying to all inbound messages with a bounce is an old idea. The theory was that legitimate senders would validate their address and get added to a white list. The scheme didn't work for the same reason captchas don't work.

It sounds like Gmail is seeing 3000 emails a day coming from foo@bar.com, some of which are different kinds of spam, and reasonably concludes they are a spammer.

Under RFC 7489 [1], a domain with no DMARC record simply has no DMARC policy, the receiver is able to enforce whatever policy it likes.

Most receivers have chosen to treat this as p=none for the last decade (Microsoft included). This is changing to now so that mail with no record is simply refused. Nothing in the standard prohibits this.

a DMARC of p=none might be seen as ambiguous - SPF and DKIM have their own jobs and they work. However, the point of DMARC is not a new way of enforcing mail authentication. Instead it is a way of making certain that the mail is internally consistent and furthermore provides two additional things.

1. it indicates if the domain owner has thoroughly gotten their mail to authenticate (in which case they adopt a p=reject), and

2. it provides a feedback mechanism that allows the domain owner to know if they are seeing authentication and deliverability problems in such a way that they can fix those broken mail flows.

[1] https://www.rfc-editor.org/info/rfc7489/

Googling around this started at least a year ago, but I worked at an MSP 3 years ago when it was first announced and we started getting customers into compliance. This wasn't something out of the blue.

Do you know if it’ll affect my (personal) account? I run everything through a normal Gmail account and have forwarding for incoming email and an alias for outgoing stuff

Yes, this is an older announcement from last year. Yahoo and Google did the same at that time.

The failure associated with that announcement is different. It is 5.7.515.

This new failure mode is "5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records (AS9031519)", I haven't seen any formal announcement on my end. The important thing to know about 5.7.1 is that it represents a few different failure modes, the AS9031519 is the important bit and it indicates that the domain lacks a DMARC record.

Is there any actual evidence of this outside of this one company's AI-generated article?

It shouldn't BE backwards compatible. That's the Microsoft problem. They can't innovate because they have 40 years of legacy holding them back. Email might be the only situation that's worse. I don't want another new layer over the top like DMARC, and I don't want to try to "fix it." It can't be fixed, it's just a bad design.

I want something fundamentally new that doesn't stink of 70's era pre-security thinking.

A group of heavy hitters needs to just form a working group and propose Email 2.0. As long as it's supported by the biggest vendors and companies and they don't go all "IPv6: It's better because it's complicated!" on it people will sign up because it will be able to offer MUCH more in terms of features, usability, security, ease of hosting, etc.

I like Matrix, but I'm not sure it's really a direct email replacement. I think it could become one with sufficient work, but it's not there right now.

SPF when the alignment fell

Not IME. I just added all 3, after not having any noticeable email issues for years.

Unfortunately, SPF and DKIM become optional once you send enough email for a mail server to trust you. You could've never bothered to update your email to the futuristic year of 2015 and still made your way into every inbox without ever knowing you forgot something.

I suspect that he/she means they runs a mail server and it was up to his customers to comply, but now they’ve had to deal with the fallout from their customers not complying.

The customers have to do it themselves since they control their domains. I recommend doing everything correctly but also understand that this stuff is pretty hard for people just trying to run a small business. But if it makes you happy to feel smug you can carry on assuming.

DMARC is layered across (/is useless without) two other protocols (SPF, DKIM), both of which also require DNS records.. there's no way to DMARC with one record.. unless you're excluding those SPF and DKIM records in your count. You /could/ DMARC with two records: DMARC+SPF, or DMARK+DKIM but it's ill-advised - use all three. (Ignoring host hierarchy/cname delegation, you can have far more records)

Do they literally just need the DMARC record to exist though, or do they need it to actually say something? Do you need DKIM? I found that SPF is very easy but DKIM is a royal pain.

"The old technique of adding the sender to your contacts doesn't work reliably anymore."

An Outlook user first reaching out to you, and you replying and including the unique message-ID of their original envelope in your headers, doesn't affect anything either. Absurd. The whole situation is complete dog shit.

Anecdotal. I've self-hosted for many years but didn't run into these issues with O365 until this year. But not surprised to hear it.