Outlook.com Is Quietly Rejecting Email from Domains Without DMARC

Commenters largely agree that SPF, DKIM, and DMARC have become expected parts of sending email, and some say domains should have had DMARC configured years ago. They view enforcement as a reasonable way to reduce spoofing and phishing, especially for organizations, and report that adding a DMARC record restored delivery. Others object less to the requirement than to its rollout: they say customers and operators were caught off guard, sometimes during urgent work, and that a clear SMTP rejection is preferable to mail being accepted and then silently lost. One commenter points to Microsoft documentation and earlier reporting as evidence that the policy had been announced.

The dispute also turns on what DMARC accomplishes and who bears the cost. Some commenters describe it as a simple DNS change and a fair minimum for professional senders; others argue that DMARC alone does not authenticate or prevent spoofing, and that its value is limited for small personal domains. Self-hosters and mail operators describe opaque blocklists, unexplained delivery failures, and difficulty getting Microsoft support to resolve them. Some see these problems as evidence that large providers wield too much power over email; others respond that self-hosting is increasingly impractical and that stricter authentication is justified. Across both camps, commenters emphasize that legitimate mail can still be lost, even from properly configured systems.