Microsoft announces its new handling of DMARC policies

As of March 2023, Microsoft 365 started sending aggregate DMARC reports. This update fixed a blindspot that had existed; previously, where Microsoft didn’t report on DMARC results, you would miss crucial insights and legitimate senders that could then be blocked from sending emails once p=reject was enabled.

Another milestone improvement has now been announced, with Microsoft honoring DMARC policies in M365 and its consumer properties from July 2023.

We have changed our DMARC policy handling to honor the sender’s DMARC policy. If an email fails DMARC validation and the sender’s policy is set to p=reject or p=quarantine, we will reject the email.

Announcing New DMARC Policy Handling Defaults for Enhanced Email Security

Previously, Microsoft did not honor p=reject and would treat the policy in oreject (override reject) mode that behaves like quarantine. This meant that if a sender’s DMARC policy stated “p=reject”, both Outlook.com (including Hotmail and MSN) and Microsoft 365 would put the email in the recipient’s junk folder or spam folder, making it possible for phishing emails to make it into inboxes. Read more about DMARC policies here.

With this update, Microsoft is now honoring and enforcing a domain’s reject policy in M365 and its consumer properties. This means that a domain with a policy of reject will block emails that fail DMARC validation by default. By respecting a domain’s DMARC policy, Microsoft helps create a safe digital environment for its customers and consumers by ensuring that exact domain impersonation attacks are blocked.

Evaluating your DMARC posture is now more important than ever 

With this update, Microsoft joins other top email-sending providers (ESPs) like Yahoo, Gmail, and Apple who all honor DMARC policies. Given this shift in the ESP landscape, it is a good time for companies to evaluate their DMARC posture and make sure they are not inadvertently blocking good emails. 

How Red Sift OnDMARC can help

With Red Sift’s OnDMARC, an award-winning automated DMARC solution, Microsoft 365 customers can enhance their email security and protect against a wide range of outbound and inbound email-based threats. Customers have full visibility of their sending sources, both inbound and outbound, and can expect to reach DMARC enforcement and block malicious spoofing emails from getting to their employees, customers, and partners in as little as 4-8 weeks.

OnDMARC seamlessly plugs into the Microsoft environment and works in harmony with Microsoft Defender for Office 365 to provide a robust layered defense against advanced email threats. The Microsoft Intelligent Security Association (MISA) recognizes and lists OnDMARC as an approved integration and preferred solution in the Azure Marketplace, acknowledging it as fully complementary to Microsoft’s own email security solutions.

“At Microsoft, we look to build enduring, ongoing relationships with partners like Red Sift protecting e-mail and other hybrid work essentials. With increasingly sophisticated cyber criminals targeting email communications, the Red Sift platform helps Microsoft 365 customers to enhance the security of their systems.”

Parri Munsell, Senior Director, Microsoft Security Marketing

Learn more about Red Sift OnDMARC here or if you’d like to jump straight in and get started with a 14-day free trial, just click the link below.


Please note: Microsoft tenant admins also have the ability to customize how they want their tenants to adhere to these DMARC policies. We encourage all Microsoft customers to review their tenant DMARC settings and customize them if needed to benefit from improved email security and deliverability.

PUBLISHED BY

Francesca Rünger-Field

26 Jul. 2023

SHARE ARTICLE:

Categories

Recent Posts

VIEW ALL
DMARC

Why DMARC should top your MSP roadmap in 2025

Jack Lilley

Executive summary: Email remains the easiest way for criminals to reach customers, and major mailbox providers have decided that unauthenticated mail is no longer welcome. Google and Yahoo started rejecting bulk messages without DMARC in early 2024, and Microsoft 365 will follow in 2025. Yet only 9.7% of the world’s 73 million active domains…

Read more
Product Release

Red Sift’s 2025 Spring Quarterly Product Release

Francesca Rünger-Field

This Spring, we’ve delivered targeted updates to improve compliance, simplify certificate management, and strengthen infrastructure visibility—so you can take action faster and with more confidence. Highlights include: OnDMARC BIMI: Now with full Digicert & CMC support OnDMARC customers that wish to improve trust in their emails and boost open rates by implementing BIMI through…

Read more
BEC

The threat of Business Email Compromise in US healthcare

Jack Lilley

Executive summary: Business Email Compromise is siphoning billions from U.S. healthcare by exploiting human trust instead of software flaws. Spoofed or hijacked messages authorize fraudulent payments, spark ransomware, and expose patient data—causing crippling financial, operational, and compliance damage. Deploying DMARC, MFA, and rigorous multi-person payment checks is now critical. 3 key takeaways Business Email…

Read more
Email

Cloudflare selects Red Sift as a preferred partner to provide DMARC and…

Rebecca Warren

AI-generated email attacks are rapidly growing in scale and sophistication, demanding stronger defenses from at-risk organizations. Starting today, Red Sift is excited to announce a new strategic partnership with Cloudflare, the leading connectivity cloud company, to deliver its market-leading email security application, Red Sift OnDMARC, to a broader global audience.  Today’s alignment enhances Cloudflare’s…

Read more