Microsoft announces its new handling of DMARC policies

As of March 2023, Microsoft 365 started sending aggregate DMARC reports. This update fixed a blindspot that had existed; previously, where Microsoft didn’t report on DMARC results, you would miss crucial insights and legitimate senders that could then be blocked from sending emails once p=reject was enabled.

Another milestone improvement has now been announced, with Microsoft honoring DMARC policies in M365 and its consumer properties from July 2023.

We have changed our DMARC policy handling to honor the sender’s DMARC policy. If an email fails DMARC validation and the sender’s policy is set to p=reject or p=quarantine, we will reject the email.

Announcing New DMARC Policy Handling Defaults for Enhanced Email Security

Previously, Microsoft did not honor p=reject and would treat the policy in oreject (override reject) mode that behaves like quarantine. This meant that if a sender’s DMARC policy stated “p=reject”, both (including Hotmail and MSN) and Microsoft 365 would put the email in the recipient’s junk folder or spam folder, making it possible for phishing emails to make it into inboxes. Read more about DMARC policies here.

With this update, Microsoft is now honoring and enforcing a domain’s reject policy in M365 and its consumer properties. This means that a domain with a policy of reject will block emails that fail DMARC validation by default. By respecting a domain’s DMARC policy, Microsoft helps create a safe digital environment for its customers and consumers by ensuring that exact domain impersonation attacks are blocked.

Evaluating your DMARC posture is now more important than ever 

With this update, Microsoft joins other top email-sending providers (ESPs) like Yahoo, Gmail, and Apple who all honor DMARC policies. Given this shift in the ESP landscape, it is a good time for companies to evaluate their DMARC posture and make sure they are not inadvertently blocking good emails. 

How Red Sift OnDMARC can help

With Red Sift’s OnDMARC, an award-winning automated DMARC solution, Microsoft 365 customers can enhance their email security and protect against a wide range of outbound and inbound email-based threats. Customers have full visibility of their sending sources, both inbound and outbound, and can expect to reach DMARC enforcement and block malicious spoofing emails from getting to their employees, customers, and partners in as little as 4-8 weeks.

OnDMARC seamlessly plugs into the Microsoft environment and works in harmony with Microsoft Defender for Office 365 to provide a robust layered defense against advanced email threats. The Microsoft Intelligent Security Association (MISA) recognizes and lists OnDMARC as an approved integration and preferred solution in the Azure Marketplace, acknowledging it as fully complementary to Microsoft’s own email security solutions.

“At Microsoft, we look to build enduring, ongoing relationships with partners like Red Sift protecting e-mail and other hybrid work essentials. With increasingly sophisticated cyber criminals targeting email communications, the Red Sift platform helps Microsoft 365 customers to enhance the security of their systems.”

Parri Munsell, Senior Director, Microsoft Security Marketing

Learn more about Red Sift OnDMARC here or if you’d like to jump straight in and get started with a 14-day free trial, just click the link below.

Please note: Microsoft tenant admins also have the ability to customize how they want their tenants to adhere to these DMARC policies. We encourage all Microsoft customers to review their tenant DMARC settings and customize them if needed to benefit from improved email security and deliverability.


Francesca Rünger-Field

26 Jul. 2023



Recent Posts


Red Sift Recognized on Deloitte’s EMEA Fast 500™ List

Francesca Rünger-Field

We’re thrilled to share that Red Sift has been included in Deloitte’s 2023 EMEA Fast 500 list. This recognition stems from 389% revenue growth over three years, $54 million in Series B funding, acquiring ASM innovator Hardenize, and introducing the Red Sift Pulse Platform. Read the press release here. About the award The Deloitte Technology Fast…

Read more
Brand Protection

The vital role of cybersecurity for Nonprofits: A deep dive 

Sean Costigan

Save the Children, a beacon of hope and change, has been dedicated to improving the lives of children for over a century. Founded in London, it now has a presence in 29 nations, employing 844 staff members in the UK alone and engaging over 3600 formal volunteers. As charities and nonprofits like Save the…

Read more

Red Sift brings DMARC data to the SOC with new Cisco XDR…

Rebecca Warren

Today, we’re thrilled to announce that we’re extending our partnership by joining the Cisco Security Technical Alliance and integrating Red Sift OnDMARC with Cisco XDR. This integration builds on the Domain Protection partnership we announced in November 2023 to bring visibility of business email compromise into the SOC (security operations center). At release, Red…

Read more

Preventing certificate related violations in cybersecurity frameworks:  A guide to certificate monitoring…

Rebecca Warren

TLS is one of the most widely adopted security protocols in the world allowing for unprecedented levels of commerce across the internet.  At the core of the TLS protocol is TLS certificates. Organizations must deploy TLS certificates and corresponding private keys to their systems to provide them with unique identities that can be reliably…

Read more