As of March 2023, Microsoft 365 started sending aggregate DMARC reports. This update fixed a blindspot that had existed; previously, where Microsoft didn’t report on DMARC results, you would miss crucial insights and legitimate senders that could then be blocked from sending emails once p=reject was enabled.
Another milestone improvement has now been announced, with Microsoft honoring DMARC policies in M365 and its consumer properties from July 2023.
We have changed our DMARC policy handling to honor the sender’s DMARC policy. If an email fails DMARC validation and the sender’s policy is set to p=reject or p=quarantine, we will reject the email.
Announcing New DMARC Policy Handling Defaults for Enhanced Email Security
Previously, Microsoft did not honor p=reject and would treat the policy in oreject (override reject) mode that behaves like quarantine. This meant that if a sender’s DMARC policy stated “p=reject”, both Outlook.com (including Hotmail and MSN) and Microsoft 365 would put the email in the recipient’s junk folder or spam folder, making it possible for phishing emails to make it into inboxes. Read more about DMARC policies here.
With this update, Microsoft is now honoring and enforcing a domain’s reject policy in M365 and its consumer properties. This means that a domain with a policy of reject will block emails that fail DMARC validation by default. By respecting a domain’s DMARC policy, Microsoft helps create a safe digital environment for its customers and consumers by ensuring that exact domain impersonation attacks are blocked.
Evaluating your DMARC posture is now more important than ever
With this update, Microsoft joins other top email-sending providers (ESPs) like Yahoo, Gmail, and Apple who all honor DMARC policies. Given this shift in the ESP landscape, it is a good time for companies to evaluate their DMARC posture and make sure they are not inadvertently blocking good emails.
How Red Sift OnDMARC can help
With Red Sift’s OnDMARC, an award-winning automated DMARC solution, Microsoft 365 customers can enhance their email security and protect against a wide range of outbound and inbound email-based threats. Customers have full visibility of their sending sources, both inbound and outbound, and can expect to reach DMARC enforcement and block malicious spoofing emails from getting to their employees, customers, and partners in as little as 4-8 weeks.
OnDMARC seamlessly plugs into the Microsoft environment and works in harmony with Microsoft Defender for Office 365 to provide a robust layered defense against advanced email threats. The Microsoft Intelligent Security Association (MISA) recognizes and lists OnDMARC as an approved integration and preferred solution in the Azure Marketplace, acknowledging it as fully complementary to Microsoft’s own email security solutions.
“At Microsoft, we look to build enduring, ongoing relationships with partners like Red Sift protecting e-mail and other hybrid work essentials. With increasingly sophisticated cyber criminals targeting email communications, the Red Sift platform helps Microsoft 365 customers to enhance the security of their systems.”
Parri Munsell, Senior Director, Microsoft Security Marketing
Learn more about Red Sift OnDMARC here or if you’d like to jump straight in and get started with a 14-day free trial, just click the link below.
Please note: Microsoft tenant admins also have the ability to customize how they want their tenants to adhere to these DMARC policies. We encourage all Microsoft customers to review their tenant DMARC settings and customize them if needed to benefit from improved email security and deliverability.
