Microsoft’s email security is unexpectedly blocking legitimate business mail

Microsoft’s email filters, which are designed to protect users from malicious messages, appear to be rejecting legitimate ones. This issue has been ongoing since November 5 and is currently being investigated. The problem only affects small senders, rather than bulk senders, and can result in Non-Delivery Reports (NDRs) with errors related to DMARC, SPF, or DKIM.

Some senders have reported inconsistent failures, with some messages getting through while others are rejected. Despite Microsoft not announcing a policy change or any public communication about the issue, email experts believe that the problem may be a combination of a policy change and a bug. The root cause of the issue could be that many small senders are not publishing DMARC, SPF, or DKIM records, which are necessary for email authentication.

The fix is to add a DMARC record to every domain that sends mail as the sender, with a policy of "p=none" to prevent bounces while the issue is being investigated. Larger organizations are more likely to have these records in place, but smaller organizations may have overlooked the need for them. The inconsistency in the failure rate makes the issue particularly dangerous, as recipients may assume that the message was not sent when in fact it was.

Microsoft customers should check their mail logs and help desk tickets for bounce reports and resend any important messages that did not get through.