Microsoft began enforcing DMARC authentication requirements on May 5, 2025, for domains sending 5,000 or more emails daily to its consumer email services. The enforcement requires domains to publish SPF, DKIM, and DMARC DNS records with alignment between the authenticated domain and the visible From: address. Emails failing these checks are silently rejected with a 550 5.7.515 error, without bounce or sender notification. This policy targets bulk senders such as newsletter and transactional email services. Common misconfigurations include missing SPF or DMARC records, lack of DKIM signing, or alignment failures due to third-party sending services. Microsoft 365 business accounts are unaffected by this enforcement, which follows similar rollouts by Google and Yahoo. The change emphasizes the necessity for domains to implement proper email authentication to maintain deliverability to Microsoft consumer inboxes.

Emails sent to Microsoft consumer email addresses from domains without properly configured SPF, DKIM, and DMARC records with alignment may be silently rejected without notification. This can cause loss of email deliverability for bulk senders such as newsletters and transactional email services, potentially leading to undelivered invoices, notifications, or marketing messages. The enforcement does not affect Microsoft 365 business accounts. There are no known exploits or active attacks associated with this enforcement; the impact is on email delivery reliability.

Ensure your domain publishes valid SPF, DKIM, and DMARC DNS records with proper alignment between the authenticated domain and the From: header. For domains sending 5,000 or more emails daily to Microsoft consumer addresses, this is mandatory to avoid silent rejection. Check your domain records using DNS queries or tools like MXToolbox. If using third-party email services, configure custom DKIM signing and include their sending IPs in your SPF record. Microsoft 365 business accounts are not affected by this policy. No patch is required as this is a policy enforcement by Microsoft. The vendor advisory indicates this is a deliberate enforcement step, so remediation involves configuration updates rather than software patches.