Outlook’s New Requirements for High‐Volume Senders

Question

Hi, this is about the new enforcement on email auth by outlook.com

Strengthening Email Ecosystem: Outlook’s New Requirements for High‐Volume Senders | Microsoft Community Hub

https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/strengthening-email-ecosystem-outlook%E2%80%99s-new-requirements-for-high%E2%80%90volume-senders/4399730?

My question is: If SPF result is pass with alignment, hence DMARC is also passing, but Dkim auth result has temperror (could be due to DNS timeout, other reasons at the time of resolution by recipient server)

What will happen to those messages?

* Changed to a question

Answer 1

Hello GagandeepSingh0309,

Thank you for your reply.

I am a reasonable inference based on publicly available RFC email authentication standards and Microsoft's historical processing logic. Like you, I am an ordinary user of Outlook.

We suggest that you submit a question in Microsoft Q&A and select either Exchange Online or Email Authentication as tags.

Also, I hope the following link can be helpful to you:

Email authentication in Microsoft 365 - Microsoft Defender for Office 365 | Microsoft Learn

Wishing you a wonderful day.

Best regards,

Kai Ho | Microsoft Community Support Specialist

Answer 2

Thank you so much for replying Kai. So you answer is not official but an assumption?

Where do you think i can get official answer to this?

Answer 3

Hello GagandeepSingh0309,

Welcome to the Microsoft Community.

From your description, I understand that you are confused about the new enforcement for Outlook's email ninja, and I empathize with the confusion you are experiencing regarding this issue.

According to Outlook's requirements for new bulk senders, in conjunction with email authentication standards (DMARC/SPF/DKIM) and common processing logic, the situation you described (SPF passing and aligned, but DKIM failing due to temperror) is handled as follows:

SPF alignment passed:

meets one of the DMARC pass conditions (either SPF or DKIM can pass).

DKIM temperror:

pertains to a temporary failure (such as a DNS query timeout), which will not directly result in a DMARC failure.

According to RFC 7489, temporary errors should be ignored during DMARC processing, and reliance on SPF results should continue.

Conclusion:

DMARC result is pass (because SPF has passed and is aligned).

Normal delivery:

If DMARC passes, even if there is a temperror with DKIM, the email is usually received normally (assuming no other anti-spam policies intercept it).

I really wish I could address your issue, but unfortunately, it's beyond the scope of community support. It would be more appropriate to post it on Microsoft Learn (in English), where there are more advanced forums and more users posting these questions; you can click 'Ask a Question' for experts to provide more professional solutions.

Here’s the link to the forum where you can raise specific scenarios and share your thoughts to help resolve the issue.

Microsoft Authenticator - Microsoft Q&A

I’m sorry to have to direct you to another forum again. I sincerely hope your issue gets properly handled after contacting the right department. Thank you for your understanding!

Best regards,

Kai Ho | Microsoft Community Support Specialist