News for hackers. Stuff that matters.
Re:Outlook.com Is Quietly Rejecting Email from Domains Witho... by verandaguy on Sunday November 08, 2026 @02:49PM (#50416466)
This is interesting. At some point, I think it'll be desirable to give increasing positive weight to emails with the DPF/DKIM/DMARC trifecta configured, since those are least likely to be problem emails (spam or phishing), but I wonder what the best avenue is to actually make that the default. It's almost certainly not this kind of unannounced cutoff.

Email is, I think, among the most distributed popular online services, and there's a ton of stuff that's legacy, self-managed, or otherwise janky. Supporting SPF, DKIM, and DMARC does put a burden on independent operators, but is it an undue or unreasonable one in the current landscape?

Re:Outlook.com Is Quietly Rejecting Email from Domains Witho... by anonymous908213 on Sunday November 08, 2026 @02:53PM (#50416506)
> but is it an undue or unreasonable one in the current landscape

Yes. In the first place, this should not even be a thing. Two corporations should not be in control of who can send e-mail. If they want to mark not having DMARC as spam, mark it as spam, but these games with refusing to deliver are just bullshit and essentially force a monopoly where other e-mail providers cannot compete because their e-mails aren't delivered.

Re:Outlook.com Is Quietly Rejecting Email from Domains Witho... by mike_hearn on Sunday November 08, 2026 @03:45PM (#50417017)
No, not delivering is much better. You get a clean error message that tells you exactly what to do, it can be fixed in minutes. Spamfoldering email for not having DMARC would be a mistake, it might be years before low volume senders notice and figure out what's wrong (if they ever do).
Re:Outlook.com Is Quietly Rejecting Email from Domains Witho... by anonymous908213 on Sunday November 08, 2026 @03:53PM (#50417119)
> You get a clean error message that tells you exactly what to do

We are literally talking about a situation where this is not happening! And the problem is that it's not just this. Once you give them a license to police e-mail, they start policing e-mail for all kinds of arbitrary and inscruutable reasons. If this were going to be done, it should really be formalized as an industry standard by an independent consortium, not up to the whims of Microsoogle.

Re:Outlook.com Is Quietly Rejecting Email from Domains Witho... by mike_hearn on Sunday November 08, 2026 @04:01PM (#50417196)
Are we? Microsoft is bouncing emails with instructions on what to do.

DMARC, DKIM and the rest are industry standards set through an independent consortium (it's called the MAAWG iirc)

Re:Outlook.com Is Quietly Rejecting Email from Domains Witho... by stevekemp on Sunday November 08, 2026 @03:00PM (#50416580)
It seems like 90% of the spam I receive (on my google account) is sent from google addresses, so it will have valid SPF/DKIM/DMARC setup.

That said checking for these things is a good idea, the only problem I see is dropping the mail on the floor, rather than rejecting it at SMTP time - at least that lets the self-hosting users who haven't got things configured know their email is being rejected, and to pick up the phone instead.

There's nothing worse than sending an email, it being accepted, and then later discarded with no clue to either sender or recipient.

Re:Outlook.com Is Quietly Rejecting Email from Domains Witho... by shye on Sunday November 08, 2026 @03:15PM (#50416687)
Selection bias: you don’t see the spam that get rejected at HELO.
Re:Outlook.com Is Quietly Rejecting Email from Domains Witho... by cowlevel on Monday November 09, 2026 @12:40AM (#50421490)
My server doesn't reject anyone, but does greylisting. That's a default setting in Postfix. It means the first time an IP address connects it gets a temporary error. If it retries later the message is accepted. That's the only anti-spam measure I have.

Maybe 1 in 5 emails I get is spam, and because I use a different address with every sender I know who sold "my" address to a spam list.

Re:Outlook.com Is Quietly Rejecting Email from Domains Witho... by stephbook on Sunday November 08, 2026 @03:02PM (#50416594)
> I wonder what the best avenue is to actually make that the default. It's almost certainly not this kind of unannounced cutoff.

En contraire, I think not delivering mail is the fastest way to adoption. People will use an old system for as long as it works. It now does not anymore.

Re:Outlook.com Is Quietly Rejecting Email from Domains Witho... by verandaguy on Sunday November 08, 2026 @05:55PM (#50418405)
I don't know. I think this disenfranchises a lot of independent operators, and the blow of that could at least be softened by making a highly-visible public announcement about it a few months ahead of time.

Maybe you're right that just enforcing it is the way, but I don't agree with doing that with no heads up.

Re:Outlook.com Is Quietly Rejecting Email from Domains Witho... by jwr on Sunday November 08, 2026 @03:10PM (#50416642)
Most spam I get is from Google, Microsoft and Amazon. We should pressure those to start dealing with the problem. Right now they are conveniently ignoring it.
Re:Outlook.com Is Quietly Rejecting Email from Domains Witho... by esikich on Sunday November 08, 2026 @03:23PM (#50416768)
There's no burden whatsoever. It's a one time setup that takes like 15 minutes.
Re:Outlook.com Is Quietly Rejecting Email from Domains Witho... by verandaguy on Sunday November 08, 2026 @05:55PM (#50418412)
That is a burden definitionally, though; and that's to say nothing of the effort required to understand the technology and its impacts on operations.
Re:Outlook.com Is Quietly Rejecting Email from Domains Witho... by esikich on Sunday November 08, 2026 @06:58PM (#50419115)
You can literally just Google a 3 step guide for any provider. What are you even arguing? That security for infra shouldn't be a thing? Should grandma be able to run a mail server? What's your point?
Re:Outlook.com Is Quietly Rejecting Email from Domains Witho... by verandaguy on Sunday November 08, 2026 @07:04PM (#50419168)
I'm arguing that with a system as distributed as email, there will certainly be people who won't do this upgrade; I'm highlighting the contrast between the need for this set of technologies (SPF, DKIM, DMARC) and the utility of an old-school open web where the barrier to entry is low and anyone can participate.

We have seen a massive erosion of the latter aspect of the web in the past few years, and I think it's useful to frame conversations in terms of that loss. The web used to be fun, and now it's become, more than ever, a professional enterprise. You often can't stand up a website without having to buy into Cloudflare's DDoS protection or something equivalent. I think this is absurd, and it's not the only such case, though these changes are obviously reactions to how usage of the web's evolved over the years.

I wonder if we can get the old web back in some way, shape, or form, cause I think we've lost something with the corporatization of the internet.

And for what it's worth, yeah, I think grandma should be able to run a mail server. Why not?

Re:Outlook.com Is Quietly Rejecting Email from Domains Witho... by 2000UltraDeluxe on Monday November 09, 2026 @09:51AM (#50426450)
It's perfectly doable for a hobbyist to set up email authentication properly. It requires some effort, sure, but it's not so hard it prevents you from running your own email server.
Re:Outlook.com Is Quietly Rejecting Email from Domains Witho... by 9029 on Sunday November 08, 2026 @06:01PM (#50418484)
I could be naive, but I don't see how this would be any more unreasonable than requiring HTTPS
Re:Outlook.com Is Quietly Rejecting Email from Domains Witho... by cowlevel on Monday November 09, 2026 @12:42AM (#50421503)
Requiring HTTPS was very unreasonable. You have so many more moving parts that can go wrong, and a business relationship with a CA (even if it's Let's Encrypt). We only tolerate this because the alternative is worse.
Re:Outlook.com Is Quietly Rejecting Email from Domains Witho... by rcxdude on Sunday November 08, 2026 @06:03PM (#50418516)
None of them are a good 'Is this spam?' heuristic, though. All they do is ensure the sending domain isn't forged, but most spam, even phishing emails, doesn't really rely on that. Spammers are much more motivated than average to jump through the hoops necessary to set it up, as well.