[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fpdjE6aDakp7l-LMPP0ACGDkG6O6zoZ9Nmb4F53fV4zM":3},{"article":4,"iocs":48,"watch_terms":49,"solutions":50,"lesson":142},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"8e9bdbab-10f9-4c0e-bf73-e408fec2dd06","Outlook.com bounces legit emails as Microsoft's authentication crackdown goes sideways","outlook-com-bounces-legit-emails-as-microsoft-s-authentication-crackdown-goes-si-d941be","Missing DMARC or wobbly SPF means your mail may be treated as suspicious","Microsoft's Outlook.com is experiencing widespread issues where legitimate emails are being bounced back to senders. This appears to be a side effect of Microsoft tightening its email authentication rules, specifically DMARC and SPF validation, intended to combat spam. However, the changes are impacting smaller senders and even those with compliant settings, with no clear advisory from Microsoft.","Microsoft's Outlook.com is bouncing legitimate emails due to an authentication crackdown.","https:\u002F\u002Fwww.theregister.com\u002Fapplications\u002F2026\u002F11\u002F09\u002Foutlookcom-bounces-legit-emails-as-microsofts-authentication-crackdown-goes-sideways\u002F5308428","https:\u002F\u002Fimage.theregister.com\u002F?imageId=249757&width=800","2026-11-09T13:30:00+00:00","2026-11-09T14:00:21.298316+00:00",7,[17,20,23,26,28],{"name":18,"type":19},"Microsoft","vendor",{"name":21,"type":22},"Outlook.com","product",{"name":24,"type":25},"DMARC","technology",{"name":27,"type":25},"SPF",{"name":29,"type":25},"DKIM","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":30,"icon":32,"name":33,"slug":34},null,"Vulnerabilities","vulnerabilities",[36,41,43],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":42},{"id":30,"icon":32,"name":33,"slug":34},{"category":44},{"id":45,"icon":32,"name":46,"slug":47},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",[],[18,21],{"controls":51,"vendors":138},[52,81,110],{"slug":53,"name":54,"problem":55,"products":56},"email-authentication","Email authentication (DMARC)","Nobody can send email that pretends to come from your domain.",[57,65,73],{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":61,"product_name":62,"url":63,"description":64},"valimail","Valimail","\u002Fvendor-logos\u002Fvalimail.png","valimail-enforce","Valimail Enforce","https:\u002F\u002Fwww.valimail.com\u002Fproducts\u002Fenforce\u002F","Automated DMARC enforcement with discovery of every service that sends mail as your domain.",{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"red-sift","Red Sift","\u002Fvendor-logos\u002Fred-sift.png","ondmarc","Red Sift OnDMARC","https:\u002F\u002Fredsift.com\u002Fpulse-platform\u002Fondmarc","Guided DMARC deployment and monitoring, with support for BIMI and MTA-STS.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","email-fraud-defense","Proofpoint Email Fraud Defense","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-fraud-defense","DMARC deployment and monitoring with hosted SPF and DKIM services.",{"slug":82,"name":83,"problem":84,"products":85},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[86,94,102],{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",{"slug":111,"name":112,"problem":113,"products":114},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[115,123,130],{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",{"vendor_slug":124,"vendor_name":18,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",[139],{"slug":124,"name":18,"logo_path":125,"roles":140},[141],"affected",{"slug":143,"title":144,"body":145,"framework_refs":146,"framework_notes":154},"microsofts-dmarcspf-crackdown-blocks-legitimate-email","Microsoft's DMARC\u002FSPF Crackdown Blocks Legitimate Email","Microsoft tightened its email authentication enforcement (DMARC and SPF validation) on Outlook.com without adequate change communication or staged rollout, causing legitimate emails from compliant senders to be incorrectly bounced. The root cause is a misconfigured or overly aggressive policy change applied at scale without sufficient testing or fallback mechanisms. This matters because email is a critical business communication channel, and unannounced disruptions erode trust, impact operations, and may inadvertently silence security alerts or transactional messages. The absence of a clear advisory from Microsoft compounded the incident, leaving affected senders without guidance to diagnose or remediate the problem.",[147,148,149,150,151,152,153],"CIS Control 17: Incident Response Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","CIS Control 14: Security Awareness and Skills Training","NIS2 Article 21(2)(b)","CIS Control 7: Continuous Vulnerability Management",{"NIS2 Article 21(2)(b)":155,"NIST SP 800-53 SI-2: Flaw Remediation":156,"CIS Control 17: Incident Response Management":157,"CIS Control 7: Continuous Vulnerability Management":158,"CIS Control 14: Security Awareness and Skills Training":159,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":160,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":161},"NIS2 requires incident handling procedures including timely communication to affected parties — Microsoft's failure to issue a clear advisory about the authentication change and its side effects does not align with this obligation for operators of essential digital infrastructure.","While aimed at patching flaws, SI-2 also covers controlled testing and staged deployment of changes to production systems — a process that would have caught the over-aggressive authentication enforcement before it impacted legitimate senders at scale.","Microsoft's lack of a clear advisory and the absence of a rollback plan represent failures in incident communication and response; a formal incident response process would have ensured timely customer notification and a coordinated remediation path.","Continuous monitoring of email delivery health and authentication configuration drift would have surfaced misalignments before Microsoft's enforcement tightening caused widespread bounces, allowing proactive remediation.","Many smaller senders affected by this incident lacked awareness of DMARC\u002FSPF compliance requirements; proactive training and guidance on email authentication standards would have ensured their domains were correctly configured ahead of enforcement.","Applying untested, sweeping authentication rule changes without change management controls mirrors the risk of unmanaged technical changes — ISO 27001 A.8.8 requires that changes to security controls be assessed for impact before deployment.","DMARC and SPF enforcement are core email authentication controls; this framework item requires that authentication policies be correctly configured and validated to ensure only authorized senders are blocked, not compliant ones."]