Outlook.com and similar are an anathema to email. This is why they tell you not to run a mail server .
On the other hand rejecting domains without dmarc is fine. Just not happy it is silent.
I bet Microsoft is single-handedly responsible for 80+% of complaints about email being impossible to host.
In a federated / pseudo-decentralized network, any provider with 10+% of captive users has an outsized leverage on the entire ecosystem. You don't need a monopoly; as long as you have a monopoly on just a few users that others absolutely need to be able to interact with, you can dictate terms to everybody.
I wish I could just wholesale block gmail.com like people used to do with the early webmail providers.
I think that implies having an actual google account to do that, which is absurd.
They are the reason I dropped self-hosting my mails. They were silently dropping some of my mails depending on the day I sent them. If they were at least sent to the spam folder, it would be easier to communicate with their users. And since a lot of their users are not technical at all, it's complicated to explain them the issue.
It's absurd in every way. I was trying to get it to stop spamming maillist traffic. It's impossible. Global level filters enacted as admin to not spam check are ignored.
Based on my broad experience, I’d comfortably rank Microsoft as the worst of the major email providers. (I am owner poste.io)
I haven’t productionized this setup (I send maybe a dozen emails a year) but it worked for me ad hoc a couple years back, when I had to send a mail to an Outlook-hosted address and they blackholed everything I tried to send while 250 OKing me.
I ran a SaaS up until recently. Emailing users notifications for events was just a normal part of the app. Users got upset when the emails didn't come through. So then I had to be email tech support for something I had no control over. Lovely.
It's always people self-hosting mail on a shared server in Moldova (because they think it makes them cool) that are complaining.
Which with cheap models like Jev as spam classifiers, this can now become a reality.
The problem is, Google and Microsoft have monopolized the entire email market, so their esoteric deliverability mysticism from 2007 still persists (basically blanket bans on entire IP spaces, locking out anybody trying to send emails on their own).
Email naturally followed this evolution.
With LLMs on the other side trying to make spam less detectable by cheap models like Jev?
It's funny when people assume benefits from some tech go one way and baddies will surely never use it...
https://www.mimar.rs/blog/a-journey-of-my-mx-server-to-new-r...
And yes, it's cool not to have to let scum read your private communications :D
It should be the other way around though.. More people should run their own mail servers so that centralized players cannot control what should be a decentralized communication protocol.
Four hours later, I got the same message by email. I thought he was back - nope. An email sent at 10am that was delivered at 4pm showed it was from 2pm until I looked at the header and saw sent at 10am and just... chilling out for 4 hours. DMARC was set up for them just fine.
I've had the same issue with my own custom domain, with DMARC set up. A year later, it finally got bumped up to some sort of "trusted" domain for that one place and my emails get delivered the same day now.
Mildly infuriating for emails containing OTP codes "valid for 10 minutes".
Yes, no one should not have DKIM or DMARC but holy yikes when neither side wants to actually give in to help the customer.
It turns out that whoever has the most power is the most powerful. This is why distributed/decentralized systems cannot singlehandedly free us from tyranny, and why I find people who spend all their time preaching decentralized systems to be quite silly. We don't need better systems (well maybe we do but,,,), we need better education and awareness of how billionaires manipulate us; this goes beyond software.
Mail, then emails, then home phones, then cell phones, then texts, then social media have been gradually rendered less and less usable by bad actors systematically abusing every single tool we try to use to communicate with one another to steal from us, lie to us, and manipulate our beliefs, and we'll just keep inventing and discarding new ways of communicating until we reckon with this.
The only question is how many years the lazy network-effects monopolies (like Google, Microsoft, Verizon, etc) will hold this back from happening.
The optimist in me says this will unlock pathways to true decentralization of push communication protocols (like SMTP) instead of only have decentralization of pull-oriented protocols (like HTTP).
I'll never pay for email so your options are either outlook or Gmail and I don't trust Google.
But we won't.
So that people would vote for the government to manipulate them instead?
Honestly, I hate outlook as much as you do, but I'd still prefer it to Max
Selfhosted email is likely easier now than it ever was before.
Oh man, please tag me if you're ever the lead on any project so I know to stay far away from it.
This is not Microsoft's fault. The building's on fire and they're locking out the arsonists.
I was working for Microsoft when outlook.com launched and got a good email address that was my primary for more than a decade.
I had so many issues with things getting silently dropped with no recourse (2FA codes, account recovery mails, etc.) on so many sites that I finally gave up, reversed the stream, and had Outlook forward to GMail instead of vice versa. A few months after that, I realized that all my Outlook got was an enormous volume (hundreds of day) a spam and that all legitimate mail was going to my other accounts, so I turned it off entirely and haven't read that mailbox in over a year.
This is not unique to Microsoft and really the source's problem — they did something to get blocked in the first place.
Add in the fact that you're almost certainly not the only one impacted, and that they have no interest in fixing it, it screams incompetence on the source's part.
Been there, done that, good luck explaining the problem to the app's first-level support in the Philippines because it's not in their script.
> and had Outlook forward to GMail
Till the day GMail hits you with the "We couldn't verify it's you" bullshit and locks you out of your account forever. Good luck getting support from Google, the word is not in their lexicon.
I've never encountered this issue with GMail. Delivery just works. I'm trying to think of the last false-positive spam flag I've had with GMail, and I've definitely never had mail be entirely dropped.
This is also true of Microsoft though.
Stop being so ignorant
I have access to a fairly large dataset of known bad hosting providers, but most people don't. So how do you tell the difference between getting a good deal and "this is cheap because it's sketchy as all hell".
We also don't block all of Vietnam, or all Jio customers in India, even if we know that 20% of bot traffic is from those two alone.
Wait until this guy realizes that all spam these days comes from Azure ASNs, and abuses cross-tenant issues as well as a simple "Fwd: ..." and "Re: ..." tricks to bypass Microsoft Outlook spam filters.
Experience shows that the walls will get taller and the moats will get deeper.
The solution is allow only communications that are demonstrably not spam and not unwanted.
There have been lots of proposals to this effect but maybe you have to put up two cents in a crypto wallet, which the other person can claim if the mail is unwanted. If someone takes your two cents, you remove them from your lists ASAP. The receiver doesn't benefit meaningfully from the 2c so they are unlikely to claim it. The sender is only damaged if a lot of different people claim the 2 cents. Maybe a few domains are default whitelisted even if they don't put up 2 cents, to protect against entities that are important but would be frequently spite-claimed (IRS, courts, and other similar). If you use a provider that doesn't whitelist, fine, but you're going to miss those emails.
Maybe the top 'spite claim' users are published and it becomes difficult to get people to agree to put up money to talk to you.
This reduces spam to the level of junk mail, which is still not totally trivial but is orders of magnitude more manageable.
There is and it's the same as other protocols including proprietary ones - a sender address whitelist.
There's no proprietary protocol that solved spam either.
Seems they are the disease not the cure
Lately I've also been getting a lot from compromised MS365 accounts.
It seems insane that gmail doesnt provide a way to automatically send a mail (eg based on domain, keywords, etc) to spam. I know theres block sender but for example aliexpress uses a different name for every email so that's useless.
What this is called is survivorship bias. The question I would ask is how much mail are you not seeing at all because it's dropped at the edge first thing because it's IP block listed?
Next, how much spam are you seeing from them because they and Google are the largest providers on Earth? Kind of like selecting a random person from the population in the US and going "look, it's a white guy". Yea, that's how statistics works.
Lastly, because the are good at blocking spam at the edge, then that's the last bastion of attack for spammers to put their efforts in if they want any return at all.
Self-hosting allows me to use a different receiving address for each entity I contact, so I know exactly who put me on spam lists and if it gets bad I can route that address to the garbage bin.
Anecdotes are not a great thing to run mail servers on, broad statistics are.
These entities communicate via plain old mail, that costs more than 2 cents already.
We have dozens of different ways to send E2EE messages to each other, with realtime publish-subscribe, and yet billions of dollars are spent trying to duct tape email. Who cares if Outlook/Gmail/Icloud use IMAP or Websocket? If the interface looks the same to the end user will they really care?
Experience shows that the walls will get taller and the moats will get deeper.
The people working on outlook.com are just talentless amateurs - the rest knows how to do it right. It's a shame it's so widely used.
What about tencent.com, foxmail.com, or qq.com?
Most of them wouldn't even care probably...
User signs up, uses @outlook. Your app declines it and explains that they block with no way to remedy, and explain they are a bad vendor.
Emails would be accepted by Outlook.com, but would never deliver. We had SPF/DKIM/DMARC and full reporting. They RBL'ed us with no remedy.
We told the customer to not use outlook.com BECAUSE we told them we could not guarantee any delivery of messages.
Means you're not using your email seriously. For example, to send CVs in response to job postings.
I send up to 20 email per day to people who have issues with their package build scripts, and I have no idea whether they ignore me because they stopped using the distro or because mail got dropped.
You should be able to see this on your DMARC dashboard
Fortunate for those running their own servers is that they actually still get all the cool emails from people not complying.
At the most you need to use an external service for delivery (usually because you have problems with MS) but you can still run your own server with no difficulties once you do that.
That said, DMARC is required by a lot of people now, so I do not think this particular issue is a problem.
I have been self hosting my my personal email (and for family). Few problems so far other than delivery to MS and I have recently moved a domain I use for work email over.
Oddly enough the MS problems come from hotmail, but not other services. If that is a problem, then pay a bit to have email delivered.