Microsoft 365: The Fisher-Price IT Edition
Most organisations do not run their own mail server. They pay Microsoft, and Exchange Online does the work. So this post holds Microsoft 365 to exactly the house rules the Postfix and Stalwart builds met, using nothing but Microsoft’s own documentation and read-only DNS against real tenants. Some of the rules it meets well: outbound DANE and MTA-STS are on by default, and inbound DANE with DNSSEC finally went GA. Several it cannot meet at all. There is no documented way to require inbound TLS from every sender, no way to reject an SPF hard fail at the door, nothing that rejects on a failed DKIM signature alone, and no control that drops mail from a sender domain that does not exist. DNSSEC is explicitly not planned for the mail host every tenant actually uses. The IPv6 rollout that was meant to take six months has left the NCSC’s own mailbox unreachable over IPv6 two years on. And the documentation contradicts itself on wildcards, on SPF, and on DNSSEC. This is the platform most of the country’s mail runs on, and this is what it will and will not let you do.