From address doesn't meet the authentication requirements defined for the sender

[#1]

SEE REPLY #745

[#2]

DMARC= Fail [ZR2P278MB0986.CHEP278.PROD.OUTLOOK.COM 2025-10-07T16:16:15.600Z 08DE035E89109706] [DU2PR04CA0298.eurprd04.prod.outlook.com 2025-10-07T16:16:15.610Z 08DE03C375A61F76] [DU2PEPF00028D08.eurprd03.prod.outlook.com 2025-10-07T16:16:15.610Z 08DE0367A33C61E1]

[#3]

That is a fail by the M$ system - already documented/explained on here. DMARC is implemented on the outbound servers at PN.

[#4]

@jkg 

All that you cover in your long posts has been in place from a fair while back.

In the specific matter of this thread, Microsoft accepts delivery of emails from Plusnet ticking all of the boxes you refer to is there is a single addressee; if there are multiple Microsoft addressees it is rejected by some Microsoft domains, but rejected by other suggesting a DKIM failure, unless it is sent from webmail (possibly other email clients) or is in plain text.

There is no smoking gun to clearly indicate the source of this issue.  If the ticked boxes work for a single addressee, they should work for multiple addressees exactly the same.

[#5]

@Townman 

In addition, is Microsoft still lumping all ....@username.plus.com addresses together, as if they were one single high-volume sender (>5000 emails per day)?  And then imposing higher anti-spam standards on them, which Plusnet does not meet (and shouldn't have to unless a specific username is sending a high volume)?

While that by itself doesn't explain the other weird behaviours observed, it could be a factor in why they hit Plusnet rather than more conventional consumer email providers, where the username is before the '@' symbol rather than after.

Hypothesis: perhaps MS know that, say, ....@gmail.com is a legitimate high-volume sender, so they check the username before the '@' symbol before deciding they need to enforce stricter >5000/day anti-spam measures.  But no-one has told their algorithm that in the case of plus.com, they need to check for a username after the '@' before deciding.

This is still not a full explanation: why can they not just look at the full @username.plus.com?  Though factors like single addressees being less susceptible than multiple could be part of their anti-spam scoring.

[#6]

@Tim-J 

Hi Tim,

The tenants of your post are fairly sound...

• Microsoft treats all sub-domains to be part of the root domain for the purposes of counting bulk senders, not just for Plusnet but everywhere as in *.sch.uk / *.nhs.uk / *.gov.uk etc
• Plusnet DOES meet the published requirement for high volume users - SPF / DKIM / DMARC
• There is a shadow of grey in respect of a recommendation that high volume user should consider having a clear unsubscribe link in all of their emails sent to 'distribution' lists**
• I have seen no evidence that MS looks at the whole email address to determine the bulk sender in respect of @gamil.com and other similar non-personal-sub-domain email address service

One could ask many questions around "why does MS not doing something which looks ore sensible" - the answer probably is because they are big enough to get away with it!

**I raise the matter of the unsubscribe recommendation (it has not been aired much around here) as it is the only recommendation in the Microsoft rule book which is not (would not be) implemented (by Plusnet).

See Strengthening Email Ecosystem: Outlook’s New Requirements for High‐Volume Senders | Microsoft Commun...Requirements for bulk senders - Dynamics 365 Customer Insights | Microsoft Learn

Large senders should also adopt these practices to maintain quality and trust:

• Functional Unsubscribe Links: Provide an easy, clearly visible way for recipients to opt out of further messages, particularly for marketing or bulk mail. 

This states "should" not "must" and therefore deem it as just a recommendation.  If one were to consider this recommendation, it is something EVERY individual user would need to craft into EVERY email.  Such is clearly non-sensical ... but it does look suspect when one considers that subsequent to getting all of the required rules in place, the only delivery failures relate to sending to multiple addresses ... as one would do in sending to a (marketing) email list.

Whilst looking for the above I found various articles which somewhat suggest that unsubscribe might in fact be mandated ... but even if it were, one would hope that the error event was not a random DKIM failure ... which works fine if there is a single addressee.

[#7]

@Townman 

Thank you for being on the case, as always.

To add to your recent posts, in my experience, if there are multiple Microsoft addressees there is no pattern to which ones will be rejected. For example, in #377 I reported sending an HTML email to 17 MS-related addresses (plus others) comprised of:

13 hotmail, 1 outlook, 1 live, 2 msn

And received 13 rejections:

9 hotmail, 1 outlook, 1 live, 1 msn

Implying that 5 emails were actually delivered.

At that time, the workaround was to compose emails as plain text but since then various Plusnet outbound servers (avasout) have been put on block lists so of course even plain text emails get bounced now and adding an ‘unsubscribe’ link (a ludicrous requirement) won’t have any effect either.

It has been said many times that this is all Microsoft’s fault and that they have not relented. However, Plusnet has still never given any indication whether any progress is being made to get the situation improved e.g. by getting their servers off block lists. Furthermore, and equally worrying, there is no indication that they are going to hold back on migrating affected users (essentially everyone with a subdomain in their email address) to Greenby before the problems are solved.

[#8]

@abitpedantic 

Indeed, what was a comparatively simple issue with Microsoft playing silly beggars, has become fairly complex in that a real spam reputation issue has over shadowed everything.  The black lists seem to be at both individual user level and core server level.

Following the usual profile of removing resources from black lists, the issues first need to be shown to have been fixed.  I suspect (I have no grounds for knowing) that getting the various spam generators closed down is proving challenging.

[#9]

https://community.plus.net/t5/forums/replypage/board-id/Email/message-id/745 ?

Or how else to access?

[#10]

Where are you expecting this to go to?

[#11]

Wish I knew, @Townman - every time I click the link, it tells me it is read-only and won't let me access it, so I've no idea what our resident expert is on about.

[#12]

"SEE REPLY #745"

Well, how will people see that?

[#13]

Just asking a question, which may be dumb, but seeking.

[#14]

To link to message 745 ... 

Put the mouse over the  Message <number>  E.g 745 and from the right click choose copy link.

I used the Insert/edit link function to create : Jump to #745 

[#15]

Thanks, Philip - why he has to make life so complicated I have absolutely no idea, and I still can't work out what he was trying to achieve?