How to handle Microsoft treating DMARC reject policy as quarantine?

Email Marketer from StackExchange explains that enforcing DMARC policies depends on the receiver's implementation, and some treat 'reject' as 'quarantine' to avoid losing legitimate emails due to misconfiguration.

Email Marketer from Unlock The Inbox suggests monitoring your DMARC reports to identify legitimate emails that are failing authentication. Based on the report, you can improve SPF records, DKIM keys, and DMARC records.

Email Marketer from Mailhardener explains that while a DMARC policy of reject should instruct receivers to reject non-compliant messages, Microsoft might quarantine them instead to avoid blocking legitimate emails due to misconfigurations or other issues.

Email Marketer from Word to the Wise explains the changes with authentication at Office365.

Email Marketer from Reddit shares Microsoft's actions are designed to protect users, as they prioritize avoiding false negatives (missing valid emails) over strictly adhering to DMARC policies.

Email Marketer from Mailjet explains that even with a 'reject' policy, some ISPs might quarantine emails instead, giving recipients a chance to review them. This decision falls on the ISP's discretion.

Email Marketer from EmailGeek recommends creating an Exchange rule to reject emails that fail DMARC checks, to prevent Microsoft from treating a 'reject' policy as 'quarantine.'

Marketer from Email Geeks shares that Microsoft often disregards DMARC policies, treating reject as quarantine, and not sending aggregate reports, and suggests creating an Exchange rule to reject emails failing DMARC and voting for DMARC aggregate reports in UserVoice.

Email Marketer from EmailSecuritySPF advises ensuring that your SPF and DKIM records are correctly configured and aligned. Regularly review DMARC reports to understand what's happening with your email and adjust accordingly.

Email Marketer from Email Reddit points out it's critical to carefully set up SPF and DKIM to prevent legitimate emails from failing DMARC and being quarantined.

Email Marketer from Email Forum suggests it is important to advocate for alignment and advocate for it with clients. Also that abrupt changes from MS without good communication are not ideal.

Expert from Word to the Wise discusses the changes in how Microsoft handles authentication for inbound mail to Office 365, explaining that Microsoft has made changes that affect the authentication landscape and how email is handled, especially for those using DMARC.

Expert from Email Geeks shares that a DMARC policy provides information and is at most a request, not a command.

Expert from Email Geeks explains that folks have spoken directly with Microsoft O365 responsible parties who have confirmed they are enforcing alignment and will spam folder anything that doesn’t align *on the office365 platform*.

Expert from Email Geeks explains that what senders can do about phishing using their identity will depend a lot on the details of the brand and what behavior they're seeing.

Expert from Email Geeks says that Microsoft has always done its own thing with authentication, forcing others to work around it.

Expert from Word to the Wise discusses that Microsoft's changes may cause mail sent through forwarders, such as mailing lists, to be delivered to the junk folder, as forwarded messages often fail authentication checks.

Expert from Email Geeks shares that on the O365 side, anything that isn’t aligned (with or without DMARC) gets thrown into the spam folder.

Expert from Email Geeks shares that the two best parts of DMARC are the concept of alignment for authentication and reporting, while Steve Atkins (WttW) says that there are reasonable times to have a DMARC policy and no reporting, but DMARC brings minimal value in most cases, breaks a lot of things, and costs a lot of money

Documentation from SocketLabs Blog explains that Microsoft started routing unaligned mail that comes into O365 hosted clients into the spam folder regardless.

Documentation from Google Workspace Admin Help mentions that DMARC policies are guidelines for how recipient servers should handle emails that fail authentication. However, the ultimate decision rests with the recipient server.

Documentation from DMARC.org states that DMARC policies are requests, not commands, and receivers ultimately decide how to handle messages that fail DMARC checks.

Documentation from Microsoft Docs explains that Microsoft 365 quarantines messages that fail DMARC when the sender's domain has a DMARC policy of p=reject, because some legitimate email may fail DMARC.