I received an oddly formatted email claiming that I need to re-attest my network access for Microsoft's Smart Network Data Services (SNDS). The message passed SPF and DKIM, and the included link uses an aka.ms address that leads to an SNDS re-attestation page. It also displays the real public IP address of our mail server. Is this a legitimate Microsoft request, and what does the reference to year 0001 mean?
4 Answers
The fact that the message includes the actual mail-server IP does not prove it is safe, since that information can be obtained from mail headers and DNS. However, if the URL resolves to Microsoft’s official SNDS service and the authentication headers are consistent, the request is likely real. I would navigate to the service manually, avoid entering credentials through the email, and confirm the request from there.
Check the complete authentication results, especially whether DMARC passed and whether DKIM was aligned with the visible sender domain. A message can pass SPF while still failing alignment or coming from an unexpected Microsoft service. In this case, reports of valid SPF and DMARC, along with delivery through Microsoft’s notification infrastructure, make a compromised sender less likely, though the email still looks like a poorly assembled template.
The link appears to lead to Microsoft’s legitimate SNDS service, and several people reported receiving the same notification with valid SPF, DMARC, or DKIM results. The message is probably a genuine Microsoft-generated email, but its terrible formatting makes it look like phishing. It’s still safer to open the SNDS site directly rather than clicking the email link and verify the IP and account details there.
SNDS is Microsoft’s system for monitoring sending IP reputation and mail delivery. A re-attestation request can ask the owner of an IP range to confirm that they still control or operate it. The year 0001 is likely a Microsoft date-handling or template bug—often what appears when a required date field is missing or initialized to the minimum supported date—not a real deadline in the year 1.
That makes sense. The authentication results and the destination looked valid, but the formatting was alarming enough that I wanted confirmation before doing anything.