Exchange Online suddenly stopped receiving messages from some services, including PaperCut. The sender receives this error: "550 5.7.509 Access denied — sending domain papercut.com does not pass DMARC verification and has a DMARC policy of reject." Was Microsoft recently changed to enforce DMARC more strictly, or is this more likely a problem with PaperCut's SPF/DKIM configuration or an intermediate mail relay?
3 Answers
Exchange Online has supported DMARC enforcement for a long time, so this probably isn’t a new Microsoft-wide switch. PaperCut’s domain is publishing a reject policy, and the message is likely failing both aligned SPF and DKIM. A change on the sender’s side—or a relay or forwarding service in the delivery path—could have caused the failure. The sender needs to correct its authentication and alignment rather than the recipient simply bypassing DMARC.
The useful evidence would be in the Authentication-Results headers from an older successful message or a bounce. Check whether SPF passed and aligned with the visible From domain, and whether DKIM passed with an aligned signing domain. If either authentication method fails, DMARC can reject the message. Since these messages never arrive, ask the sending service to inspect its outbound logs and headers.
Microsoft’s default anti-phishing behavior honors a sender’s DMARC policy when the sender publishes p=reject. That behavior wasn’t suddenly enabled overnight. First rule out any current Exchange Online service incident, but the error strongly suggests PaperCut or a mail relay changed something. A temporary allow rule might work as a workaround, but it would only hide the sender’s authentication problem and should not be the long-term fix.
I’m not trying to bypass the policy; I’m only the recipient. The question is whether Microsoft changed enforcement recently, but it sounds more likely that PaperCut’s authentication or delivery path changed.