Microsoft 365 administrators have been issued fresh guidance to avoid falling foul of new anti-spam policies introduced by Google.
Google unveiled a raft of changes last week for bulk senders on Gmail that aim to improve security for users.
The new rules, due to come into effect in February 2024, will require organizations that send over 5,000 daily emails to implement SPF/DKIM and DMARC email authentication for domains.
Bulk senders will also be required to provide recipients with easily accessible ‘one-click’ options to unsubscribe from email correspondence.
Google said the changes aim to improve security for users and tackle phishing attacks.
In its advisory, Microsoft warned administrators that failure to adhere to the new authentication standards risks having communications marked as spam.
“By setting up email authentication for your domain, you can ensure that your messages are less likely to be rejected or marked as spam by email providers like Gmail, Yahoo, AOL, [or] Outlook.com,” Microsoft said.
“This is especially important when sending bulk email (large volume email), as it helps maintain the deliverability and reputation of your email campaigns.”
Microsoft 365 anti-spam advice
Microsoft’s advisory noted that using its 365 platform to send mass emails is ill-advised anyway and could result in users being penalized.
“EOP (Exchange Online Protection) has strict outbound spam controls that can block or segregate your email to a special high-risk delivery pool if it exceeds sending limits.,” the advisory warned.
”Using Microsoft 365 to send bulk (mass) email is not a supported use of the service.”
For users sending bulk emails outside of EOP, the advisory recommended sending bulk emails through on-premise email servers. Additionally, it recommended using third-party bulk email providers for mass email activities.
“These companies have a vested interest in working with customers to ensure good email sending practices,” the advisory noted.
RELATED RESOURCE
Cyber-resilient infrastructure starts with server security
Transform revenue operations through data-driven decision-making.
DOWNLOAD FOR FREE
For users choosing to send bulk emails using EOP, Microsoft outlined a series of outbound spam protection recommendations.
This included avoiding sending a “large rate or volume” of emails that causes users to run afoul of sending limits offered by the service.
The guidance added that this includes not sending correspondence to large volumes of recipients using the bcc field.
“Avoid using addresses in your primary email domain (for example, contoso.com) as senders for bulk email,” the advisory added. “Doing so can affect the delivery of regular email from senders in the domain.”
Microsoft also recommended custom subdomains for bulk emails, but warned that these must be configured with email authentication records in DNS, which includes SPF, DKIM, and DMARC.
-
Cloudflare is cracking down on AI web scrapersNews Cloudflare CEO Matthew Prince said AI companies have been "scraping content without limits" - now the company is cracking down.
-
Swiss government data published following supply chain attack – here’s what we know about the culpritsNews Radix, a non-profit organization in the health promotion sector, supplies a number of federal offices, whose data has apparently been accessed.
-
Hackers are using Microsoft 365 features to bombard enterprises with phishing emails – and they’ve already hit more than 70 organizationsNews A new phishing campaign uncovered by researchers at Varonis shows threat actors are abusing Microsoft 365's Direct Send feature to launch phishing attacks.
-
Healthcare organizations need to shake up email security practices
News Microsoft 365 is the source of almost half of all healthcare email breaches, thanks mainly to misconfigurations in security settings.
-
Hackers are on a huge Microsoft 365 password spraying spree – here’s what you need to knowNews A botnet made up of 130,000 compromised devices has been conducting a huge password spraying campaign targeting Microsoft 365 accounts.
-
Hackers are using Microsoft Teams to conduct “email bombing” attacksNews Experts told ITPro that tactics like this are on the rise, and employees must be trained effectively
-
Number of attacks using Microsoft Office files surges in 2023News Attacks using popular Microsoft Office file types have increased in 2023
-
Microsoft Security Copilot to offer raft of “new capabilities” for 365 DefenderNews Microsoft Security Copilot will give 365 Defender users real-time malware tracking and automated incident summaries
-
Microsoft SQL password-guessing attacks rising as hackers pivot from OneNote vectorsNews Database admins are advised to enforce better controls as attacks ending in ransomware are being observed
-
Defence in depth: Closing the gaps in Microsoft 365 securityWhitepaper Exploring the security challenges facing organisations with a reliance on Microsoft 365
