Microsoft 365 administrators have been issued fresh guidance to avoid falling foul of new anti-spam policies introduced by Google.
Google unveiled a raft of changes last week for bulk senders on Gmail that aim to improve security for users.
The new rules, due to come into effect in February 2024, will require organizations that send over 5,000 daily emails to implement SPF/DKIM and DMARC email authentication for domains.
Bulk senders will also be required to provide recipients with easily accessible ‘one-click’ options to unsubscribe from email correspondence.
Google said the changes aim to improve security for users and tackle phishing attacks.
In its advisory, Microsoft warned administrators that failure to adhere to the new authentication standards risks having communications marked as spam.
“By setting up email authentication for your domain, you can ensure that your messages are less likely to be rejected or marked as spam by email providers like Gmail, Yahoo, AOL, [or] Outlook.com,” Microsoft said.
“This is especially important when sending bulk email (large volume email), as it helps maintain the deliverability and reputation of your email campaigns.”
Microsoft 365 anti-spam advice
Microsoft’s advisory noted that using its 365 platform to send mass emails is ill-advised anyway and could result in users being penalized.
“EOP (Exchange Online Protection) has strict outbound spam controls that can block or segregate your email to a special high-risk delivery pool if it exceeds sending limits.,” the advisory warned.
”Using Microsoft 365 to send bulk (mass) email is not a supported use of the service.”
For users sending bulk emails outside of EOP, the advisory recommended sending bulk emails through on-premise email servers. Additionally, it recommended using third-party bulk email providers for mass email activities.
“These companies have a vested interest in working with customers to ensure good email sending practices,” the advisory noted.
RELATED RESOURCE
Cyber-resilient infrastructure starts with server security
Transform revenue operations through data-driven decision-making.
DOWNLOAD FOR FREE
For users choosing to send bulk emails using EOP, Microsoft outlined a series of outbound spam protection recommendations.
This included avoiding sending a “large rate or volume” of emails that causes users to run afoul of sending limits offered by the service.
The guidance added that this includes not sending correspondence to large volumes of recipients using the bcc field.
“Avoid using addresses in your primary email domain (for example, contoso.com) as senders for bulk email,” the advisory added. “Doing so can affect the delivery of regular email from senders in the domain.”
Microsoft also recommended custom subdomains for bulk emails, but warned that these must be configured with email authentication records in DNS, which includes SPF, DKIM, and DMARC.
-
The Race Is On for Higher Ed to Adapt: Equity in Hyflex Learning -
Google faces 'first of its kind' class action for search ads overcharging in UKNews Google faces a "first of its kind" £5 billion lawsuit in the UK over accusations it has a monopoly in digital advertising that allows it to overcharge customers.
-
Healthcare organizations need to shake up email security practicesNews Microsoft 365 is the source of almost half of all healthcare email breaches, thanks mainly to misconfigurations in security settings.
-
Hackers are on a huge Microsoft 365 password spraying spree – here’s what you need to knowNews A botnet made up of 130,000 compromised devices has been conducting a huge password spraying campaign targeting Microsoft 365 accounts.
-
Hackers are using Microsoft Teams to conduct “email bombing” attacksNews Experts told ITPro that tactics like this are on the rise, and employees must be trained effectively
-
Number of attacks using Microsoft Office files surges in 2023News Attacks using popular Microsoft Office file types have increased in 2023
-
Microsoft Security Copilot to offer raft of “new capabilities” for 365 DefenderNews Microsoft Security Copilot will give 365 Defender users real-time malware tracking and automated incident summaries
-
Microsoft SQL password-guessing attacks rising as hackers pivot from OneNote vectorsNews Database admins are advised to enforce better controls as attacks ending in ransomware are being observed
-
Defence in depth: Closing the gaps in Microsoft 365 securityWhitepaper Exploring the security challenges facing organisations with a reliance on Microsoft 365
-
Google launches dark web monitoring tools for US Gmail usersNews First launched for Google One customers, the dark web report service is rolling out to all US-based Gmail users
