I am having issue that Yahoo emails are not reaching recipients.

Of course, you can always add an SPF record on an in-house server but it's completely redundant. There's no reason to look up an SPF when the reverse PTR matches the sender's domain. That's how Yahoo knows that Microsoft (or any other third party) is sending the email on behalf of the sender. When it doesn't match, that's when the SPF is needed. A properly configured in-house server has a static IP along with a reverse PTR. Adding an SPF isn't necessary.

Most of the issues that occurred earlier this year (and some still) affect domains using third party servers without a proper SPF. According to all three major free email services, AOL, Gmail and Yahoo, the DMARC and DKIM requirements are still specified for companies that send more than 5000 emails/day. In fact, I tested multiple Microsoft account domains without DMARC - just SPF and DKIM and the email is received fine. Sent O365 mail to Gmail with just SPF successfully as well.

There's no consistency with Yahoo/AOL's new requirement. If they're considering Microsoft 'bulk' then why doesn't mail bounce without DMARC? Why doesn't Gmail bounce without DKIM or DMARC?

I miss the days when you can have an open SMTP server and nobody abused it.

>> SPF isn't necessary if you're sending from your own server anyway

SPF record lists all servers (or IPs) authorized to send email on behalf of your (private) domain name. I don't see why you don't need SPF if you host your own mail server. Without it spammers can spoof your domain name to send spam from their SMTP servers (or botnets). I used to host my own Exchange server and I created an SPF record for the company domain. That tells recipient SMTP servers my email can only come from these authorized IPs (defined in the SPF). Whether or not recipient's SMTP servers verify SPF record is another story.

>> But from what I see, this is clearly an issue between Microsoft and Yahoo and its cohorts (AOL, Verizon, etc.).

That's incorrect. Some users don't even use Microsoft hosting service and their email are still rejected (due to invalid or missing records). That's why I said I don't see Microsoft hosting service as part of the problem. It's DNS record problem. It isn't mail hosting service or company.

I don't know what you've seen but I have a number of clients using various email services and in-house mail servers that have no problem sending to Yahoo without DKIM. SPF isn't necessary if you're sending from your own server anyway (of course, there are other requirements like Reverse PTR, proper HELO statements). But from what I see, this is clearly an issue between Microsoft and Yahoo and its cohorts (AOL, Verizon, etc.).

It has always been a free-for-all when it comes to security requirements when sending to various mail servers. There are hundreds of blacklists that can be subscribed to. Most servers don't validate against more than three. Which three? Exactly. Then there's the heuristics. Yet another black hole.

If you look at Yahoo's "Sender Best Practices" they still state that SPF *or* DKIM is required for non-bulk senders. None of my clients send bulk mail through their official email domain.

I don't mind increasing security but I'm not a fan of these companies moving the goal posts without sufficient warning.

I don't see Microsoft mail hosting service as a factor in this problem. The root cause of the problem is custom or private domain names not having correct DNS records and recipient's SMTP servers recent change to enforce those records. The mail hosting service can be any company... Microsoft, Google or any 3rd party mail hosting company or yourself if you host an on-premise mail servers.

Microsoft says it's not their issue. Yahoo is requiring additional security from senders to their service. Why and why all of a sudden is the question.

Implementing DKIM on the Microsoft side and adding the DNS records on the sender's domain DNS fixes the problem.