Outlook emails not deliverable to yahoo and aol

This is the exact problem I am having starting last week...to aol and yahoo addresses I had successfully used before. And I was unaware for a while because the notice of being undeliverable went into MY junk holder. Even after I added the Microsoft email address to my safe list in Outlook. HELP.

Go Daddy explained on the phone to me that they are getting a number of complaints about emails not being deliverable to hotmail, yahoo, and aol--all three which use the same server. They are actively working on the problem.

Hi

Good day!

Thank you for posting to Microsoft Community. We are glad to assist.

We are looking into your situation and we need sometime to do further research on this. If it is required, we will consult with our team members for this situation. Will update the thread accordingly.

Appreciate your patience and understanding and thank you for your time and cooperation.

Sincerely,

Microsoft Community

OK - THIS VERY LONG REPLY IS MEANT TO ANSWER THIS FOR EVERYONE AND SHOULD TELL YOU WHAT TO DO STEP BY STEP. THIS IS CONFIRMED TO WORK WITH GODADDY M365 AS WELL, JUST FOLLOW THE INSTRUCTIONS.

(please provide feedback if there is an error in my steps and I'll adjust and re-post and/or just edit, if you have issues following these steps, you must tell us your domain name)

PRELIMINARY STEPS

This post should contain all the steps for you to create SPF, DMARC, and DKIM records needed to fix mail flow issues from custom M365 domains to Yahoo/Aol hosted domains. This only applies to people whose email is hosted by M365

You need access to your domain DNS records and your M365 security admin center.

Get familiar with the MX Toolbox “SuperTool”. Google search SPF lookup and click on the result for MX Toolbox, we will use this site to check your records as you enter them.

Most DNS entries will update within a minute or 2, but some DNS hosts might take longer (Network Solutions has been slow historically). If the DNS checks at MX Toolbox don’t update, give it up to 15-20 minutes.

-----SPF-----

The universal Microsoft 365 SPF record is –

v=spf1 include:spf.protection.outlook.com ~all

(under certain circumstances, you might have more info on that line, but minimally you must have the include:spf.protection.outlook.com ~all entry)

Check your SPF record by filling in your domain name at the MX Toolbox site. Once there, put in your domain name and lookup your SPF record.

If you do not have any SPF record at all, log in to your DNS provider, create a TXT record, the name is either blank or @, the value is the one listed above, starting with v=. Save it, give it a few minutes and confirm the correct record now shows up in the MX Toolbox checker when you re-run the check.

If you already had an SPF record, but it is wrong, do NOT create another one, you are only allowed 1. You have to find the existing SPF TXT record and edit it, and then confirm in the MX Toolbox checker.

-----DMARC-----

Once SPF is setup, we need to create the DMARC record. Use the MX Toolbox to check for an existing DMARC record…leave your domain name filled in and click on the drop down arrow next to “SPF Record Lookup” and select “DMARC Lookup” and click the button.

There are many options in creating a DMARC record, but the following one is generic enough that you should be able to use it. You’ll need to fill in the <email_address_for_reports> with a valid email address on your domain, without the <> brackets.

Back in your DNS records, create a new TXT record if you do not have a DMARC already.

The Name is _dmarc

The value/data is –

v=DMARC1; p=quarantine; rua=mailto:<email_address_for_reports>; pct=100; aspf=r; adkim=r

(again, fill in the email address on your domain that you want to use for the <email…> section. If you don’t want to use your email, you can easily create a shared mailbox, name it Postmaster, and give it an email address of postmaster@ and select your domain. I’m not going to get into details on how to setup a shared mailbox, it is pretty easy in the exchange admin center – mailboxes – Create shared mailbox button. NOTE: shared mailboxes do not require a license, so it doesn’t cost you anything to create it)

If you already have a dmarc record and MX toolbox says it is valid, you can skip this step for now, but if you still have issues once we are all done, you could try editing it and use my sample record rather than what’s in there.

After creating the record, use the MX Toolbox checker to make sure it is valid.

------DKIM – PART 1 – M365-----

Log into M365 admin center, and click on “show all” then go to the Security admin center. If you purchased M365 from a discount provider, you might need to login to admin.exchange.microsoft.com and then once logged in, open a new tab and type in security.microsoft.com and it should automatically log you into the security admin center.

In the Security Admin Center (Microsoft Defender), under Email & Collaboration, click on Policies and Rules. Then click on Threat Policies, then under Rules, click Email Authentication Settings. Click DKIM at the top, make note of your “onmicrosoft” domain name, we’ll need it later. It should say it is your “Default Signing Domain” and this is fine. Click on the onmicrosoft domain name and make sure DKIM is enabled, if not, go ahead and enable it. Once enabled, it will give you some DNS entries, but we don’t use those as those are for the onmicrosoft domain, which Microsoft handles.

Next, click on your own custom domain name. If it says “No DKIM keys…” click on “Create DKIM keys” and then it will give you a popup with the DNS entries that you need to create. Copy those DNS entries into a document or text file to make sure you have them, then you can close out of this screen without enabling DKIM for now. If you do not have a prompt to “Create DKIM Keys, and you only have a slide bar to enable them, go ahead and try to enable. You WILL get a “Client Error” box, and this dialog box will tell you the DNS entries we need. Copy all of this text into a document that we’ll reference later. It won’t let you save it, so you can just click ok and close out for now with it still disabled.

-----DKIM – PART 2 – DNS ENTRIES-----

Back in your DNS records, you will need to create 2 CNAME dns entries that were provided to you in the previous step that you should have copied into a document. The “Name” will be the same for everyone, the Value/Data will be different for everyone. The info comes from the DKIM or Client Error dialog box, and when you dig into it, it should be in the format shown below, substituting your own domain name and your OnMicrosoft domain name as needed. Don’t include the <>. Also if your domain is not a .com then the first part where it shows your_domain-com will be -org or -net or -whatever your domain ends in. The OnMicrosoft domain will always end in .com. Again, you won’t have to type this info in, you’ll just have to extract it from the text we copied from the popup in the security admin center.

1st record to create:

Record type: CNAME

Name: selector1._domainkey

Value/Data: (whatever was in the text that popped up, should look like below)

selector1-<your_custom_domain>-com._domainkey.<your_OnMicrosoft_domain>.com

2nd record to create:

Record type: CNAME

Name: selector2._domainkey

Value/Data: (whatever was in the 2nd record in the text that popped up, should look like below)

selector2-<your_custom_domain>-com._domainkey.<your_OnMicrosoft_domain>.com

(best if you are copying and pasting from the DKIM or “Client Error” popup, just make sure you don’t get any extra spaces)

Now, after you create those records, you go back where we were in the M365 Security Admin center and enable DKIM for your custom domain. NOTE: DNS records might take a few minutes, Network Solutions is especially slow, so after creating the DNS, give it a few minutes before you try to enable. If you keep getting errors after 15-20 minutes double check that the settings shown in the Pop up EXACTLY match what you created in DNS.

If you were able to successfully enable DKIM on your domain, give it 2-3 minutes, then we can check it back in MX Toolbox. Select DKIM from the orange drop down. However, for your domain name, we need to tell it the selector to use, so the value you look up will be like this –

yourdomain.com:selector1

At this point, your issues should be resolved. You can send a test message to a yahoo email address and it should go through. FYI – for my test emails I was seeing a 3-5 minute lag on them, but they always went through, so I’m calling that good.

-Brad

Ok so I have some more information and got two clients of mine working.

First you must have an SPF record the one posted previously is tested working.

Second having multiple SPF records is a problem. Godaddy recommended multiple SPF records at one point and time to fix emails going to a spam folder that is now what's causing this issue.

Third you need a DMARC text record. Godaddy sent me the following article to set this up. https://easydmarc.com/blog/how-to-add-dmarc-record-to-godaddy-in-3-easy-steps/

Hope this is all helpful this was a combination of issues that led me to these three things.