Outlook emails not deliverable to yahoo and aol

1st record to create:

Record type: CNAME

Name: selector1._domainkey

Value/Data: (whatever was in the text that popped up, should look like below)

selector1-<your_custom_domain>-com._domainkey.<your_OnMicrosoft_domain>.com

2nd record to create:

Record type: CNAME

Name: selector2._domainkey

Value/Data: (whatever was in the 2nd record in the text that popped up, should look like below)

selector2-<your_custom_domain>-com._domainkey.<your_OnMicrosoft_domain>.com

I think this is clearer

selector1-<CustomDomain>-com._domainkey.<CustomDomain>.onmicrosoft.com
selector2-<CustomDomain>-com._domainkey.<CustomDomain>.onmicrosoft.com

Assuming your domain name ends with .com, replace <CustomDomain> with your domain name (without the .com)

Quickest way to get to DKIM settings: https://security.microsoft.com/authentication?viewid=DKIM

OK - THIS VERY LONG REPLY IS MEANT TO ANSWER THIS FOR EVERYONE AND SHOULD TELL YOU WHAT TO DO STEP BY STEP. THIS IS CONFIRMED TO WORK WITH GODADDY M365 AS WELL, JUST FOLLOW THE INSTRUCTIONS.

(please provide feedback if there is an error in my steps and I'll adjust and re-post and/or just edit, if you have issues following these steps, you must tell us your domain name)

PRELIMINARY STEPS

This post should contain all the steps for you to create SPF, DMARC, and DKIM records needed to fix mail flow issues from custom M365 domains to Yahoo/Aol hosted domains. This only applies to people whose email is hosted by M365

You need access to your domain DNS records and your M365 security admin center.

Get familiar with the MX Toolbox “SuperTool”. Google search SPF lookup and click on the result for MX Toolbox, we will use this site to check your records as you enter them.

Most DNS entries will update within a minute or 2, but some DNS hosts might take longer (Network Solutions has been slow historically). If the DNS checks at MX Toolbox don’t update, give it up to 15-20 minutes.

-----SPF-----

The universal Microsoft 365 SPF record is –

v=spf1 include:spf.protection.outlook.com ~all

(under certain circumstances, you might have more info on that line, but minimally you must have the include:spf.protection.outlook.com ~all entry)

Check your SPF record by filling in your domain name at the MX Toolbox site. Once there, put in your domain name and lookup your SPF record.

If you do not have any SPF record at all, log in to your DNS provider, create a TXT record, the name is either blank or @, the value is the one listed above, starting with v=. Save it, give it a few minutes and confirm the correct record now shows up in the MX Toolbox checker when you re-run the check.

If you already had an SPF record, but it is wrong, do NOT create another one, you are only allowed 1. You have to find the existing SPF TXT record and edit it, and then confirm in the MX Toolbox checker.

-----DMARC-----

Once SPF is setup, we need to create the DMARC record. Use the MX Toolbox to check for an existing DMARC record…leave your domain name filled in and click on the drop down arrow next to “SPF Record Lookup” and select “DMARC Lookup” and click the button.

There are many options in creating a DMARC record, but the following one is generic enough that you should be able to use it. You’ll need to fill in the <email_address_for_reports> with a valid email address on your domain, without the <> brackets.

Back in your DNS records, create a new TXT record if you do not have a DMARC already.

The Name is _dmarc

The value/data is –

v=DMARC1; p=quarantine; rua=mailto:<email_address_for_reports>; pct=100; aspf=r; adkim=r

(again, fill in the email address on your domain that you want to use for the <email…> section. If you don’t want to use your email, you can easily create a shared mailbox, name it Postmaster, and give it an email address of postmaster@ and select your domain. I’m not going to get into details on how to setup a shared mailbox, it is pretty easy in the exchange admin center – mailboxes – Create shared mailbox button. NOTE: shared mailboxes do not require a license, so it doesn’t cost you anything to create it)

If you already have a dmarc record and MX toolbox says it is valid, you can skip this step for now, but if you still have issues once we are all done, you could try editing it and use my sample record rather than what’s in there.

After creating the record, use the MX Toolbox checker to make sure it is valid.

------DKIM – PART 1 – M365-----

Log into M365 admin center, and click on “show all” then go to the Security admin center. If you purchased M365 from a discount provider, you might need to login to admin.exchange.microsoft.com and then once logged in, open a new tab and type in security.microsoft.com and it should automatically log you into the security admin center.

In the Security Admin Center (Microsoft Defender), under Email & Collaboration, click on Policies and Rules. Then click on Threat Policies, then under Rules, click Email Authentication Settings. Click DKIM at the top, make note of your “onmicrosoft” domain name, we’ll need it later. It should say it is your “Default Signing Domain” and this is fine. Click on the onmicrosoft domain name and make sure DKIM is enabled, if not, go ahead and enable it. Once enabled, it will give you some DNS entries, but we don’t use those as those are for the onmicrosoft domain, which Microsoft handles.

Next, click on your own custom domain name. If it says “No DKIM keys…” click on “Create DKIM keys” and then it will give you a popup with the DNS entries that you need to create. Copy those DNS entries into a document or text file to make sure you have them, then you can close out of this screen without enabling DKIM for now. If you do not have a prompt to “Create DKIM Keys, and you only have a slide bar to enable them, go ahead and try to enable. You WILL get a “Client Error” box, and this dialog box will tell you the DNS entries we need. Copy all of this text into a document that we’ll reference later. It won’t let you save it, so you can just click ok and close out for now with it still disabled.

-----DKIM – PART 2 – DNS ENTRIES-----

Back in your DNS records, you will need to create 2 CNAME dns entries that were provided to you in the previous step that you should have copied into a document. The “Name” will be the same for everyone, the Value/Data will be different for everyone. The info comes from the DKIM or Client Error dialog box, and when you dig into it, it should be in the format shown below, substituting your own domain name and your OnMicrosoft domain name as needed. Don’t include the <>. Also if your domain is not a .com then the first part where it shows your_domain-com will be -org or -net or -whatever your domain ends in. The OnMicrosoft domain will always end in .com. Again, you won’t have to type this info in, you’ll just have to extract it from the text we copied from the popup in the security admin center.

1st record to create:

Record type: CNAME

Name: selector1._domainkey

Value/Data: (whatever was in the text that popped up, should look like below)

selector1-<your_custom_domain>-com._domainkey.<your_OnMicrosoft_domain>.com

2nd record to create:

Record type: CNAME

Name: selector2._domainkey

Value/Data: (whatever was in the 2nd record in the text that popped up, should look like below)

selector2-<your_custom_domain>-com._domainkey.<your_OnMicrosoft_domain>.com

(best if you are copying and pasting from the DKIM or “Client Error” popup, just make sure you don’t get any extra spaces)

Now, after you create those records, you go back where we were in the M365 Security Admin center and enable DKIM for your custom domain. NOTE: DNS records might take a few minutes, Network Solutions is especially slow, so after creating the DNS, give it a few minutes before you try to enable. If you keep getting errors after 15-20 minutes double check that the settings shown in the Pop up EXACTLY match what you created in DNS.

If you were able to successfully enable DKIM on your domain, give it 2-3 minutes, then we can check it back in MX Toolbox. Select DKIM from the orange drop down. However, for your domain name, we need to tell it the selector to use, so the value you look up will be like this –

yourdomain.com:selector1

At this point, your issues should be resolved. You can send a test message to a yahoo email address and it should go through. FYI – for my test emails I was seeing a 3-5 minute lag on them, but they always went through, so I’m calling that good.

-Brad

B/c that is the correct spf record for my godaddy managed o365 mail. i failed to realize this may be different for different o365 tenants/providers. i assumed it would all be the same b/c it was all o365.

This is what confuses us (mail admins)... changing requirements dynamically. Do you have an article on this "new" requirement?

Nope. I only know it because I have enough customers on various domains and platforms that when it is affecting all of them, I can deduce that yahoo changed it. Since my clients that are running on private exchange servers are not affected, it might be that M365 hosted domains are subject to tougher rules due to the volume of emails that come from those servers. (Yahoo public statement was that everyone needed a minimum of SPF or DKIM, but bulk senders needed both along with DMARC).

My solution previously was to implement SPF, and turn off DKIM on M365. The other possibility of what happened is Microsoft might have gone through and Enabled DKIM on their M365 tenants that didn't have it turned on to try to assist. I found this to be the case on one of my domains. (I had turned off DKIM, but today I found it on). Turning DKIM on without DMARC being setup properly could be the cause of issues for some people, but I'm not going to post turning DKIM off as a solution anymore, since that might not be a permanent solution.

I've fixed 5 M365 Tenants at this point, still have 7 to go.

-Brad

HI EVERYONE,

It seems that on Friday Yahoo moved to goalpost on what was required for sending them emails (again). My private exchange server customers don't have any issues once SPF is implemented, but M365 are going to need the whole kit and kaboodle.

This is what confuses us (mail admins)... changing requirements dynamically. Do you have an article on this "new" requirement?