Why Microsoft 365 Delivers Spoofed Emails Despite DMARC Reject Policy
Question details
The user wants to understand why spoofed emails are being delivered to the Junk folder in Microsoft 365 even when the sending domain has a DMARC p=reject policy configured.
- Product
- Microsoft 365
- Device & OS
- not provided
- Scenario
- Managing Microsoft 365 inbound email security, authentication, and DMARC enforcement.
- Observed behavior
- Spoofed emails bypass the DMARC p=reject policy and are delivered to the Junk Email folder instead of being completely rejected by the server.
Ensure you have administrator access to the Microsoft 365 Defender portal and Exchange Admin Center to review email headers and security configurations.
Review Message Headers and Authentication Results
Analyze the internet message headers of the spoofed email to determine how Microsoft 365 evaluated the SPF, DKIM, and DMARC records.
A DMARC p=reject policy is treated as a request by receiving systems like Microsoft 365. Enforcement depends on SPF and DKIM alignment, as well as local inbound protection policies. Reviewing headers clarifies why the message bypassed rejection.
Locate the delivered spoofed email in the user's Junk Email folder or quarantine.
Open the email, navigate to the message properties or details section, and copy the complete internet message headers.
Look for the 'Authentication-Results' header. Check the outcomes for SPF, DKIM, and DMARC to see if they passed, failed, or were bypassed.
Ensure that the domain identifiers evaluated by SPF and DKIM align perfectly with the visible 'From' address in the header.
Check Microsoft 365 Threat and Mail-Flow Policies
Verify that your local Exchange and Defender policies are not overriding DMARC failures and routing messages to the Junk folder.
Looking for a fast, lightweight alternative to Microsoft Office?
While you manage complex enterprise email security in Microsoft 365, you can empower your team with WPS Office for everyday document tasks. It's a free, lightweight, and highly compatible office suite designed to streamline productivity.
- 1. Visit the official website: Go to the official WPS Office website to access the latest secure download.
- 2. Download for your OS: Click the Free Download button tailored for Windows, Mac, or Linux.
- 3. Install and collaborate: Run the installer and instantly open your existing Microsoft Office files with no format loss.
Frequently Asked Questions
What does a DMARC p=reject policy actually do?
A p=reject policy explicitly requests that receiving email servers reject any messages that fail DMARC authentication. However, receiving servers (like Microsoft 365) treat this as a strong recommendation and may weigh it against other local threat signals, reputation scores, or custom policies before taking action.
Why do spoofed emails go to the Junk folder instead of being completely dropped?
Microsoft 365 often routes DMARC-failed emails to the Junk folder or Quarantine if local anti-spam, anti-phishing, or impersonation policies determine it is safer to hold the email rather than reject it outright. This layered approach helps administrators prevent legitimate emails (false positives) from being permanently lost.
How can I force Microsoft 365 to strictly honor DMARC reject policies?
You can configure Microsoft 365 Defender anti-phishing policies to handle DMARC failures more strictly. Within the Threat Policies section, you can specify the exact action to take when a message fails DMARC validation, choosing to explicitly reject the message or move it directly to quarantine.
