check before: 2024-07-01
Product:
Exchange, Power Automate
Platform:
Online, US Instances, World tenant
Status:
Rolling out
Change type:
Admin impact, New feature, Updated message, User impact
Links:
Details:
Summary:
Microsoft Exchange Online is updating to support inbound SMTP DANE with DNSSEC. Public Preview begins in July 2024, with General Availability rolling out from early September to late October 2024. This feature will be off by default and can be enabled using Exchange PowerShell, with a new experience for enabling without PowerShell coming by the end of 2024. There are specific supported and unsupported domain configurations to consider.
Details:
Updated July 17, 2024: We have updated the rollout timing below. Thank you for your patience.
We are adding support for DNS-based Authentication of Named Entities (or DANE) for SMTP and Domain Name System Security Extensions (DNSSEC) for inbound mail to Exchange Online. DANE for SMTP is a security protocol that uses DNS to verify the authenticity of the certificates used for securing email communication with TLS and protecting against TLS downgrade attacks. DNSSEC is a set of extensions to DNS that provides cryptographic verification of DNS records, preventing DNS-spoofing and adversary-in-the-middle attacks to DNS.
This message is associated with Microsoft 365 Roadmap ID 63213.
[When this will happen:]
Public Preview: We will begin rolling out in July 2024.
General Availability: We begin rolling out early September 2024 (previously late August) and expect to complete by late October 2024 (previously late September).
Change Category:
XXXXXXX ... free basic plan only
Scope:
XXXXXXX ... free basic plan only
Release Phase:
General Availability, Preview
Created:
2024-01-30
updated:
2024-08-10
Public Preview Start Date
XXXXXXX ... free basic plan only
Task Type
XXXXXXX ... free basic plan only
Docu to Check
XXXXXXX ... free basic plan only
MS How does it affect me
XXXXXXX ... free basic plan only
MS Preperations
XXXXXXX ... free basic plan only
MS Urgency
XXXXXXX ... free basic plan only
MS workload name
XXXXXXX ... free basic plan only
linked item details
XXXXXXX ... free basic plan only
summary for non-techies**
Microsoft Exchange Online will support inbound SMTP DANE with DNSSEC starting with a Public Preview in July 2024 and General Availability from early September to late October 2024, initially off by default and enabled via Exchange PowerShell, with a simpler method coming by the end of 2024. Compatibility checks for domain configurations are necessary, and updates to third-party gateways or connectors may be required.
Direct effects for Operations**
Email Delivery Issues
If the feature is enabled without proper domain configuration, it may lead to email delivery failures due to unsupported domain types or misconfigured DNS settings.
- roles: IT Administrator, Email Support Specialist
- references: https://learn.microsoft.com/purview/how-smtp-dane-works?view=o365-worldwide#how-can-exchange-online-customers-use-smtp-dane-inbound, https://techcommunity.microsoft.com/t5/exchange-team-blog/implementing-inbound-smtp-dane-with-dnssec-for-exchange-online/ba-p/3939694
Increased Support Tickets
Users may experience issues with email communication, leading to an increase in support tickets and user frustration if the feature is enabled without adequate preparation.
- roles: Help Desk Technician, IT Support Manager
- references: https://www.microsoft.com/microsoft-365/roadmap?filters=&searchterms=63213, https://techcommunity.microsoft.com/t5/exchange-team-blog/implementing-inbound-smtp-dane-with-dnssec-for-exchange-online/ba-p/3939694
Security Vulnerabilities
Enabling the feature without understanding the limitations may expose the organization to security vulnerabilities, such as DNS spoofing or TLS downgrade attacks if not properly configured.
- roles: Security Analyst, Network Administrator
- references: https://learn.microsoft.com/purview/how-smtp-dane-works?view=o365-worldwide#how-can-exchange-online-customers-use-smtp-dane-inbound, https://techcommunity.microsoft.com/t5/exchange-team-blog/implementing-inbound-smtp-dane-with-dnssec-for-exchange-online/ba-p/3939694
Configutation Options**
XXXXXXX ... paid membership only
Opportunities**
Enhanced Email Security
By enabling DANE with DNSSEC, organizations can significantly improve their email security posture, protecting against TLS downgrade attacks and ensuring the authenticity of certificates used in email communication. This is particularly beneficial for organizations handling sensitive data or communications.
- next-steps: Conduct a risk assessment to determine the impact of enabling DANE with DNSSEC on existing email configurations. Prepare to update domain configurations as necessary and train IT staff on the new security protocols and their implementation.
- roles: IT Security Team, Network Administrators, Compliance Officers
- references: https://learn.microsoft.com/purview/how-smtp-dane-works?view=o365-worldwide#how-can-exchange-online-customers-use-smtp-dane-inbound, https://techcommunity.microsoft.com/t5/exchange-team-blog/implementing-inbound-smtp-dane-with-dnssec-for-exchange-online/ba-p/3939694
Streamlined Domain Configuration Management
The introduction of DNSSEC can lead to better management of domain configurations, reducing the risk of DNS spoofing and ensuring that the email routing is secure and reliable. This can also simplify troubleshooting processes related to email delivery issues.
- next-steps: Review current domain configurations and identify any that may be impacted by the DANE implementation. Create a plan for updating any affected configurations and ensure proper documentation for future reference.
- roles: IT Administrators, Email System Administrators, Network Engineers
- references: https://learn.microsoft.com/purview/how-smtp-dane-works?view=o365-worldwide#how-can-exchange-online-customers-use-smtp-dane-inbound, https://techcommunity.microsoft.com/t5/exchange-team-blog/implementing-inbound-smtp-dane-with-dnssec-for-exchange-online/ba-p/3939694
User Experience Improvement
With the enhanced security measures in place, users can have greater confidence in the integrity of their email communications. This can lead to increased trust in the organization's email system and reduce concerns about phishing or email spoofing attacks.
- next-steps: Communicate the benefits of the new DANE and DNSSEC features to end-users. Provide training sessions or materials to help users understand the importance of these changes and how they enhance email security.
- roles: End Users, IT Support Staff, Communications Team
- references: https://learn.microsoft.com/purview/how-smtp-dane-works?view=o365-worldwide#how-can-exchange-online-customers-use-smtp-dane-inbound, https://techcommunity.microsoft.com/t5/exchange-team-blog/implementing-inbound-smtp-dane-with-dnssec-for-exchange-online/ba-p/3939694
Potentional Risks**
XXXXXXX ... paid membership only
IT Security**
XXXXXXX ... paid membership only
explanation for non-techies**
XXXXXXX ... free basic plan only
** AI generated content. This information must be reviewed before use.
a free basic plan is required to see more details. Sign up here
A cloudsocut.one plan is required to see all the changed details. If you are already a customer, choose login.
If you are new to cloudscout.one please choose a plan.
change history
| Date | Property | old | new |
| 2024-07-18 | MC Last Updated | 06/21/2024 20:09:36 | 2024-07-17T18:09:15Z |
| 2024-07-18 | MC Messages | Updated June 21, 2024: We have updated the rollout timing below. Thank you for your patience.
We are adding support for DNS-based Authentication of Named Entities (or DANE) for SMTP and Domain Name System Security Extensions (DNSSEC) for inbound mail to Exchange Online. DANE for SMTP is a security protocol that uses DNS to verify the authenticity of the certificates used for securing email communication with TLS and protecting against TLS downgrade attacks. DNSSEC is a set of extensions to DNS that provides cryptographic verification of DNS records, preventing DNS-spoofing and adversary-in-the-middle attacks to DNS. This message is associated with Microsoft 365 Roadmap ID 63213. [When this will happen:] Public Preview: We will begin rolling out in July 2024. Standard Release: We begin rolling out late August 2024 (previously late June) and expect to complete by late September 2024 (previously late July). | Updated July 17, 2024: We have updated the rollout timing below. Thank you for your patience.
We are adding support for DNS-based Authentication of Named Entities (or DANE) for SMTP and Domain Name System Security Extensions (DNSSEC) for inbound mail to Exchange Online. DANE for SMTP is a security protocol that uses DNS to verify the authenticity of the certificates used for securing email communication with TLS and protecting against TLS downgrade attacks. DNSSEC is a set of extensions to DNS that provides cryptographic verification of DNS records, preventing DNS-spoofing and adversary-in-the-middle attacks to DNS. This message is associated with Microsoft 365 Roadmap ID 63213. [When this will happen:] Public Preview: We will begin rolling out in July 2024. General Availability: We begin rolling out early September 2024 (previously late August) and expect to complete by late October 2024 (previously late September). |
| 2024-07-18 | MC End Time | 11/04/2024 08:00:00 | 2025-01-13T08:00:00Z |
| 2024-07-18 | MC Summary | Microsoft Exchange Online is updating to support inbound SMTP DANE with DNSSEC. Public Preview begins in July 2024, with Standard Release from late August to late September 2024. The feature will be off by default and can be enabled via Exchange PowerShell, with a new experience coming by end of 2024. Review domain configurations and visit the Microsoft Community Hub for detailed information on limitations and preparation. Roadmap ID: 63213. | Microsoft Exchange Online is updating to support inbound SMTP DANE with DNSSEC. Public Preview begins in July 2024, with General Availability rolling out from early September to late October 2024. This feature will be off by default and can be enabled using Exchange PowerShell, with a new experience for enabling without PowerShell coming by the end of 2024. There are specific supported and unsupported domain configurations to consider. |
| 2024-06-22 | MC Last Updated | 04/15/2024 23:43:58 | 2024-06-21T20:09:36Z |
| 2024-06-22 | MC Messages | Updated April 15, 2024: We have updated the timing of the Preview below. Thank you for your patience.
We are adding support for DNS-based Authentication of Named Entities (or DANE) for SMTP and Domain Name System Security Extensions (DNSSEC) for inbound mail to Exchange Online. DANE for SMTP is a security protocol that uses DNS to verify the authenticity of the certificates used for securing email communication with TLS and protecting against TLS downgrade attacks. DNSSEC is a set of extensions to DNS that provides cryptographic verification of DNS records, preventing DNS-spoofing and adversary-in-the-middle attacks to DNS. This message is associated with Microsoft 365 Roadmap ID 63213. [When this will happen:] Public Preview: We will begin rolling out in May 2024. Standard Release: We begin rolling out late June 2024 and expect to complete by late July 2024. | Updated June 21, 2024: We have updated the rollout timing below. Thank you for your patience.
We are adding support for DNS-based Authentication of Named Entities (or DANE) for SMTP and Domain Name System Security Extensions (DNSSEC) for inbound mail to Exchange Online. DANE for SMTP is a security protocol that uses DNS to verify the authenticity of the certificates used for securing email communication with TLS and protecting against TLS downgrade attacks. DNSSEC is a set of extensions to DNS that provides cryptographic verification of DNS records, preventing DNS-spoofing and adversary-in-the-middle attacks to DNS. This message is associated with Microsoft 365 Roadmap ID 63213. [When this will happen:] Public Preview: We will begin rolling out in July 2024. Standard Release: We begin rolling out late August 2024 (previously late June) and expect to complete by late September 2024 (previously late July). |
| 2024-06-22 | MC End Time | 09/06/2024 09:00:00 | 2024-11-04T08:00:00Z |
| 2024-06-22 | MC Summary | Microsoft Exchange Online will support inbound SMTP DANE with DNSSEC starting from lMay 2024. Inbound SMTP DANE with DNSSEC will be off by default, and if you do not want to enable the feature, you do not need to do anything. If you want to enable the feature, follow the documentation using Exchange PowerShell. Review your domain configuration internally to ensure you won't be impacted by any of the limitations. | Microsoft Exchange Online is updating to support inbound SMTP DANE with DNSSEC. Public Preview begins in July 2024, with Standard Release from late August to late September 2024. The feature will be off by default and can be enabled via Exchange PowerShell, with a new experience coming by end of 2024. Review domain configurations and visit the Microsoft Community Hub for detailed information on limitations and preparation. Roadmap ID: 63213. |
| 2024-04-16 | MC Messages | Updated February 16, 2024: We have updated the content below for clarity Thank you for your patience.
We are adding support for DNS-based Authentication of Named Entities (or DANE) for SMTP and Domain Name System Security Extensions (DNSSEC) for inbound mail to Exchange Online. DANE for SMTP is a security protocol that uses DNS to verify the authenticity of the certificates used for securing email communication with TLS and protecting against TLS downgrade attacks. DNSSEC is a set of extensions to DNS that provides cryptographic verification of DNS records, preventing DNS-spoofing and adversary-in-the-middle attacks to DNS. This message is associated with Microsoft 365 Roadmap ID 63213. [When this will happen:] Public Preview: We will begin rolling out late March 2024 and expect to complete by late April 2024. Standard Release: We begin rolling out late June 2024 and expect to complete by late July 2024. | Updated April 15, 2024: We have updated the timing of the Preview below. Thank you for your patience.
We are adding support for DNS-based Authentication of Named Entities (or DANE) for SMTP and Domain Name System Security Extensions (DNSSEC) for inbound mail to Exchange Online. DANE for SMTP is a security protocol that uses DNS to verify the authenticity of the certificates used for securing email communication with TLS and protecting against TLS downgrade attacks. DNSSEC is a set of extensions to DNS that provides cryptographic verification of DNS records, preventing DNS-spoofing and adversary-in-the-middle attacks to DNS. This message is associated with Microsoft 365 Roadmap ID 63213. [When this will happen:] Public Preview: We will begin rolling out in May 2024. Standard Release: We begin rolling out late June 2024 and expect to complete by late July 2024. |
| 2024-04-16 | MC Last Updated | 02/17/2024 00:20:42 | 2024-04-15T23:43:58Z |
| 2024-04-16 | MC Summary | Microsoft Exchange Online will support inbound SMTP DANE with DNSSEC starting from late March 2024. Inbound SMTP DANE with DNSSEC will be off by default, and if you do not want to enable the feature, you do not need to do anything. If you want to enable the feature, follow the documentation using Exchange PowerShell. Review your domain configuration internally to ensure you won't be impacted by any of the limitations. | Microsoft Exchange Online will support inbound SMTP DANE with DNSSEC starting from lMay 2024. Inbound SMTP DANE with DNSSEC will be off by default, and if you do not want to enable the feature, you do not need to do anything. If you want to enable the feature, follow the documentation using Exchange PowerShell. Review your domain configuration internally to ensure you won't be impacted by any of the limitations. |
| 2024-02-17 | MC prepare | Review your domain configuration internally to ensure you won’t be impacted by any of the limitations below, and visit Implementing Inbound SMTP DANE with DNSSEC for Exchange Online Mail Flow - Microsoft Community Hub for more detailed information on limitations:
Not supported: Fully delegated domain, onmicrosoft.com domains, and domains purchased from Microsoft known as “viral” or self-service sign-up domains Supported with risk: 3rd-party gateways and integration with mail flow https://learn.microsoft.com/purview/how-smtp-dane-works?view=o365-worldwide#how-can-exchange-online-customers-use-smtp-dane-inbound https://techcommunity.microsoft.com/t5/exchange-team-blog/implementing-inbound-smtp-dane-with-dnssec-for-exchange-online/ba-p/3939694 https://www.microsoft.com/microsoft-365/roadmap?filters=&searchterms=63213 | Review your domain configuration internally to ensure you won’t be impacted by any of the limitations below, and visit Implementing Inbound SMTP DANE with DNSSEC for Exchange Online Mail Flow - Microsoft Community Hub for more detailed information on limitations:
Not supported: Fully delegated domain, onmicrosoft.com domains, and domains purchased from Microsoft known as “viral” or self-service sign-up domains Supported with risk: 3rd-party gateways, connectors, and integration with hybrid mail flow (ex. if you are using a connector to smarthost to a domain that you want to enable with DNSSEC, you need to update the smarthost name for that connector [ex. contoso-com.mail.protection.outlook.com] to match the new MX record that will be provided during DNSSEC enablement or, preferably, to match the tenant's onmicrosoft.com domain [ex. tenant-name.onmicrosoft.com] before enabling the feature.) https://learn.microsoft.com/purview/how-smtp-dane-works?view=o365-worldwide#how-can-exchange-online-customers-use-smtp-dane-inbound https://techcommunity.microsoft.com/t5/exchange-team-blog/implementing-inbound-smtp-dane-with-dnssec-for-exchange-online/ba-p/3939694 https://www.microsoft.com/microsoft-365/roadmap?filters=&searchterms=63213 |
| 2024-02-17 | MC Summary | Microsoft Exchange Online will support inbound SMTP DANE with DNSSEC starting from late March 2024. Inbound SMTP DANE with DNSSEC will be off by default, and if you do not want to enable the feature, you do not need to do anything. If you want to enable the feature, follow the documentation using Exchange PowerShell. Review your domain configuration internally to ensure you won't be impacted by any of the limitations. | |
| 2024-02-17 | MC Last Updated | 01/30/2024 00:51:59 | 2024-02-17T00:20:42Z |
| 2024-02-17 | MC Messages | We are adding support for DNS-based Authentication of Named Entities (or DANE) for SMTP and Domain Name System Security Extensions (DNSSEC) for inbound mail to Exchange Online. DANE for SMTP is a security protocol that uses DNS to verify the authenticity of the certificates used for securing email communication with TLS and protecting against TLS downgrade attacks. DNSSEC is a set of extensions to DNS that provides cryptographic verification of DNS records, preventing DNS-spoofing and adversary-in-the-middle attacks to DNS.
This message is associated with Microsoft 365 Roadmap ID 63213. [When this will happen:] Public Preview: We will begin rolling out late March 2024 and expect to complete by late April 2024. Standard Release: We begin rolling out late June 2024 and expect to complete by late July 2024. | Updated February 16, 2024: We have updated the content below for clarity Thank you for your patience.
We are adding support for DNS-based Authentication of Named Entities (or DANE) for SMTP and Domain Name System Security Extensions (DNSSEC) for inbound mail to Exchange Online. DANE for SMTP is a security protocol that uses DNS to verify the authenticity of the certificates used for securing email communication with TLS and protecting against TLS downgrade attacks. DNSSEC is a set of extensions to DNS that provides cryptographic verification of DNS records, preventing DNS-spoofing and adversary-in-the-middle attacks to DNS. This message is associated with Microsoft 365 Roadmap ID 63213. [When this will happen:] Public Preview: We will begin rolling out late March 2024 and expect to complete by late April 2024. Standard Release: We begin rolling out late June 2024 and expect to complete by late July 2024. |
| 2024-02-17 | MC Title | Microsoft Exchange Online: Support for inbound SMTP DANE with DNSSEC | (Updated) Microsoft Exchange Online: Support for inbound SMTP DANE with DNSSEC |
| 2024-02-17 | MC MessageTagNames | New feature, User impact, Admin impact | Updated message, New feature, User impact, Admin impact |
Last updated 3 weeks ago
