check before: 2025-04-15
Product:
Exchange, Outlook
Platform:
Developer, Online, US Instances, World tenant
Status:
Change type:
Admin impact, Updated message, User impact
Links:
Details:
Summary:
Starting April 15, 2025, messages with multiple From addresses without a Sender header will be rejected in Exchange Online to comply with RFC 5322. The rollout for GCC High and DOD is delayed to October 7, 2025. Tenants sending high volumes of such emails are opted out temporarily.
Details:
Updated July 2, 2025: We have updated the timeline below. Thank you for your patience.
We are proactively opting tenants out of the rollout that were detected as sending high volumes of emails exhibiting multiple From addresses without a Sender address header. These exempted senders will only be able to send emails exhibiting multiple From addresses without a Sender address header to recipients belonging to the same tenant as the sender. We will provide a subsequent update by the end of May 2025 (previously end of March) with an updated timeline for tenants that are opted out.
We're going to start gradually dropping messages that have multiple From addresses (also known as P2 From headers) without a Sender header from being processed via Exchange Online, please review the section "When this will happen" for rollout timeline information for your tenant.
If we see significant traffic exhibiting multiple From addresses (P2 From headers) without a Sender header in your tenant in the month of September, we will send you a Message Center Post by October 15th alerting you and providing some sample message IDs.
We are doing this to comply with RFC 5322 (https://www.rfc-editor.org/rfc/rfc5322#section-3.6.2) which mandates the Sender header to be present and contain a single address if the From header has more than one address. Noncompliance with this could be exploited by attackers, allowing them to impersonate a sender address by misleading the client into using the From header to determine the sender instead of the Sender header.
[When this will happen:]
General Availability (Worldwide, GCC): We will begin rolling out April 15, 2025, and expect to complete by May 15, 2025.
GCC High, DOD: We will begin rolling out October 7, 2025 (previously July 1), and expect to complete by November 1, 2025 (previously August 1).
We are delaying the rollout start date in order to provide more time to customers for investigating messages exhibiting multiple P2 From Addresses without a Sender Address.
Most of the traffic exhibiting multiple P2 From Addresses without a Sender Address will be inbound spam destined for your tenant sent by malicious spammers on the internet.
Some customers are sending legitimate emails with this malformed header configuration. On October 15, we sent a targeted MC post to customers showing high volumes of messages exhibiting multiple P2 From Addresses without a Sender Address as they may be impacted by this change.
For investigating if you will be impacted by this change, focus your investigation on messages sent using On Premises Inbound Connectors to Exchange Online. Authenticated mail submission is not impacted because submitting messages like this using those submissions are not allowed (Graph, Outlook clients, SMTP AUTH Client Submission).
Change Category:
XXXXXXX ... free basic plan only
Scope:
XXXXXXX ... free basic plan only
Release Phase:
Created:
2024-09-10
updated:
2025-07-03
Task Type
XXXXXXX ... free basic plan only
Docu to Check
XXXXXXX ... free basic plan only
MS How does it affect me
XXXXXXX ... free basic plan only
MS Preperations
XXXXXXX ... free basic plan only
MS Urgency
XXXXXXX ... free basic plan only
MS workload name
XXXXXXX ... free basic plan only
summary for non-techies**
Starting in 2025, Exchange Online will reject emails with multiple "From" addresses but no "Sender" address to prevent misuse, with a temporary opt-out available for internal organizational emails.
Direct effects for Operations**
Email Delivery Issues
Messages with multiple From addresses without a Sender header will be rejected, leading to potential loss of important communications.
- roles: Email Administrators, End Users
- references: https://www.rfc-editor.org/rfc/rfc5322#section-3.6.2
Increased User Frustration
Users may experience confusion and frustration due to Non-Delivery Reports (NDRs) when attempting to send emails with invalid headers.
- roles: End Users, Support Staff
- references: https://www.rfc-editor.org/rfc/rfc5322#section-3.6.2
Compliance Risks
Failure to comply with RFC 5322 may expose the organization to security risks, including email spoofing and phishing attacks.
- roles: Security Officers, Email Administrators
- references: https://www.rfc-editor.org/rfc/rfc5322#section-3.6.2
Operational Disruption
High volumes of rejected emails may disrupt normal business operations, especially for departments relying on email communication.
- roles: Department Managers, End Users
- references: https://www.rfc-editor.org/rfc/rfc5322#section-3.6.2
Increased Support Tickets
The change may lead to an increase in support tickets as users encounter issues sending emails, straining IT resources.
- roles: Support Staff, IT Managers
- references: https://www.rfc-editor.org/rfc/rfc5322#section-3.6.2
Configutation Options**
XXXXXXX ... paid membership only
Opportunities**
Email Header Compliance Automation
Implementing automated tools to check outgoing emails for compliance with RFC 5322 can help prevent issues related to multiple From addresses without a Sender header. This will ensure that all outgoing emails adhere to the required standards before they are sent, reducing the likelihood of rejected messages and improving overall email deliverability.
- next-steps: Research and select email compliance tools that can integrate with Exchange Online. Set up a pilot program to test the effectiveness of these tools before a full rollout.
- roles: IT Administrators, Compliance Officers, Email System Administrators
- references: https://www.rfc-editor.org/rfc/rfc5322#section-3.6.2, https://techcommunity.microsoft.com/t5/exchange-team-blog/what-you-need-to-know-about-multiple-from-addresses-and/ba-p/3020500
User Training and Awareness Programs
Conducting training sessions for users on proper email practices, specifically focusing on the correct use of From and Sender headers, can help minimize the occurrence of compliance issues. Educating users about the implications of sending emails with incorrect headers will enhance their understanding and reduce potential disruptions.
- next-steps: Develop training materials and schedule training sessions for all email users within the organization. Create a feedback mechanism to assess the effectiveness of the training.
- roles: HR Managers, Training Coordinators, IT Support Staff
- references: https://www.microsoft.com/en-us/microsoft-365/blog/2020/06/30/understanding-email-headers-and-how-they-affect-deliverability/, https://www.linkedin.com/pulse/importance-email-header-compliance-rfc-5322-ivan-novak/
Email Traffic Monitoring and Reporting
Establishing a monitoring system for email traffic can help identify patterns of non-compliance with the new header requirements. By analyzing email traffic, the organization can proactively address issues and ensure that legitimate emails are not mistakenly rejected.
- next-steps: Implement email analytics tools that can provide insights into email traffic patterns. Regularly review reports to identify and resolve compliance issues before they affect users.
- roles: Network Administrators, IT Security Analysts, Compliance Officers
- references: https://www.zdnet.com/article/how-to-monitor-your-email-traffic/, https://www.csoonline.com/article/3307851/how-to-use-email-analytics-to-improve-communication.html
Potentional Risks**
XXXXXXX ... paid membership only
IT Security**
XXXXXXX ... paid membership only
explanation for non-techies**
XXXXXXX ... free basic plan only
** AI generated content. This information must be reviewed before use.
a free basic plan is required to see more details. Sign up here
A cloudsocut.one plan is required to see all the changed details. If you are already a customer, choose login.
If you are new to cloudscout.one please choose a plan.
change history
| Date | Property | old | new |
| 2025-07-03 | MC Last Updated | 03/21/2025 19:39:58 | 2025-07-02T15:18:03Z |
| 2025-07-03 | MC Messages | Updated March 21, 2025: We have updated the rollout timeline below. Thank you for your patience.
We are proactively opting tenants out of the rollout that were detected as sending high volumes of emails exhibiting multiple From addresses without a Sender address header. These exempted senders will only be able to send emails exhibiting multiple From addresses without a Sender address header to recipients belonging to the same tenant as the sender. We will provide a subsequent update by the end of May 2025 (previously end of March) with an updated timeline for tenants that are opted out. We're going to start gradually dropping messages that have multiple From addresses (also known as P2 From headers) without a Sender header from being processed via Exchange Online, please review the section "When this will happen" for rollout timeline information for your tenant. If we see significant traffic exhibiting multiple From addresses (P2 From headers) without a Sender header in your tenant in the month of September, we will send you a Message Center Post by October 15th alerting you and providing some sample message IDs. We are doing this to comply with RFC 5322 (https://www.rfc-editor.org/rfc/rfc5322#section-3.6.2) which mandates the Sender header to be present and contain a single address if the From header has more than one address. Noncompliance with this could be exploited by attackers, allowing them to impersonate a sender address by misleading the client into using the From header to determine the sender instead of the Sender header. [When this will happen:] General Availability (Worldwide, GCC): We will begin rolling out April 15, 2025, and expect to complete by May 15, 2025. GCC High, DOD: We will begin rolling out July 1, 2025, and expect to complete by August 1, 2025. We are delaying the rollout start date in order to provide more time to customers for investigating messages exhibiting multiple P2 From Addresses without a Sender Address. Most of the traffic exhibiting multiple P2 From Addresses without a Sender Address will be inbound spam destined for your tenant sent by malicious spammers on the internet. Some customers are sending legitimate emails with this malformed header configuration. On October 15, we sent a targeted MC post to customers showing high volumes of messages exhibiting multiple P2 From Addresses without a Sender Address as they may be impacted by this change. For investigating if you will be impacted by this change, focus your investigation on messages sent using On Premises Inbound Connectors to Exchange Online. Authenticated mail submission is not impacted because submitting messages like this using those submissions are not allowed (Graph, Outlook clients, SMTP AUTH Client Submission). | Updated July 2, 2025: We have updated the timeline below. Thank you for your patience.
We are proactively opting tenants out of the rollout that were detected as sending high volumes of emails exhibiting multiple From addresses without a Sender address header. These exempted senders will only be able to send emails exhibiting multiple From addresses without a Sender address header to recipients belonging to the same tenant as the sender. We will provide a subsequent update by the end of May 2025 (previously end of March) with an updated timeline for tenants that are opted out. We're going to start gradually dropping messages that have multiple From addresses (also known as P2 From headers) without a Sender header from being processed via Exchange Online, please review the section "When this will happen" for rollout timeline information for your tenant. If we see significant traffic exhibiting multiple From addresses (P2 From headers) without a Sender header in your tenant in the month of September, we will send you a Message Center Post by October 15th alerting you and providing some sample message IDs. We are doing this to comply with RFC 5322 (https://www.rfc-editor.org/rfc/rfc5322#section-3.6.2) which mandates the Sender header to be present and contain a single address if the From header has more than one address. Noncompliance with this could be exploited by attackers, allowing them to impersonate a sender address by misleading the client into using the From header to determine the sender instead of the Sender header. [When this will happen:] General Availability (Worldwide, GCC): We will begin rolling out April 15, 2025, and expect to complete by May 15, 2025. GCC High, DOD: We will begin rolling out October 7, 2025 (previously July 1), and expect to complete by November 1, 2025 (previously August 1). We are delaying the rollout start date in order to provide more time to customers for investigating messages exhibiting multiple P2 From Addresses without a Sender Address. Most of the traffic exhibiting multiple P2 From Addresses without a Sender Address will be inbound spam destined for your tenant sent by malicious spammers on the internet. Some customers are sending legitimate emails with this malformed header configuration. On October 15, we sent a targeted MC post to customers showing high volumes of messages exhibiting multiple P2 From Addresses without a Sender Address as they may be impacted by this change. For investigating if you will be impacted by this change, focus your investigation on messages sent using On Premises Inbound Connectors to Exchange Online. Authenticated mail submission is not impacted because submitting messages like this using those submissions are not allowed (Graph, Outlook clients, SMTP AUTH Client Submission). |
| 2025-07-03 | MC End Time | 10/01/2025 10:00:00 | 2025-12-15T09:00:00Z |
| 2025-07-03 | MC Summary | Starting April 15, 2025, Exchange Online will reject emails with multiple From addresses without a Sender header to comply with RFC 5322. Tenants sending high volumes of such emails are opted out temporarily. Rollout for GCC High and DOD starts July 1, 2025. Ensure emails have a single Sender address if multiple From addresses are used. | Starting April 15, 2025, messages with multiple From addresses without a Sender header will be rejected in Exchange Online to comply with RFC 5322. The rollout for GCC High and DOD is delayed to October 7, 2025. Tenants sending high volumes of such emails are opted out temporarily. |
| 2025-03-22 | MC Messages | Updated February 28, 2025: We have updated the rollout timeline below. Thank you for your patience.
We are proactively opting tenants out of the rollout that were detected as sending high volumes of emails exhibiting multiple From addresses without a Sender address header. These exempted senders will only be able to send emails exhibiting multiple From addresses without a Sender address header to recipients belonging to the same tenant as the sender. We will provide a subsequent update by the end of May 2025 (previously end of March) with an updated timeline for tenants that are opted out. Starting April 15, 2025 (previously February 3), we're going to start gradually dropping messages that have multiple From addresses (also known as P2 From headers) without a Sender header from being processed via Exchange Online. If we see significant traffic exhibiting multiple From addresses (P2 From headers) without a Sender header in your tenant in the month of September, we will send you a Message Center Post by October 15th alerting you and providing some sample message IDs. We are doing this to comply with RFC 5322 (https://www.rfc-editor.org/rfc/rfc5322#section-3.6.2) which mandates the Sender header to be present and contain a single address if the From header has more than one address. Noncompliance with this could be exploited by attackers, allowing them to impersonate a sender address by misleading the client into using the From header to determine the sender instead of the Sender header. [When this will happen:] April 15, 2025 (previously February 3) We are delaying the rollout start date from December to April 15, 2025 (previously February 3) in order to provide more time to customers for investigating messages exhibiting multiple P2 From Addresses without a Sender Address. Most of the traffic exhibiting multiple P2 From Addresses without a Sender Address will be inbound spam destined for your tenant sent by malicious spammers on the internet. Some customers are sending legitimate emails with this malformed header configuration. On October 15, we sent a targeted MC post to customers showing high volumes of messages exhibiting multiple P2 From Addresses without a Sender Address as they may be impacted by this change. For investigating if you will be impacted by this change, focus your investigation on messages sent using On Premises Inbound Connectors to Exchange Online. Authenticated mail submission is not impacted because submitting messages like this using those submissions are not allowed (Graph, Outlook clients, SMTP AUTH Client Submission). | Updated March 21, 2025: We have updated the rollout timeline below. Thank you for your patience.
We are proactively opting tenants out of the rollout that were detected as sending high volumes of emails exhibiting multiple From addresses without a Sender address header. These exempted senders will only be able to send emails exhibiting multiple From addresses without a Sender address header to recipients belonging to the same tenant as the sender. We will provide a subsequent update by the end of May 2025 (previously end of March) with an updated timeline for tenants that are opted out. We're going to start gradually dropping messages that have multiple From addresses (also known as P2 From headers) without a Sender header from being processed via Exchange Online, please review the section "When this will happen" for rollout timeline information for your tenant. If we see significant traffic exhibiting multiple From addresses (P2 From headers) without a Sender header in your tenant in the month of September, we will send you a Message Center Post by October 15th alerting you and providing some sample message IDs. We are doing this to comply with RFC 5322 (https://www.rfc-editor.org/rfc/rfc5322#section-3.6.2) which mandates the Sender header to be present and contain a single address if the From header has more than one address. Noncompliance with this could be exploited by attackers, allowing them to impersonate a sender address by misleading the client into using the From header to determine the sender instead of the Sender header. [When this will happen:] General Availability (Worldwide, GCC): We will begin rolling out April 15, 2025, and expect to complete by May 15, 2025. GCC High, DOD: We will begin rolling out July 1, 2025, and expect to complete by August 1, 2025. We are delaying the rollout start date in order to provide more time to customers for investigating messages exhibiting multiple P2 From Addresses without a Sender Address. Most of the traffic exhibiting multiple P2 From Addresses without a Sender Address will be inbound spam destined for your tenant sent by malicious spammers on the internet. Some customers are sending legitimate emails with this malformed header configuration. On October 15, we sent a targeted MC post to customers showing high volumes of messages exhibiting multiple P2 From Addresses without a Sender Address as they may be impacted by this change. For investigating if you will be impacted by this change, focus your investigation on messages sent using On Premises Inbound Connectors to Exchange Online. Authenticated mail submission is not impacted because submitting messages like this using those submissions are not allowed (Graph, Outlook clients, SMTP AUTH Client Submission). |
| 2025-03-22 | MC How Affect | If email clients including devices and applications that you use to send messages, do so using multiple From addresses but without a Sender address header after April 15 2025 (previously December 1st), you will get an NDR error code 550 5.1.20 "Multiple From addresses are not allowed without Sender address'". | If email clients including devices and applications that you use to send messages, do so using multiple From addresses but without a Sender address header after the change starts rolling out to your environment, you will get an NDR error code 550 5.1.20 "Multiple From addresses are not allowed without Sender address. |
| 2025-03-22 | MC Last Updated | 02/28/2025 17:27:08 | 2025-03-21T19:39:58Z |
| 2025-03-22 | MC End Time | 06/30/2025 10:00:00 | 2025-10-01T10:00:00Z |
| 2025-03-22 | MC Summary | Starting April 15, 2025, Exchange Online will reject emails with multiple From addresses without a Sender header to comply with RFC 5322. Tenants sending high volumes of such emails are opted out temporarily. Organizations must ensure emails with multiple From addresses include a single Sender address to avoid NDR errors. | Starting April 15, 2025, Exchange Online will reject emails with multiple From addresses without a Sender header to comply with RFC 5322. Tenants sending high volumes of such emails are opted out temporarily. Rollout for GCC High and DOD starts July 1, 2025. Ensure emails have a single Sender address if multiple From addresses are used. |
| 2025-03-01 | MC Messages | Updated February 14, 2025: We are proactively opting tenants out of the rollout that were detected as sending high volumes of emails exhibiting multiple From addresses without a Sender address header. These exempted senders will only be able to send emails exhibiting multiple From addresses without a Sender address header to recipients belonging to the same tenant as the sender. We will provide a subsequent update by the end of March with an updated timeline for tenants that are opted out.
Starting February 3 (previously December 1), we're going to start gradually dropping messages that have multiple From addresses (also known as P2 From headers) without a Sender header from being processed via Exchange Online. If we see significant traffic exhibiting multiple From addresses (P2 From headers) without a Sender header in your tenant in the month of September, we will send you a Message Center Post by October 15th alerting you and providing some sample message IDs. We are doing this to comply with RFC 5322 (https://www.rfc-editor.org/rfc/rfc5322#section-3.6.2) which mandates the Sender header to be present and contain a single address if the From header has more than one address. Noncompliance with this could be exploited by attackers, allowing them to impersonate a sender address by misleading the client into using the From header to determine the sender instead of the Sender header. [When this will happen:] February 3, 2025 (previously December 1st) We are delaying the rollout start date from December to February 3rd 2025 in order to provide more time to customers for investigating messages exhibiting multiple P2 From Addresses without a Sender Address. Most of the traffic exhibiting multiple P2 From Addresses without a Sender Address will be inbound spam destined for your tenant sent by malicious spammers on the internet. Some customers are sending legitimate emails with this malformed header configuration. On October 15, we sent a targeted MC post to customers showing high volumes of messages exhibiting multiple P2 From Addresses without a Sender Address as they may be impacted by this change. For investigating if you will be impacted by this change, focus your investigation on messages sent using On Premises Inbound Connectors to Exchange Online. Authenticated mail submission is not impacted because submitting messages like this using those submissions are not allowed (Graph, Outlook clients, SMTP AUTH Client Submission). | Updated February 28, 2025: We have updated the rollout timeline below. Thank you for your patience.
We are proactively opting tenants out of the rollout that were detected as sending high volumes of emails exhibiting multiple From addresses without a Sender address header. These exempted senders will only be able to send emails exhibiting multiple From addresses without a Sender address header to recipients belonging to the same tenant as the sender. We will provide a subsequent update by the end of May 2025 (previously end of March) with an updated timeline for tenants that are opted out. Starting April 15, 2025 (previously February 3), we're going to start gradually dropping messages that have multiple From addresses (also known as P2 From headers) without a Sender header from being processed via Exchange Online. If we see significant traffic exhibiting multiple From addresses (P2 From headers) without a Sender header in your tenant in the month of September, we will send you a Message Center Post by October 15th alerting you and providing some sample message IDs. We are doing this to comply with RFC 5322 (https://www.rfc-editor.org/rfc/rfc5322#section-3.6.2) which mandates the Sender header to be present and contain a single address if the From header has more than one address. Noncompliance with this could be exploited by attackers, allowing them to impersonate a sender address by misleading the client into using the From header to determine the sender instead of the Sender header. [When this will happen:] April 15, 2025 (previously February 3) We are delaying the rollout start date from December to April 15, 2025 (previously February 3) in order to provide more time to customers for investigating messages exhibiting multiple P2 From Addresses without a Sender Address. Most of the traffic exhibiting multiple P2 From Addresses without a Sender Address will be inbound spam destined for your tenant sent by malicious spammers on the internet. Some customers are sending legitimate emails with this malformed header configuration. On October 15, we sent a targeted MC post to customers showing high volumes of messages exhibiting multiple P2 From Addresses without a Sender Address as they may be impacted by this change. For investigating if you will be impacted by this change, focus your investigation on messages sent using On Premises Inbound Connectors to Exchange Online. Authenticated mail submission is not impacted because submitting messages like this using those submissions are not allowed (Graph, Outlook clients, SMTP AUTH Client Submission). |
| 2025-03-01 | MC How Affect | If email clients including devices and applications that you use to send messages, do so using multiple From addresses but without a Sender address header after December 1st, you will get an NDR error code 550 5.1.20 "Multiple From addresses are not allowed without Sender address'". | If email clients including devices and applications that you use to send messages, do so using multiple From addresses but without a Sender address header after April 15 2025 (previously December 1st), you will get an NDR error code 550 5.1.20 "Multiple From addresses are not allowed without Sender address'". |
| 2025-03-01 | MC Last Updated | 02/14/2025 21:37:02 | 2025-02-28T17:27:08Z |
| 2025-03-01 | MC End Time | 05/05/2025 10:00:00 | 2025-06-30T10:00:00Z |
| 2025-03-01 | MC Summary | Starting February 3, 2025, Exchange Online will drop messages with multiple From addresses without a Sender header to comply with RFC 5322. Affected users were notified on October 15. To prevent issues, ensure messages with multiple From addresses include a Sender header. | Starting April 15, 2025, Exchange Online will reject emails with multiple From addresses without a Sender header to comply with RFC 5322. Tenants sending high volumes of such emails are opted out temporarily. Organizations must ensure emails with multiple From addresses include a single Sender address to avoid NDR errors. |
| 2025-02-15 | MC Last Updated | 01/31/2025 17:35:05 | 2025-02-14T21:37:02Z |
| 2025-02-15 | MC Messages | Updated January 31, 2025: We are proactively opting tenants out of the rollout that were detected as sending high volumes of emails exhibiting multiple From addresses without a Sender address header. These exempted senders will only be able to send emails exhibiting multiple From addresses without a Sender address header to recipients belonging to the same tenant as the sender. We will provide a subsequent update by the end of February with an updated timeline for tenants that are opted out.
Starting February 3 (previously December 1), we're going to start gradually dropping messages that have multiple From addresses (also known as P2 From headers) without a Sender header from being processed via Exchange Online. If we see significant traffic exhibiting multiple From addresses (P2 From headers) without a Sender header in your tenant in the month of September, we will send you a Message Center Post by October 15th alerting you and providing some sample message IDs. We are doing this to comply with RFC 5322 (https://www.rfc-editor.org/rfc/rfc5322#section-3.6.2) which mandates the Sender header to be present and contain a single address if the From header has more than one address. Noncompliance with this could be exploited by attackers, allowing them to impersonate a sender address by misleading the client into using the From header to determine the sender instead of the Sender header. [When this will happen:] February 3, 2025 (previously December 1st) We are delaying the rollout start date from December to February 3rd 2025 in order to provide more time to customers for investigating messages exhibiting multiple P2 From Addresses without a Sender Address. Most of the traffic exhibiting multiple P2 From Addresses without a Sender Address will be inbound spam destined for your tenant sent by malicious spammers on the internet. Some customers are sending legitimate emails with this malformed header configuration. On October 15, we sent a targeted MC post to customers showing high volumes of messages exhibiting multiple P2 From Addresses without a Sender Address as they may be impacted by this change. For investigating if you will be impacted by this change, focus your investigation on messages sent using On Premises Inbound Connectors to Exchange Online. Authenticated mail submission is not impacted because submitting messages like this using those submissions are not allowed (Graph, Outlook clients, SMTP AUTH Client Submission). | Updated February 14, 2025: We are proactively opting tenants out of the rollout that were detected as sending high volumes of emails exhibiting multiple From addresses without a Sender address header. These exempted senders will only be able to send emails exhibiting multiple From addresses without a Sender address header to recipients belonging to the same tenant as the sender. We will provide a subsequent update by the end of March with an updated timeline for tenants that are opted out.
Starting February 3 (previously December 1), we're going to start gradually dropping messages that have multiple From addresses (also known as P2 From headers) without a Sender header from being processed via Exchange Online. If we see significant traffic exhibiting multiple From addresses (P2 From headers) without a Sender header in your tenant in the month of September, we will send you a Message Center Post by October 15th alerting you and providing some sample message IDs. We are doing this to comply with RFC 5322 (https://www.rfc-editor.org/rfc/rfc5322#section-3.6.2) which mandates the Sender header to be present and contain a single address if the From header has more than one address. Noncompliance with this could be exploited by attackers, allowing them to impersonate a sender address by misleading the client into using the From header to determine the sender instead of the Sender header. [When this will happen:] February 3, 2025 (previously December 1st) We are delaying the rollout start date from December to February 3rd 2025 in order to provide more time to customers for investigating messages exhibiting multiple P2 From Addresses without a Sender Address. Most of the traffic exhibiting multiple P2 From Addresses without a Sender Address will be inbound spam destined for your tenant sent by malicious spammers on the internet. Some customers are sending legitimate emails with this malformed header configuration. On October 15, we sent a targeted MC post to customers showing high volumes of messages exhibiting multiple P2 From Addresses without a Sender Address as they may be impacted by this change. For investigating if you will be impacted by this change, focus your investigation on messages sent using On Premises Inbound Connectors to Exchange Online. Authenticated mail submission is not impacted because submitting messages like this using those submissions are not allowed (Graph, Outlook clients, SMTP AUTH Client Submission). |
| 2025-02-15 | MC End Time | 03/03/2025 09:00:00 | 2025-05-05T10:00:00Z |
| 2025-02-01 | MC Messages | Updated November 6, 2024: We have updated the content. Thank you for your patience.
Starting February 3 (previously December 1), we're going to start gradually dropping messages that have multiple From addresses (also known as P2 From headers) without a Sender header from being sent via Exchange Online. If we see significant traffic exhibiting multiple From addresses (P2 From headers) without a Sender header in your tenant in the month of September, we will send you a Message Center Post by October 15th alerting you and providing some sample message IDs. We are doing this to comply with RFC 5322 (https://www.rfc-editor.org/rfc/rfc5322#section-3.6.2) which mandates the Sender header to be present and contain a single address if the From header has more than one address. Noncompliance with this could be exploited by attackers, allowing them to impersonate a sender address by misleading the client into using the From header to determine the sender instead of the Sender header. [When this will happen:] February 3, 2025 (previously December 1st) We are delaying the rollout start date from December to February 3rd 2025 in order to provide more time to customers for investigating messages exhibiting multiple P2 From Addresses without a Sender Address. Most of the traffic exhibiting multiple P2 From Addresses without a Sender Address will be inbound spam destined for your tenant sent by malicious spammers on the internet. Some customers are sending legitimate emails with this malformed header configuration. On October 15, we sent a targeted MC post to customers showing high volumes of messages exhibiting multiple P2 From Addresses without a Sender Address as they may be impacted by this change. For investigating if you will be impacted by this change, focus your investigation on messages sent using On Premises Inbound Connectors to Exchange Online. Authenticated mail submission is not impacted because submitting messages like this using those submissions are not allowed (Graph, Outlook clients, SMTP AUTH Client Submission). | Updated January 31, 2025: We are proactively opting tenants out of the rollout that were detected as sending high volumes of emails exhibiting multiple From addresses without a Sender address header. These exempted senders will only be able to send emails exhibiting multiple From addresses without a Sender address header to recipients belonging to the same tenant as the sender. We will provide a subsequent update by the end of February with an updated timeline for tenants that are opted out.
Starting February 3 (previously December 1), we're going to start gradually dropping messages that have multiple From addresses (also known as P2 From headers) without a Sender header from being processed via Exchange Online. If we see significant traffic exhibiting multiple From addresses (P2 From headers) without a Sender header in your tenant in the month of September, we will send you a Message Center Post by October 15th alerting you and providing some sample message IDs. We are doing this to comply with RFC 5322 (https://www.rfc-editor.org/rfc/rfc5322#section-3.6.2) which mandates the Sender header to be present and contain a single address if the From header has more than one address. Noncompliance with this could be exploited by attackers, allowing them to impersonate a sender address by misleading the client into using the From header to determine the sender instead of the Sender header. [When this will happen:] February 3, 2025 (previously December 1st) We are delaying the rollout start date from December to February 3rd 2025 in order to provide more time to customers for investigating messages exhibiting multiple P2 From Addresses without a Sender Address. Most of the traffic exhibiting multiple P2 From Addresses without a Sender Address will be inbound spam destined for your tenant sent by malicious spammers on the internet. Some customers are sending legitimate emails with this malformed header configuration. On October 15, we sent a targeted MC post to customers showing high volumes of messages exhibiting multiple P2 From Addresses without a Sender Address as they may be impacted by this change. For investigating if you will be impacted by this change, focus your investigation on messages sent using On Premises Inbound Connectors to Exchange Online. Authenticated mail submission is not impacted because submitting messages like this using those submissions are not allowed (Graph, Outlook clients, SMTP AUTH Client Submission). |
| 2025-02-01 | MC Last Updated | 11/08/2024 01:37:37 | 2025-01-31T17:35:05Z |
| 2024-11-08 | MC Last Updated | 09/21/2024 01:49:28 | 2024-11-08T01:37:37Z |
| 2024-11-08 | MC Messages | Updated September 20, 2024: We have updated the content. Thank you for your patience.
Starting December 1st, we're going to start gradually dropping messages that have multiple From addresses (also known as P2 From headers) without a Sender header from being sent via Exchange Online. If we see significant traffic exhibiting multiple From addresses (P2 From headers) without a Sender header in your tenant in the month of September, we will send you a Message Center Post by October 15th alerting you and providing some sample message IDs. We are doing this to comply with RFC 5322 (https://www.rfc-editor.org/rfc/rfc5322#section-3.6.2) which mandates the Sender header to be present and contain a single address if the From header has more than one address. Noncompliance with this could be exploited by attackers, allowing them to impersonate a sender address by misleading the client into using the From header to determine the sender instead of the Sender header. [When this will happen:] December 1st, 2024 | Updated November 6, 2024: We have updated the content. Thank you for your patience.
Starting February 3 (previously December 1), we're going to start gradually dropping messages that have multiple From addresses (also known as P2 From headers) without a Sender header from being sent via Exchange Online. If we see significant traffic exhibiting multiple From addresses (P2 From headers) without a Sender header in your tenant in the month of September, we will send you a Message Center Post by October 15th alerting you and providing some sample message IDs. We are doing this to comply with RFC 5322 (https://www.rfc-editor.org/rfc/rfc5322#section-3.6.2) which mandates the Sender header to be present and contain a single address if the From header has more than one address. Noncompliance with this could be exploited by attackers, allowing them to impersonate a sender address by misleading the client into using the From header to determine the sender instead of the Sender header. [When this will happen:] February 3, 2025 (previously December 1st) We are delaying the rollout start date from December to February 3rd 2025 in order to provide more time to customers for investigating messages exhibiting multiple P2 From Addresses without a Sender Address. Most of the traffic exhibiting multiple P2 From Addresses without a Sender Address will be inbound spam destined for your tenant sent by malicious spammers on the internet. Some customers are sending legitimate emails with this malformed header configuration. On October 15, we sent a targeted MC post to customers showing high volumes of messages exhibiting multiple P2 From Addresses without a Sender Address as they may be impacted by this change. For investigating if you will be impacted by this change, focus your investigation on messages sent using On Premises Inbound Connectors to Exchange Online. Authenticated mail submission is not impacted because submitting messages like this using those submissions are not allowed (Graph, Outlook clients, SMTP AUTH Client Submission). |
| 2024-11-08 | MC End Time | 02/24/2025 09:00:00 | 2025-03-03T09:00:00Z |
| 2024-11-08 | MC Summary | Starting December 1st, Exchange Online will reject emails with multiple From addresses without a Sender header, to comply with RFC 5322. Noncompliance can lead to sender impersonation. Affected organizations will be notified by October 15th if they had significant noncompliant traffic in September. | Starting February 3, 2025, Exchange Online will drop messages with multiple From addresses without a Sender header to comply with RFC 5322. Affected users were notified on October 15. To prevent issues, ensure messages with multiple From addresses include a Sender header. |
| 2024-09-21 | MC MessageTagNames | User impact, Admin impact | Updated message, User impact, Admin impact |
| 2024-09-21 | MC Summary | Starting October 15th, Exchange Online will reject emails with multiple From addresses without a Sender header, to comply with RFC 5322. Organizations should ensure a single address in the Sender header to avoid non-delivery reports (NDRs) with error code 550 5.1.20. Feedback on this change is welcomed. | Starting December 1st, Exchange Online will reject emails with multiple From addresses without a Sender header, to comply with RFC 5322. Noncompliance can lead to sender impersonation. Affected organizations will be notified by October 15th if they had significant noncompliant traffic in September. |
| 2024-09-21 | MC Last Updated | 09/10/2024 02:59:50 | 2024-09-21T01:49:28Z |
| 2024-09-21 | MC Messages | Starting October 15th, we're going to start gradually dropping messages that have multiple From addresses (also known as P2 From headers) without a Sender header from being sent via Exchange Online.
We are doing this to comply with RFC 5322 (https://www.rfc-editor.org/rfc/rfc5322#section-3.6.2) which mandates the Sender header to be present and contain a single address if the From header has more than one address. Noncompliance with this could be exploited by attackers, allowing them to impersonate a sender address by misleading the client into using the From header to determine the sender instead of the Sender header. [When this will happen:] October 15, 2024 | Updated September 20, 2024: We have updated the content. Thank you for your patience.
Starting December 1st, we're going to start gradually dropping messages that have multiple From addresses (also known as P2 From headers) without a Sender header from being sent via Exchange Online. If we see significant traffic exhibiting multiple From addresses (P2 From headers) without a Sender header in your tenant in the month of September, we will send you a Message Center Post by October 15th alerting you and providing some sample message IDs. We are doing this to comply with RFC 5322 (https://www.rfc-editor.org/rfc/rfc5322#section-3.6.2) which mandates the Sender header to be present and contain a single address if the From header has more than one address. Noncompliance with this could be exploited by attackers, allowing them to impersonate a sender address by misleading the client into using the From header to determine the sender instead of the Sender header. [When this will happen:] December 1st, 2024 |
| 2024-09-21 | MC How Affect | If email clients including devices and applications that you use to send messages, do so using multiple From addresses but without a Sender address header after October 15th, you will get an NDR error code 550 5.1.20 "Multiple From addresses are not allowed without Sender address'". | If email clients including devices and applications that you use to send messages, do so using multiple From addresses but without a Sender address header after December 1st, you will get an NDR error code 550 5.1.20 "Multiple From addresses are not allowed without Sender address'". |
| 2024-09-21 | MC Title | Reject multiple From addresses (P2 From headers) without a Sender header | (Updated) Reject multiple From addresses (P2 From headers) without a Sender header |
| 2024-09-21 | MC End Time | 12/31/2024 09:00:00 | 2025-02-24T09:00:00Z |
Last updated 2 weeks ago
