MC1220759 – MTA-STS and SMTP DANE mode on connectors

Product:

Exchange

Platform:

Online, World tenant

Status:

Change type:

New feature, User impact, Admin impact

Links:

Details:

Summary:
Exchange Online will let admins control MTA-STS and SMTP DANE validation modes on outbound connectors starting late February 2026. Modes include Opportunistic (default), None (disables validation), and Mandatory (enforces SMTP DANE). No action is needed unless changes to validation behavior are desired.

Details:
[Introduction]
This feature provides admin's control over Outbound MTA-STS and SMTP DANE validations for emails sent over outbound connectors in Exchange Online, allowing organizations to choose how strictly the service enforces MTA-STS and SMTP DANE when sending mail to external domains.
Admins will be able to configure each outbound connector to use the following modes:
Opportunistic [default], applies to both MTA-STS and SMTP DANE. Opportunistic Mode means Exchange Online will attempt to perform validations for both MTA-STS and SMTP DANE but still sends the message if the destination doesn't support either protocol.
None, which applies to both MTA-STS and SMTP DANE and disables the validation entirely, therefore reducing the security of emails sent over that connector by removing MTA-STS and/or SMTP DANE protections designed to prevent downgrade attacks and spoofed MX redirection.
Mandatory, applies only to SMTP DANE and enforces full SMTP DANE and DNSSEC validation, requiring the destination to support Inbound SMTP DANE with DNSSEC and queueing mail if the validation does not succeed.
[When this will happen]
General Availability (Worldwide): We will begin rolling out in late February 2026 and expect to complete by late March 2026.

Change Category:
XXXXXXX ... free basic plan only

Scope:
XXXXXXX ... free basic plan only

Release Phase:

Created:
2026-01-22

updated:
2026-01-22

Task Type

XXXXXXX ... free basic plan only

Docu to Check

XXXXXXX ... free basic plan only

MS How does it affect me

XXXXXXX ... free basic plan only

MS Preperations

XXXXXXX ... free basic plan only

MS Urgency

XXXXXXX ... free basic plan only

MS workload name

XXXXXXX ... free basic plan only

summary for non-techies**

Exchange Online is introducing a feature that allows administrators to choose between Opportunistic, None, and Mandatory modes for email security validation when sending emails to external domains, with the rollout set for late February 2026.

Direct effects for Operations**

Email Delivery Reliability
Switching to Mandatory mode without preparation may lead to undelivered emails if the recipient's server does not support SMTP DANE, causing communication disruptions.
   - roles: Email Administrators, IT Support Staff
   - references: https://techcommunity.microsoft.com/t5/exchange-team-blog/announcing-mta-sts-and-smtp-dane-validation-modes-on-outbound/ba-p/3701230

User Experience
If emails are queued due to failed validations in Mandatory mode, users may experience delays in email communication, impacting productivity.
   - roles: End Users, Customer Support Representatives
   - references: https://techcommunity.microsoft.com/t5/exchange-team-blog/announcing-mta-sts-and-smtp-dane-validation-modes-on-outbound/ba-p/3701230

Security Risks
Disabling validation (None mode) can expose the organization to security threats such as spoofing and downgrade attacks, compromising sensitive information.
   - roles: Security Administrators, Compliance Officers
   - references: https://techcommunity.microsoft.com/t5/exchange-team-blog/announcing-mta-sts-and-smtp-dane-validation-modes-on-outbound/ba-p/3701230

Configutation Options**

XXXXXXX ... paid membership only

Opportunities**

XXXXXXX ... free basic plan only

Potentional Risks**

XXXXXXX ... paid membership only

IT Security**

XXXXXXX ... paid membership only

explanation for non-techies**

XXXXXXX ... free basic plan only