MTA-STS and SMTP DANE mode on connectors

Introduction

This feature provides admin's control over Outbound MTA-STS and SMTP DANE validations for emails sent over outbound connectors in Exchange Online, allowing organizations to choose how strictly the service enforces MTA-STS and SMTP DANE when sending mail to external domains.

Admins will be able to configure each outbound connector to use the following modes:

1. Opportunistic default, applies to both MTA-STS and SMTP DANE. Opportunistic Mode means Exchange Online will attempt to perform validations for both MTA-STS and SMTP DANE but still sends the message if the destination doesn't support either protocol.
2. None, which applies to both MTA-STS and SMTP DANE and disables the validation entirely, therefore reducing the security of emails sent over that connector by removing MTA-STS and/or SMTP DANE protections designed to prevent downgrade attacks and spoofed MX redirection.
3. Mandatory, applies only to SMTP DANE and enforces full SMTP DANE and DNSSEC validation, requiring the destination to support Inbound SMTP DANE with DNSSEC and queueing mail if the validation does not succeed.

When this will happen

General Availability (Worldwide): We will begin rolling out in late February 2026 and expect to complete by late March 2026.

How this will affect your organization

Connectors will default to Opportunistic Mode. Opportunistic Mode is already the default behavior for Exchange Online outbound connectors.

What you need to do to prepare

If you do not want to change the MTA-STS and/or SMTP DANE validation behavior for your outbound connectors, there is no action you need to take and you can ignore this post.

If you do want to change the MTA-STS and/or SMTP DANE validation behavior for your outbound connectors, review the documentation on this feature which will be updated and provided in this post prior to release.

Compliance considerations

No compliance considerations identified. Review as appropriate for your organization.