ChangeIntel IT change radar
Public mode

No access to your tenant or devices. Every item links to its source. What this means

Sources need attention Customize Public modeDiscuss ChangeIntel on Discord
MC711018 Stay informedUpdated messageNew featureUser impactAdmin impact

Microsoft Exchange Online: Support for inbound SMTP DANE with DNSSEC

From Microsoft 365 Message Center Archive by Merill Fernando · Microsoft may not have sent this notice to your tenant.
Exchange Online
Message Center archive Open in your tenant

Rollout

Roadmap
63213

Rollout dates are often only in the text. When Microsoft moves them, the change shows under "What changed".

Schedule dates changed in the text

Date phrases in schedule sentences differ between the versions we saw
  • Seen 17 Jul 2024 late August 2024, late September 2024 → early September 2024, late October 2024
  • Seen 21 Jun 2024 May 2024, late June 2024, late July 2024 → July 2024, late August 2024, late September 2024
  • Seen 15 Apr 2024 late March 2024, late April 2024 → May 2024

Read from date phrases in Microsoft's text, not from notice metadata. A changed phrase can be a moved rollout, a new milestone or just rewording; "What changed" below shows which.

What the notice says

Microsoft’s text, safely structured

Updated October 22, 2024: Inbound SMTP DANE with DNSSEC is now in General Availability. Thank you for your patience.

We are adding support for DNS-based Authentication of Named Entities (or DANE) for SMTP and Domain Name System Security Extensions (DNSSEC) for inbound mail to Exchange Online. DANE for SMTP is a security protocol that uses DNS to verify the authenticity of the certificates used for securing email communication with TLS and protecting against TLS downgrade attacks. DNSSEC is a set of extensions to DNS that provides cryptographic verification of DNS records, preventing DNS-spoofing and adversary-in-the-middle attacks to DNS.

This message is associated with Microsoft 365 Roadmap ID 63213.

When this will happen

Public Preview: We will begin rolling out in July 2024.

General Availability: We begin rolling out early September 2024 (previously late August) and expect to complete by late October 2024 (previously late September).

How this will affect your organization

Inbound SMTP DANE with DNSSEC will be off by default. If you do not want to enable the feature, you do not need to do anything.

If you want to enable the feature, please follow the documentation using Exchange PowerShell. When the feature is released, the documentation will be in the How can Exchange Online customers use SMTP DANE inbound section of How SMTP DNS-based Authentication of Named Entities (DANE) secures email communications | Microsoft Learn. By the end of 2024, we will release a new experience for enabling DNSSEC and SMTP DANE without using PowerShell.

What you need to do to prepare

Review your domain configuration internally to ensure you won’t be impacted by any of the limitations below, and visit Implementing Inbound SMTP DANE with DNSSEC for Exchange Online Mail Flow - Microsoft Community Hub for more detailed information on limitations:

  • Not supported: Fully delegated domain, onmicrosoft.com domains, and domains purchased from Microsoft known as “viral” or self-service sign-up domains
  • Supported with risk: 3rd-party gateways, connectors, and integration with hybrid mail flow (ex. if you are using a connector to smarthost to a domain that you want to enable with DNSSEC, you need to update the smarthost name for that connector ex. contoso-com.mail.protection.outlook.com to match the new MX record that will be provided during DNSSEC enablement or, preferably, to match the tenant's onmicrosoft.com domain ex. tenant-name.onmicrosoft.com before enabling the feature.)

What changed

Between archive captures, newest first

  1. Updated July 17,October 22, 2024: We have updated the rollout timing below.  Inbound SMTP DANE with DNSSEC is now in General Availability. Thank you for your patience. We are adding support for DNS-based Authentication …

  2. Updated June 21,July 17, 2024: We have updated the rollout timing below.   Thank you for your patience. We are adding support for DNS-based Authentication … will happen: Public Preview: We will begin rolling out in July 2024. Standard Release:General Availability: We begin rolling out late Augustearly September 2024 (previously late June)August) and expect to complete by late SeptemberOctober 2024 (previously late July).September). How this will affect your organization: Inbound SMTP DANE with DNSSEC will …

  3. Updated April 15,June 21, 2024: We have updated the rollout timing of the Preview below. Thank you for your patience. We are adding support for DNS-based … When this will happen: Public Preview: We will begin rolling out in MayJuly 2024. Standard Release: We begin rolling out late JuneAugust 2024 (previously late June) and expect to complete by late July 2024.September 2024 (previously late July). How this will affect your organization: Inbound SMTP DANE with DNSSEC will …

  4. Updated February 16,April 15, 2024: We have updated the content below for claritytiming of the Preview below. Thank you for your patience. We are adding support for DNS-based Authentication … to DNS. This message is associated with Microsoft 365 Roadmap ID 63213. [WhenWhen this will happen:]happen: Public Preview: We will begin rolling out late March 2024 and expect to complete by late April in May 2024. Standard Release: We begin rolling out late June 2024 and expect to complete by late July 2024. [HowHow this will affect your organization:]organization: Inbound SMTP DANE with DNSSEC will be off by default. If you … a new experience for enabling DNSSEC and SMTP DANE without using PowerShell. [WhatWhat you need to do to prepare:]prepare: Review your domain configuration internally to ensure you won’t be impacted by … with DNSSEC, you need to update the smarthost name for that connector [ex. contoso-com.mail.protection.outlook.com]ex. contoso-com.mail.protection.outlook.com to match the new MX record that will be provided during DNSSEC enablement or, preferably, to match the tenant's onmicrosoft.com domain [ex. tenant-name.onmicrosoft.com]ex. tenant-name.onmicrosoft.com before enabling the feature.)

  5. … to DNS. This message is associated with Microsoft 365 Roadmap ID 63213. When[When this will happen:happen:] Public Preview: We will begin rolling out late March 2024 and expect … out late June 2024 and expect to complete by late July 2024. How[How this will affect your organization:organization:] Inbound SMTP DANE with DNSSEC will be off by default. If you … a new experience for enabling DNSSEC and SMTP DANE without using PowerShell. What[What you need to do to prepare:prepare:] Review your domain configuration internally to ensure you won’t be impacted by … with DNSSEC, you need to update the smarthost name for that connector ex. contoso-com.mail.protection.outlook.com[ex. contoso-com.mail.protection.outlook.com] to match the new MX record that will be provided during DNSSEC enablement or, preferably, to match the tenant's onmicrosoft.com domain ex. tenant-name.onmicrosoft.com[ex. tenant-name.onmicrosoft.com] before enabling the feature.)

  6. · first version seen

Learn more

Links from the notice and their documentation checks

No related announcements were found in the saved public history. Check the source for newer announcements.

Not confirmed here

What this page cannot tell you
  • Whether your tenant is affected: this is Microsoft's notice, not a check of your settings.
  • 2 linked pages have not been read yet.
ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 15 Nov 20:10 UTC · 254 of 275 readable · 250 fully read · documentation 468/469 current

No accounts or analytics; your preferences stay in your browser. Information, not advice. ChangeIntel is an independent tool and is not affiliated with or endorsed by Microsoft, Apple, Google, Broadcom (VMware), Jamf, Oracle, Mozilla, or any other vendor it covers. Product names are trademarks of their owners.