ChangeIntelIT change radar
Public mode

No access to your tenant or devices. Every item links to its source. What this means

Some sources, documents or advisories need attention: 267/272 feeds/APIs · 469/469 docs · 7/9 advisories · checked 17:47 UTC Customize Public modeDiscuss ChangeIntel on Discord
MC886603 Plan for changeMajor changeUpdated messageUser impactAdmin impact

Reject multiple From addresses (P2 From headers) without a Sender header

Microsoft 365 Message Center Archive by Merill Fernando · Microsoft may not have sent this notice to your tenant.
Exchange Online
Microsoft 365 admin center

Rollout

Rollout dates are often only in the text. When Microsoft moves them, the change shows under "What changed".

Schedule dates changed in the text

Date phrases in schedule sentences differ between the versions this installation saw
  • Seen 2 Jul 2025 July 1, 2025, August 1, 2025 → October 7, 2025, November 1, 2025
  • Seen 21 Mar 2025 April 15 2025 → May 15, 2025, July 1, 2025, August 1, 2025
  • Seen 28 Feb 2025 February 3, 2025, February 3rd 2025 → the end of May 2025, April 15, 2025, April 15 2025
  • Seen 8 Nov 2024 December 1st, 2024 → February 3, 2025, February 3rd 2025
  • Seen 20 Sep 2024 October 15, 2024 → December 1st, 2024

Read from date phrases in Microsoft's text, not from notice metadata. A changed phrase can be a moved rollout, a new milestone or just rewording; "What changed" below shows which.

What the notice says

Microsoft’s text, with source markup removed
Updated July 2, 2025: We have updated the timeline below. Thank you for your patience.  We are proactively opting tenants out of the rollout that were detected as sending high volumes of emails exhibiting multiple From addresses without a Sender address header. These exempted senders will only be able to send emails exhibiting multiple From addresses without a Sender address header to recipients belonging to the same tenant as the sender. We will provide a subsequent update by the end of May 2025 (previously end of March) with an updated timeline for tenants that are opted out. We're going to start gradually dropping messages that have multiple From addresses (also known as P2 From headers) without a Sender header from being processed via Exchange Online, please review the section "When this will happen" for rollout timeline information for your tenant. If we see significant traffic exhibiting multiple From addresses (P2 From headers) without a Sender header in your tenant in the month of September, we will send you a Message Center Post by October 15th alerting you and providing some sample message IDs. We are doing this to comply with RFC 5322 (https://www.rfc-editor.org/rfc/rfc5322#section-3.6.2) which mandates the Sender header to be present and contain a single address if the From header has more than one address. Noncompliance with this could be exploited by attackers, allowing them to impersonate a sender address by misleading the client into using the From header to determine the sender instead of the Sender header. When this will happen: General Availability (Worldwide, GCC): We will begin rolling out April 15, 2025, and expect to complete by May 15, 2025. GCC High, DOD: We will begin rolling out October 7, 2025 (previously July 1), and expect to complete by November 1, 2025 (previously August 1). We are delaying the rollout start date in order to provide more time to customers for investigating messages exhibiting multiple P2 From Addresses without a Sender Address.  Most of the traffic exhibiting multiple P2 From Addresses without a Sender Address will be inbound spam destined for your tenant sent by malicious spammers on the internet. Some customers are sending legitimate emails with this malformed header configuration. On October 15, we sent a targeted MC post to customers showing high volumes of messages exhibiting multiple P2 From Addresses without a Sender Address as they may be impacted by this change. For investigating if you will be impacted by this change, focus your investigation on messages sent using On Premises Inbound Connectors to Exchange Online. Authenticated mail submission is not impacted because submitting messages like this using those submissions are not allowed (Graph, Outlook clients, SMTP AUTH Client Submission). How this affects your organization: If email clients including devices and applications that you use to send messages, do so using multiple From addresses but without a Sender address header after the change starts rolling out to your environment, you will get an NDR error code 550 5.1.20 “Multiple From addresses are not allowed without Sender address. What you can do to prepare: When this change is in effect, if you need to send a message that has more than one email address in the From field, make sure that you have a single email address in the Sender header. If you expect this change to cause any issues for your organization, please share that feedback.

What changed

Between archive captures, newest first

  1. Updated March 21,July 2, 2025: We have updated the rollout timeline below. Thank you for your patience.  We are proactively opting tenants … by May 15, 2025. GCC High, DOD: We will begin rolling out October 7, 2025 (previously July 1, 2025, 1), and expect to complete by AugustNovember 1, 2025.2025 (previously August 1). We are delaying the rollout start date in order to provide more …

  2. Updated February 28,March 21, 2025: We have updated the rollout timeline below. Thank you for your … of March) with an updated timeline for tenants that are opted out. Starting April 15, 2025 (previously February 3), we're We're going to start gradually dropping messages that have multiple From addresses (also … P2 From headers) without a Sender header from being processed via Exchange Online.Online, please review the section "When this will happen" for rollout timeline information for your tenant. If we see significant traffic exhibiting multiple From addresses (P2 From headers) … determine the sender instead of the Sender header. When this will happen: General Availability (Worldwide, GCC): We will begin rolling out April 15, 2025 (previously February 3)2025, and expect to complete by May 15, 2025. GCC High, DOD: We are delaying the rollout start date from Decemberwill begin rolling out July 1, 2025, and expect to April 15, 2025 (previously February 3)complete by August 1, 2025. We are delaying the rollout start date in order to provide more time to customers for investigating messages exhibiting multiple P2 From Addresses without a Sender Address.   Most of the traffic exhibiting multiple P2 From Addresses without a Sender … so using multiple From addresses but without a Sender address header after April 15 2025 (previously December 1st),the change starts rolling out to your environment, you will get an NDR error code 550 5.1.20 “Multiple From addresses are not allowed without Sender address’”.address. What you can do to prepare: When this change is in effect, …

  3. Updated February 14,28, 2025: We have updated the rollout timeline below. Thank you for your patience.  We are proactively opting tenants out of the rollout that were detected as … the sender. We will provide a subsequent update by the end of MarchMay 2025 (previously end of March) with an updated timeline for tenants that are opted out. Starting February 3April 15, 2025 (previously December 1),February 3), we're going to start gradually dropping messages that have multiple From addresses … determine the sender instead of the Sender header. When this will happen: February 3,April 15, 2025 (previously December 1st)February 3) We are delaying the rollout start date from December to February 3rdApril 15, 2025 (previously February 3) in order to provide more time to customers for investigating messages exhibiting … so using multiple From addresses but without a Sender address header after April 15 2025 (previously December 1st,1st), you will get an NDR error code 550 5.1.20 “Multiple From addresses …

  4. Updated January 31,February 14, 2025: We are proactively opting tenants out of the rollout that were … the sender. We will provide a subsequent update by the end of FebruaryMarch with an updated timeline for tenants that are opted out. Starting February …

  5. Updated November 6, 2024:January 31, 2025: We are proactively opting tenants out of the rollout that were detected as sending high volumes of emails exhibiting multiple From addresses without a Sender address header. These exempted senders will only be able to send emails exhibiting multiple From addresses without a Sender address header to recipients belonging to the same tenant as the sender. We have updatedwill provide a subsequent update by the content. Thank youend of February with an updated timeline for your patience.tenants that are opted out. Starting February 3 (previously December 1), we're going to start gradually dropping … (also known as P2 From headers) without a Sender header from being sentprocessed via Exchange Online. If we see significant traffic exhibiting multiple From addresses …

  6. Updated September 20,November 6, 2024: We have updated the content. Thank you for your patience. Starting February 3 (previously December 1st,1), we're going to start gradually dropping messages that have multiple From addresses … determine the sender instead of the Sender header. When this will happen: February 3, 2025 (previously December 1st, 20241st) We are delaying the rollout start date from December to February 3rd 2025 in order to provide more time to customers for investigating messages exhibiting multiple P2 From Addresses without a Sender Address. Most of the traffic exhibiting multiple P2 From Addresses without a Sender Address will be inbound spam destined for your tenant sent by malicious spammers on the internet. Some customers are sending legitimate emails with this malformed header configuration. On October 15, we sent a targeted MC post to customers showing high volumes of messages exhibiting multiple P2 From Addresses without a Sender Address as they may be impacted by this change. For investigating if you will be impacted by this change, focus your investigation on messages sent using On Premises Inbound Connectors to Exchange Online. Authenticated mail submission is not impacted because submitting messages like this using those submissions are not allowed (Graph, Outlook clients, SMTP AUTH Client Submission). How this affects your organization: If email clients including devices and applications …

  7. The text changed; it is too long to compare word by word here.

    • Tags User impact, Admin impact → Updated message, User impact, Admin impact

    Updated September 20, 2024: We have updated the content. Thank you for your patience. Starting October 15th,December 1st, we're going to start gradually dropping messages that have multiple From addresses … From headers) without a Sender header from being sent via Exchange Online. If we see significant traffic exhibiting multiple From addresses (P2 From headers) without a Sender header in your tenant in the month of September, we will send you a Message Center Post by October 15th alerting you and providing some sample message IDs. We are doing this to comply with RFC 5322 (https://www.rfc-editor.org/rfc/rfc5322#section-3.6.2) which mandates … determine the sender instead of the Sender header. When this will happen: October 15,December 1st, 2024 How this affects your organization: If email clients including devices and … so using multiple From addresses but without a Sender address header after October 15th,December 1st, you will get an NDR error code 550 5.1.20 “Multiple From addresses …

  9. · first version seen

Linked documentation

Microsoft pages the notice links to

The notice links to no Microsoft Learn or Support page that this installation reads.

No related evidence found in this installation's recent collection. This does not establish that no announcement exists.

Not confirmed here

What this page cannot tell you
  • Whether your tenant is affected: this is Microsoft's notice, not a check of your settings.
ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 26 Oct 17:47 UTC · 267 of 272 readable · 266 fully read · documentation 469/469 current

No accounts or analytics; your preferences stay in your browser. Information, not advice. ChangeIntel is an independent tool and is not affiliated with or endorsed by Microsoft, Apple, Google, Broadcom (VMware), Jamf, Oracle, Mozilla, or any other vendor it covers. Product names are trademarks of their owners. Built by Evotec.