Microsoft Exchange Online will support inbound SMTP DANE with DNSSEC starting from lMay 2024. Inbound SMTP DANE with DNSSEC will be off by default, and if you do not want to enable the feature, you do not need to do anything. If you want to enable the feature, follow the documentation using Exchange PowerShell. Review your domain configuration internally to ensure you won't be impacted by any of the limitations.
MC711018 – Updated July 17, 2024: Microsoft has updated the rollout timing below. Thank you for your patience.
Microsoft is adding support for DNS-based Authentication of Named Entities (or DANE) for SMTP and Domain Name System Security Extensions (DNSSEC) for inbound mail to Exchange Online. DANE for SMTP is a security protocol that uses DNS to verify the authenticity of the certificates used for securing email communication with TLS and protecting against TLS downgrade attacks. DNSSEC is a set of extensions to DNS that provides cryptographic verification of DNS records, preventing DNS-spoofing and adversary-in-the-middle attacks to DNS.
This message is associated with Microsoft 365 Roadmap ID 63213.
When this will happen:
Public Preview: Microsoft will begin rolling out in July 2024.
General Availability: Microsoft begin rolling out early September 2024 (previously late August) and expects to complete by late October 2024 (previously late September).
How this will affect your organization:
Inbound SMTP DANE with DNSSEC will be off by default. If you do not want to enable the feature, you do not need to do anything.
If you want to enable the feature, please follow the documentation using Exchange PowerShell. When the feature is released, the documentation will be in the How can Exchange Online customers use SMTP DANE inbound section of How SMTP DNS-based Authentication of Named Entities (DANE) secures email communications | Microsoft Learn. By the end of 2024, we will release a new experience for enabling DNSSEC and SMTP DANE without using PowerShell.
What you need to do to prepare:
Review your domain configuration internally to ensure you won’t be impacted by any of the limitations below, and visit Implementing Inbound SMTP DANE with DNSSEC for Exchange Online Mail Flow – Microsoft Community Hub for more detailed information on limitations:
Previous Exchange Online Changelog Messages
Whether it’s Security or Cloud Computing, we have the know-how for you. Sign up for our newsletters here.