--- title: "Microsoft experienced a DMARC failure; Data breach notifications landed in spam folders | DuoCircle" description: "Microsoft experienced a DMARC failure; Data breach notifications landed in spam folders." image: "https://www.duocircle.com/images/og-default.png" canonical: "https://www.duocircle.com/blog/dmarc/microsoft-experienced-dmarc-failure-breach-notifications-landed-in-spam-folders/" --- Quick Answer In July 2024, Microsoft sent breach-notification emails from mbsupport@microsoft.com to tenant admins notifying them of a Russia-linked breach affecting customer data. The messages landed in spam folders because they failed authentication: no SPF or DKIM in the headers, an embedded URL hosted on an Azure PowerApp with a generic DV SSL certificate from a third-party CA, and a request for sensitive account information, which collectively matched standard phishing heuristics. Over 500 organizations flagged the messages as phishing and routed them to sandboxes. The fix is the same DMARC discipline Microsoft asks customers to apply: SPF must list the sending IPs, DKIM must sign every outbound message, and DMARC must align From with the authenticated identity. Run aggregate (rua) and forensic (ruf) reporting to catch any sending source that misses authentication before notifications get binned. Microsoft experienced a DMARC failure; Data breach notifications landed in spam folders Your browser does not support the audio element. [ Download episode](https://media.mailhop.org/duocircle/images/2024/07/Microsoft-experienced-a-DMARC-failure-Data-breach-notifications-landed-in-spam-folders.mp3) Share [ ](https://www.linkedin.com/sharing/share-offsite/?url=undefined%2Fblog%2Fdmarc%2Fmicrosoft-experienced-dmarc-failure-breach-notifications-landed-in-spam-folders%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=Microsoft%20experienced%20a%20DMARC%20failure%3B%20Data%20breach%20notifications%20landed%20in%20spam%20folders&url=undefined%2Fblog%2Fdmarc%2Fmicrosoft-experienced-dmarc-failure-breach-notifications-landed-in-spam-folders%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=undefined%2Fblog%2Fdmarc%2Fmicrosoft-experienced-dmarc-failure-breach-notifications-landed-in-spam-folders%2F "Share on Facebook") [ ](https://reddit.com/submit?url=undefined%2Fblog%2Fdmarc%2Fmicrosoft-experienced-dmarc-failure-breach-notifications-landed-in-spam-folders%2F&title=Microsoft%20experienced%20a%20DMARC%20failure%3B%20Data%20breach%20notifications%20landed%20in%20spam%20folders "Share on Reddit") [ ](mailto:?subject=Microsoft%20experienced%20a%20DMARC%20failure%3B%20Data%20breach%20notifications%20landed%20in%20spam%20folders&body=Check out this article: undefined%2Fblog%2Fdmarc%2Fmicrosoft-experienced-dmarc-failure-breach-notifications-landed-in-spam-folders%2F "Share via Email") ![Data breach notifications](https://media.mailhop.org/duocircle/images/2024/07/sendgrid-alternative-9176.jpg) Recently, [Microsoft](/email-security/microsofts-security-services-heading-in-a-new-direction/) users received data breach notification emails, which, however, were **marked as spam** by Microsoft’s own security tools. The primary reasons triggering suspicion were that the **emails asked for critical account information**, included a link that was not explicitly linked with Microsoft, and had an **inaccurate deployment** **of DMARC**. It came forward that Microsoft, one of the world’s largest IT companies, fell short in following critical elements and best practices of [email authentication](/resources/email-authentication). The company is otherwise renowned for its transparency and sincerity towards [cybersecurity](/). [![cybersecurity](https://media.mailhop.org/duocircle/images/2024/07/hosted-email-server-9315.jpg)](https://media.mailhop.org/duocircle/images/2024/07/hosted-email-server-9315.jpg) ## SPF and DKIM were missing in Microsoft emails Kevin Beaumont, a cybersecurity specialist, took his LinkedIn account to raise this issue, and his post has more than 400 shares. In his post, Beaumont advised checking email logs, including those from Exchange Online, for messages from **[mbsupport@microsoft.com](mailto:mbsupport@microsoft.com)**. _He noted that Microsoft experienced a [breach by Russia](https://www.reuters.com/technology/cybersecurity/microsoft-tells-clients-russian-hackers-viewed-emails-bloomberg-news-reports-2024-06-27/), affecting customer data but did not follow the standard Microsoft 365 customer [data breach process](https://learn.microsoft.com/en-us/compliance/regulatory/gdpr-breach-office365)._ Notifications were emailed directly to [tenant admins](https://help.anaplan.com/tenant-administrator-9f589813-efe1-423a-91df-cfce2d50e9ce) instead of being posted in the portal. These emails might end up in spam folders and tenant admin accounts. He mentioned that organizations were **not informed** through account managers. Beaumont has emphasized the importance of **reviewing all emails since June**, as the [data breach](https://www.bbc.com/news/articles/c51yemmmg9mo) has been widespread. Thanos Vrachnos, a cybersecurity consultant, commented on the original post, sharing that many of his clients have received the email Kevin mentioned. His clients perceived the email as [phishing attempts](https://www.pymnts.com/news/security-and-risk/2024/irs-warns-tax-pros-of-barrage-of-phishing-scams/) since **no SPF and DKIM** were used according to the [email headers](/email-security/why-is-sending-forged-and-impersonated-emails-easy/). > He also emphasized the fact that the URL mentioned was hosted by a simple, **dummy-like** [Azure PowerApp](https://en.wikipedia.org/wiki/Microsoft%5FPower%5FPlatform) with a simple [DV SSL certificate](https://comodosslstore.com/in/ssl-validation-process/dv/what-is-dv-ssl) issued by another trusted CA. On Mastodon, Beaumont mentioned that over 500 organizations had **flagged the emails as phishing attempts** and sent them to [sandboxes](https://testsigma.com/blog/what-is-sandbox/). ## Fixing DMARC [DMARC](/email/dmarc) is based on **SPF and DKIM**. SPF detects and blocks [spoofed emails](https://thehackernews.com/2024/05/nsa-fbi-alert-on-n-korean-hackers.html) by verifying the sender’s IP address against a **list of authorized IPs** published in your domain’s [DNS records](/data-privacy/dns-record-types-defined-and-explained/). [DKIM](/resources/what-is-dkim) uses **cryptographic signatures** to verify that an email was sent from an authorized mail server, ensuring the message’s integrity and authenticity. _DMARC is built on SPF and DKIM, allowing domain owners to specify how [unauthorized emails](https://www.securityweek.com/domains-once-owned-by-major-firms-help-millions-of-spam-emails-bypass-security/) should be handled and providing reports on email authentication failures_. DMARC policies define **how email servers should handle** messages that fail SPF or DKIM checks. There are three types of [DMARC policies](/resources/dmarc-policy): - **None**: Take no action; **just monitor and report** authentication failures. - **Quarantine**: Mark the email as suspicious and **place it in the spam/junk folder**. - **Reject**: Block the email entirely, preventing it from reaching the recipient’s inbox. [![Microsoft Security](https://media.mailhop.org/duocircle/images/2024/07/office-365-tenant-to-tenant-migration-best-practices.jpg)](https://media.mailhop.org/duocircle/images/2024/07/office-365-tenant-to-tenant-migration-best-practices.jpg) [DMARC reporting](/resources/dmarc-aggregate-report) provides domain owners with detailed feedback on email authentication results. There are two types of reports: - **Aggregate reports**: [Summarize](https://www.zerogpt.com/summarizer) the **overall authentication results**, showing which emails passed or failed [SPF](/content/spf-record-check) and DKIM checks. - **Forensic reports**: Provide **detailed information on individual email** failures, helping identify potential security issues and sources of [email spoofing](https://www.darkreading.com/cloud-security/novel-smtp-smuggling-technique-slips-past-dmarc-email-protections). These reports help you **monitor, analyze**, and improve your [email authentication practices](/email-security/email-security-best-practices-in-2024/). ## Topics DMARCemail securityUpdates ![Brad Slavin](https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg) Brad Slavin General Manager General Manager at DuoCircle. Product strategy and commercial lead across the email security portfolio. ## Secure your email infrastructure Protect, authenticate, and deliver. Contact our team to find the right solution. [Contact Sales](/contact/) [Explore Products](/products/) Share this article [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Fdmarc%2Fmicrosoft-experienced-dmarc-failure-breach-notifications-landed-in-spam-folders%2F) [ ](https://twitter.com/intent/tweet?text=Microsoft%20experienced%20a%20DMARC%20failure%3B%20Data%20breach%20notifications%20landed%20in%20spam%20folders&url=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Fdmarc%2Fmicrosoft-experienced-dmarc-failure-breach-notifications-landed-in-spam-folders%2F) [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Fdmarc%2Fmicrosoft-experienced-dmarc-failure-breach-notifications-landed-in-spam-folders%2F) Copy Related Articles - [ ![DuoCircle blog post image](https://media.mailhop.org/duocircle/images/2024/01/dmarc-report-service.jpg) A Guide to Advancing DMARC Policies for Enhanced Email Deliverability DMARC ](/blog/dmarc/a-guide-to-advancing-dmarc-policies-for-enhanced-email-deliverability/) - [ ![Checking DMARC Compliance](https://media.mailhop.org/duocircle/images/2024/06/spf-record-generator-6142.jpg) How to check DMARC compliance for any domain DMARC ](/blog/dmarc/a-guide-to-checking-dmarc-compliance/) - [ ![DMARC problems](https://media.mailhop.org/duocircle/images/2024/10/email-migration-service-8520.jpg) A guide to detecting DMARC problems using the pentesting techniques DMARC ](/blog/dmarc/a-guide-to-detecting-dmarc-problems-using-the-pentesting-techniques/) - [ ![Publishing DMARC Records](https://media.mailhop.org/duocircle/images/2024/06/sender-policy-framework-6712.jpg) How to publish a DMARC record for your domain (with example) DMARC ](/blog/dmarc/a-guide-to-publishing-dmarc-records-for-your-domain/) ## Related Articles [ DMARC 5m A Guide to Advancing DMARC Policies for Enhanced Email Deliverability Jan 19, 2024 ](/blog/dmarc/a-guide-to-advancing-dmarc-policies-for-enhanced-email-deliverability/)[ DMARC 5m How to check DMARC compliance for any domain Jun 25, 2024 ](/blog/dmarc/a-guide-to-checking-dmarc-compliance/)[ DMARC 6m A guide to detecting DMARC problems using the pentesting techniques Oct 3, 2024 ](/blog/dmarc/a-guide-to-detecting-dmarc-problems-using-the-pentesting-techniques/)[ DMARC 8m How to publish a DMARC record for your domain (with example) Jun 12, 2024 ](/blog/dmarc/a-guide-to-publishing-dmarc-records-for-your-domain/) ```json {"@context":"https://schema.org","@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}],"sameAs":["https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.facebook.com/duocirclellc","https://www.g2.com/products/phish-protection-by-duocircle/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://support.duocircle.com"},"knowsAbout":["Email Security","Email Authentication","SPF","DKIM","DMARC","Phishing Protection","Spam Filtering","SMTP Relay","Email Deliverability","Email Forwarding"]} ``` ```json {"@context":"https://schema.org","@type":"WebSite","name":"DuoCircle LLC","url":"https://www.duocircle.com","description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}} ``` ```json [{"@context":"https://schema.org","@type":"BlogPosting","headline":"Microsoft experienced a DMARC failure; Data breach notifications landed in spam folders","description":"Microsoft experienced a DMARC failure; Data breach notifications landed in spam folders.","url":"https://www.duocircle.com/blog/dmarc/microsoft-experienced-dmarc-failure-breach-notifications-landed-in-spam-folders/","datePublished":"2024-07-18T14:24:05.000Z","dateModified":"2025-05-02T14:25:47.000Z","dateCreated":"2024-07-18T14:24:05.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/dmarc/microsoft-experienced-dmarc-failure-breach-notifications-landed-in-spam-folders/"},"articleSection":"dmarc","keywords":"DMARC, email security, Updates","wordCount":518,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2024/07/sendgrid-alternative-9176.jpg","caption":"Data breach notifications","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}},{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":2,"name":"DMARC"},{"@type":"ListItem","position":3,"name":"Microsoft experienced a DMARC failure; Data breach notifications landed in spam folders","item":"https://www.duocircle.com/blog/dmarc/microsoft-experienced-dmarc-failure-breach-notifications-landed-in-spam-folders/"}]}] ``` ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://www.duocircle.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":3,"name":"DMARC","item":"https://www.duocircle.comundefined"},{"@type":"ListItem","position":4,"name":"Microsoft experienced a DMARC failure; Data breach notifications landed in spam folders","item":"https://www.duocircle.com/blog/dmarc/microsoft-experienced-dmarc-failure-breach-notifications-landed-in-spam-folders/"}]} ``` ```json {"@context":"https://schema.org","@type":"BlogPosting","headline":"Microsoft experienced a DMARC failure; Data breach notifications landed in spam folders","description":"Microsoft experienced a DMARC failure; Data breach notifications landed in spam folders.","url":"https://www.duocircle.com/blog/dmarc/microsoft-experienced-dmarc-failure-breach-notifications-landed-in-spam-folders/","datePublished":"2024-07-18T14:24:05.000Z","dateModified":"2025-05-02T14:25:47.000Z","dateCreated":"2024-07-18T14:24:05.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/dmarc/microsoft-experienced-dmarc-failure-breach-notifications-landed-in-spam-folders/"},"articleSection":"dmarc","keywords":"DMARC, email security, Updates","wordCount":518,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2024/07/sendgrid-alternative-9176.jpg","caption":"Data breach notifications","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}} ```