# Does Microsoft 365 honor DMARC p=reject, and how do you control it?

URL: https://iblockspam.com/blog/microsoft-365-honor-dmarc-policy-reject
Last updated: 2026-10-22
Published: 2026-10-22
Topic: Setup guides
Author: iBlockSpam Team

> Does Microsoft 365 reject mail that fails a sender's DMARC p=reject? How the Honor DMARC setting works, its defaults, overrides, headers and common fixes.

## Short answer

Yes, by default. In Microsoft 365 anti-phishing policies, Honor DMARC record policy when the message is detected as spoof is on by default. Mail failing a sender's p=reject is rejected, and p=quarantine failures are quarantined. Admins can change either action, and allow entries, Safe Senders or mail flow rules can override it.

When a domain publishes DMARC with `p=reject`, it's asking receivers to refuse mail that fails authentication. Whether your Microsoft 365 tenant does that is your choice, made in the anti-phishing policy. This guide explains the setting, its defaults, what overrides it and how to read the result, as documented at the time of writing (October 2026). For publishing DMARC on your own domain, see [DMARC setup for Microsoft 365](https://iblockspam.com/blog/dmarc-setup-microsoft-365).

## Does Microsoft 365 honor DMARC p=reject?

Yes, by default. The anti-phishing setting **Honor DMARC record policy when the message is detected as spoof** (`HonorDmarcPolicy`) is selected by default. With it on, Microsoft 365 rejects messages that fail the sender's `p=reject` policy and quarantines messages that fail `p=quarantine` ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/recommended-settings-for-eop-and-office365)).

That's a decision for each receiver. [RFC 9989](https://www.rfc-editor.org/rfc/rfc9989.html), the current DMARC standard, says "the final handling of any message is always a matter of local policy". It adds that receivers "SHOULD NOT reject messages solely because of a published policy of 'reject'" and should use other analysis to avoid rejecting legitimate mail. Microsoft says something similar: a composite authentication failure "doesn't directly result in a message being blocked."

## What are the Honor DMARC settings and their defaults?

All three settings live in each anti-phishing policy, under spoof protection. These are Microsoft's values for the default policy and the Standard and Strict presets:

| Setting (PowerShell) | Options | Default | Standard | Strict |
|---|---|---|---|---|
| Honor DMARC record policy when the message is detected as spoof (`HonorDmarcPolicy`) | On / Off | On | On | On |
| If the message is detected as spoof and DMARC Policy is set as p=quarantine (`DmarcQuarantineAction`) | Quarantine the message (`Quarantine`), Move to Junk Email folder (`MoveToJmf`) | Quarantine | Quarantine | Quarantine |
| If the message is detected as spoof and DMARC Policy is set as p=reject (`DmarcRejectAction`) | Reject the message (`Reject`), Quarantine the message (`Quarantine`) | Reject | Reject | Reject |
| If the message is detected as spoof by spoof intelligence (`AuthenticationFailAction`) | Junk Email folder, Quarantine | Move to Junk Email folder | Move to Junk Email folder | Quarantine |

Sources: Microsoft's [recommended settings](https://learn.microsoft.com/en-us/defender-office-365/recommended-settings-for-eop-and-office365) and the [Set-AntiPhishPolicy reference](https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/set-antiphishpolicy?view=exchange-ps). If you choose **Quarantine the message**, Microsoft uses the quarantine policy selected for spoof intelligence. Our guide to [anti-phishing policy settings](https://iblockspam.com/blog/microsoft-365-anti-phishing-policy-settings) covers the rest of the policy.

## How does spoof intelligence change what happens?

The outcome depends on two switches: spoof intelligence and Honor DMARC. Microsoft separates **explicit** failures (a sender's DMARC fails) from **implicit** ones (Microsoft's own composite authentication flags a message from a domain with weak or no DMARC).

| | Honor DMARC on | Honor DMARC off |
|---|---|---|
| **Spoof intelligence on** | p=reject and p=quarantine failures use their own DMARC actions. Implicit failures use the spoof intelligence action. p=none: no DMARC action, other filters still apply. | All explicit and implicit failures use the spoof intelligence action. The sender's p= value is ignored. |
| **Spoof intelligence off** | p=reject and p=quarantine failures use their own DMARC actions. No implicit checks. | p=reject and p=quarantine failures use the spoof intelligence action. No implicit checks. |

This is a condensed version of Microsoft's table in [Spoof protection and sender DMARC policies](https://learn.microsoft.com/en-us/defender-office-365/anti-phishing-policies-about). The practical point: with Honor DMARC off, a sender's `p=reject` is treated like any other spoof and goes to Junk by default.

## How do you check and turn on Honor DMARC?

1. In the Microsoft Defender portal, go to **Email & collaboration** > **Policies & rules** > **Threat policies** > **Anti-phishing**, or open `https://security.microsoft.com/antiphishing`.
2. Select each policy, including **Office365 AntiPhish Default**, by clicking its row. In the details flyout, select **Edit** in the actions section.
3. Make sure **Honor DMARC record policy when the message is detected as spoof** is selected.
4. Check the two actions: **Quarantine the message** for p=quarantine and **Reject the message** for p=reject.
5. Save. Microsoft says to allow up to 30 minutes for a policy change to apply.

To review every policy at once in Exchange Online PowerShell:

```powershell
Get-AntiPhishPolicy |
  Format-List Name, Enabled, HonorDmarcPolicy, DmarcQuarantineAction, DmarcRejectAction
```

To set the defaults back explicitly:

```powershell
Set-AntiPhishPolicy -Identity "Office365 AntiPhish Default" `
  -HonorDmarcPolicy $true -DmarcQuarantineAction Quarantine -DmarcRejectAction Reject
```

Policies created by the Standard and Strict preset security policies can't be edited this way. Microsoft applies Strict, then Standard, then custom policies, then the default. If a user is in a preset, its settings win; see [preset security policies](https://iblockspam.com/blog/microsoft-365-preset-security-policies).

## What does a DMARC rejection look like?

For messages Microsoft 365 receives, check the `Authentication-Results` header. Microsoft's [DMARC article](https://learn.microsoft.com/en-us/defender-office-365/email-authentication-dmarc-configure) gives this example of a message that failed alignment (example):

```
Authentication-Results: spf=pass (sender IP is 198.51.100.10)
  smtp.mailfrom=bounces.adatum.com; dkim=pass (signature was verified)
  header.d=adatum.com; dmarc=fail action=oreject
  header.from=contoso.com;compauth=fail reason=000
```

| `action=` value | Meaning (Microsoft) |
|---|---|
| `none` | Sender published p=none; no action taken |
| `quarantine` | Sender published p=quarantine; message quarantined or junked |
| `oreject` | Sender published p=reject; message rejected ("o" = origin) |
| `pct.quarantine`, `pct.reject` | Sender used pct below 100 and this message was in the sampled share |

Our [Microsoft 365 spam headers guide](https://iblockspam.com/blog/microsoft-365-spam-headers-explained) explains `compauth` and the reason codes.

The sender gets a bounce. Microsoft's [NDR reference](https://learn.microsoft.com/en-us/troubleshoot/exchange/email-delivery/ndr/non-delivery-reports-in-exchange-online) lists it as 5.7.509 (example):

```
Access denied, sending domain [example.com] does not pass DMARC verification and has a DMARC policy of reject.
```

Microsoft's DMARC article summarizes the same rejection as `550 5.7.1`, so match on the text, not just the code. If you're the sender, our [5.7.509 reference](https://iblockspam.com/smtp-errors/5-7-509-access-denied) covers the fixes.

## Is Honor DMARC the same as your own DMARC policy?

No. They work in opposite directions, and admins often mix them up.

| | Honor DMARC setting | Your domain's DMARC record |
|---|---|---|
| Where it lives | Anti-phishing policies in your tenant | A TXT record at `_dmarc.example.com` in your DNS |
| Which mail it affects | Mail your users **receive** from other domains | Mail **other receivers** get that claims to be from your domain |
| Who acts on it | Microsoft 365, for your tenant | Gmail, Yahoo, other Microsoft 365 tenants and every other receiver that checks DMARC |
| Changed with | `Set-AntiPhishPolicy` or the Defender portal | Your DNS host |

Your own `p=reject` also has a side effect inside Microsoft 365. Microsoft says outbound mail from your domains that fails DMARC at the destination is routed through its high-risk delivery pool when your policy is `p=reject` or `p=quarantine`, and "there's no override for this behavior." Fix your own senders before you enforce; our [p=none to p=reject guide](https://iblockspam.com/blog/dmarc-none-to-reject-small-business) covers the order.

### What happens to p=quarantine failures?

By default, Microsoft 365 quarantines them, because `DmarcQuarantineAction` defaults to `Quarantine`. You can choose the Junk Email folder instead. Microsoft's DMARC article describes the p=quarantine outcome as "Junk Email folder (configurable to quarantine)", which doesn't match the policy defaults above; check your own policy with `Get-AntiPhishPolicy` rather than relying on either summary. Quarantined messages follow your quarantine policy, which decides whether users can see and release them. See [Microsoft 365 quarantine policies](https://iblockspam.com/blog/microsoft-365-quarantine-policies-notifications).

## What overrides Honor DMARC in Microsoft 365?

Microsoft lists these ways to override the setting for specific messages or senders:

- **Safe Senders.** Users' Outlook Safe Senders lists, or the safelist collection an admin sets in PowerShell.
- **Spoof intelligence insight** allow decisions.
- **Tenant Allow/Block List** allow entries for spoofed senders (see our [Tenant Allow/Block List guide](https://iblockspam.com/blog/microsoft-365-tenant-allow-block-list)).
- **Allowed sender or domain lists** in anti-spam policies.
- **Mail flow rules** that allow messages from particular senders, or that handle mail failing DMARC.

Each override opens a gap for that sender, including forged mail that claims to be from them. Our guide to [allowlisting senders safely](https://iblockspam.com/blog/whitelist-sender-microsoft-365-google-workspace) covers how to keep entries narrow.

## Why is legitimate mail being rejected for DMARC, and how do you fix it?

Start from the rejected message's headers, then work down this list:

1. **The sender's own setup is broken.** A service sends as their domain without aligned SPF or DKIM. This is the most common cause, and the fix is theirs. Send them the bounce or headers.
2. **Forwarding or a mailing list changed the message.** Forwarding breaks SPF, and edits break DKIM. If a known service sits in between, add it in the Defender portal as a trusted ARC sealer under **Email authentication settings** > **ARC** ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/email-authentication-arc-configure)). See [how forwarding breaks SPF and DMARC](https://iblockspam.com/blog/email-forwarding-breaks-spf-dmarc-arc).
3. **A gateway sits in front of Microsoft 365.** Microsoft says Honor DMARC "is applied only if Enhanced Filtering for Connectors is enabled" on the inbound connector. Without it, Microsoft 365 checks the gateway's IP instead of the real sender's.
4. **You need mail now.** Microsoft suggests, in order: a trusted ARC sealer, a mail flow rule matching both the sender IP and domain, or a temporary Tenant Allow/Block List entry.

### Mail that failed DMARC reached the inbox anyway

Microsoft's own troubleshooting table lists `dmarc=fail action=oreject` on a delivered message as a sign that "Honor DMARC [is] disabled, or allow list/override in place". Check the anti-phishing policy that applied, then the Tenant Allow/Block List and mail flow rules.

## Next steps

1. Run `Get-AntiPhishPolicy` and confirm `HonorDmarcPolicy` is `True` in every policy.
2. Review allow entries and mail flow rules that could bypass DMARC, and remove any you can't justify.
3. If a filtering service sits in front of Microsoft 365, confirm Enhanced Filtering for Connectors is on; our [Enhanced Filtering guide](https://iblockspam.com/blog/microsoft-365-third-party-spam-filter-enhanced-filtering) shows how.
4. Check your own domain's DMARC policy with the [DMARC Checker](https://iblockspam.com/tools/dmarc-checker), so the receivers you send to can do the same for you.

If you want filtering in front of Microsoft 365 that keeps these checks working, see how iBlockSpam sets up [Microsoft 365](https://iblockspam.com/platforms/microsoft-365). Browse more [setup guides](https://iblockspam.com/blog/topic/setup).

## Frequently asked questions

### Why did a message that failed p=reject still reach a Microsoft 365 inbox?

Something overrode the sender's policy. Microsoft lists Safe Senders entries, the Tenant Allow/Block List, spoof intelligence allow decisions, allowed senders in anti-spam policies and mail flow rules as overrides. The Honor DMARC setting may also be off in the policy that applied, or a gateway in front of Microsoft 365 may lack Enhanced Filtering for Connectors.

### What does action=oreject mean in a Microsoft 365 header?

It means the sender's domain publishes p=reject and the message failed DMARC. Microsoft's table of action values simply notes that the o stands for origin. Read it alongside where the message ended up, because an override can still deliver a message that carries action=oreject.

### Should I turn off Honor DMARC record policy to stop false positives?

No. Turning it off makes Microsoft 365 ignore p=reject and p=quarantine for every sender and use the spoof intelligence action instead. Fix the specific case: add a trusted ARC sealer for a forwarding service, ask the sender to fix authentication, or add a narrow, temporary allow entry while they do.

### Which bounce does a sender get when Microsoft 365 rejects mail for DMARC?

Microsoft's NDR reference lists 5.7.509: Access denied, sending domain does not pass DMARC verification and has a DMARC policy of reject. Microsoft's DMARC article summarizes the rejection as 550 5.7.1, so check the full text of the bounce rather than the code alone.

### Can I choose to quarantine instead of reject for p=reject failures?

Yes. In each anti-phishing policy, the p=reject action can be Reject the message, the default, or Quarantine the message. In PowerShell, use Set-AntiPhishPolicy with -DmarcRejectAction Quarantine. Quarantined messages use the quarantine policy selected for spoof intelligence.

## Sources

- [Microsoft Learn: Anti-phishing policies (Spoof protection and sender DMARC policies)](https://learn.microsoft.com/en-us/defender-office-365/anti-phishing-policies-about)
- [Microsoft Learn: Recommended settings for EOP and Microsoft Defender for Office 365](https://learn.microsoft.com/en-us/defender-office-365/recommended-settings-for-eop-and-office365)
- [Microsoft Learn: Set-AntiPhishPolicy](https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/set-antiphishpolicy?view=exchange-ps)
- [Microsoft Learn: Set up DMARC to validate the From address domain for cloud senders](https://learn.microsoft.com/en-us/defender-office-365/email-authentication-dmarc-configure)
- [Microsoft Learn: Email non-delivery reports and SMTP errors in Exchange Online](https://learn.microsoft.com/en-us/troubleshoot/exchange/email-delivery/ndr/non-delivery-reports-in-exchange-online)
- [Microsoft Learn: Configure trusted ARC sealers](https://learn.microsoft.com/en-us/defender-office-365/email-authentication-arc-configure)
- [Microsoft Learn: Enhanced Filtering for Connectors in Exchange Online](https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/use-connectors-to-configure-mail-flow/enhanced-filtering-for-connectors)
- [RFC 9989: DMARC, section 5.4 (Policy Enforcement Considerations)](https://www.rfc-editor.org/rfc/rfc9989.html)

## Free tools for this guide

- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject.
- [SMTP Error Code Lookup](https://iblockspam.com/tools/smtp-error-codes): Paste a bounce or type a code like 550 5.7.26: plain-English meaning, likely causes and fixes, with sources.

---

Source: iBlockSpam, https://iblockspam.com/blog/microsoft-365-honor-dmarc-policy-reject (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt