MC721853: Microsoft New feedback button

Announcement ID	MC711018		Published Date	01-29-2024
Service	Exchange		Last Updated	10-23-2024
Category	Stay informed		Expiration Date	01-13-2025
Roadmap ID	63213		Action Required by Date
Tags	Admin impact, New feature, User impact

Summary
Microsoft Exchange Online now supports inbound SMTP DANE with DNSSEC, enhancing email security. It's in General Availability since October 22, 2024. The feature is off by default and can be enabled via Exchange PowerShell, with a new enabling experience coming by end of 2024. Additional information and limitations are detailed in the provided links.

More Information

We are adding support for DNS-based Authentication of Named Entities (or DANE) for SMTP and Domain Name System Security Extensions (DNSSEC) for inbound mail to Exchange Online. DANE for SMTP is a security protocol that uses DNS to verify the authenticity of the certificates used for securing email communication with TLS and protecting against TLS downgrade attacks. DNSSEC is a set of extensions to DNS that provides cryptographic verification of DNS records, preventing DNS-spoofing and adversary-in-the-middle attacks to DNS. When this will happen: Public Preview: We will begin rolling out in July 2024. General Availability: We begin rolling out early September 2024 (previously late August) and expect to complete by late October 2024 (previously late September). How this will affect your organization: Inbound SMTP DANE with DNSSEC will be off by default. If you do not want to enable the feature, you do not need to do anything. If you want to enable the feature, please follow the documentation using Exchange PowerShell. When the feature is released, the documentation will be in the How can Exchange Online customers use SMTP DANE inbound section of How SMTP DNS-based Authentication of Named Entities (DANE) secures email communications | Microsoft Learn. By the end of 2024, we will release a new experience for enabling DNSSEC and SMTP DANE without using PowerShell. What you need to do to prepare: Review your domain configuration internally to ensure you won't be impacted by any of the limitations below. Not supported: Fully delegated domain, onmicrosoft.com domains, and domains purchased from Microsoft known as viral or self-service sign-up domains Supported with risk: 3rd-party gateways, connectors, and integration with hybrid mail flow (ex. if you are using a connector to smarthost to a domain that you want to enable with DNSSEC, you need to update the smarthost name for that connector ex. contoso-com.mail.protection.outlook.com to match the new MX record that will be provided during DNSSEC enablement or, preferably, to match the tenant's onmicrosoft.com domain ex. tenant-name.onmicrosoft.com before enabling the feature.)