Table of Contents
Summary
- Admins can control MTA-STS and SMTP DANE validations for outbound emails in Exchange Online with three modes: Opportunistic, None, and Mandatory.
- Default setting for outbound connectors will be Opportunistic Mode, which allows sending emails even if the destination doesn’t support MTA-STS or SMTP DANE.
- Selecting None disables both validations, potentially reducing email security against downgrade attacks and spoofed MX redirection.
- Mandatory mode enforces full SMTP DANE and DNSSEC validation, queuing emails if the destination doesn’t support it.
- No action is needed if admins choose to keep current validation settings; documentation will be available for those who wish to make changes.
Admin Impact: Medium
User Impact: Low
Release Start: 28 Feb 2026
Release End: 31 Mar 2026
Services: Exchange
Category: Stay informed
Tags: New Feature, User Adoption,Admin Action
History
1/22/2026 Item Added to Message Center
Microsoft Message
Introduction
This feature provides admin’s control over Outbound MTA-STS and SMTP DANE validations for emails sent over outbound connectors in Exchange Online, allowing organizations to choose how strictly the service enforces MTA-STS and SMTP DANE when sending mail to external domains.
Admins will be able to configure each outbound connector to use the following modes:
- Opportunistic default, applies to both MTA-STS and SMTP DANE. Opportunistic Mode means Exchange Online will attempt to perform validations for both MTA-STS and SMTP DANE but still sends the message if the destination doesn’t support either protocol.
- None, which applies to both MTA-STS and SMTP DANE and disables the validation entirely, therefore reducing the security of emails sent over that connector by removing MTA-STS and/or SMTP DANE protections designed to prevent downgrade attacks and spoofed MX redirection.
- Mandatory, applies only to SMTP DANE and enforces full SMTP DANE and DNSSEC validation, requiring the destination to support Inbound SMTP DANE with DNSSEC and queueing mail if the validation does not succeed.
When this will happen
General Availability (Worldwide): We will begin rolling out in late February 2026 and expect to complete by late March 2026.
How this will affect your organization
Connectors will default to Opportunistic Mode. Opportunistic Mode is already the default behavior for Exchange Online outbound connectors.
What you need to do to prepare
If you do not want to change the MTA-STS and/or SMTP DANE validation behavior for your outbound connectors, there is no action you need to take and you can ignore this post.
If you do want to change the MTA-STS and/or SMTP DANE validation behavior for your outbound connectors, review the documentation on this feature which will be updated and provided in this post prior to release.
Compliance considerations
No compliance considerations identified. Review as appropriate for your organization.