Announcing Public Preview of Inbound SMTP DANE with DNSSEC for Exchange Online

LagunaJim Does that specific domain also have MTA-STS? In testing I had possibly similar issues, the documentation is missing a few import steps that can cause issues, already informed IanMcDonald about this. Currently I have Inbound DANE and MTA-STS working and GMail is working as well. I posted my findings on all my socials, but forgot this comment section:

Important: For those who already have MTA-STS in place (enforce): do not forget to lower the TTL of your _mta-sts dns recor, wait for the previous to expire AND change your id value when you change anything in the mta-sts.txt policy file and before you change the MX DNS record.

Otherwise MTA-STS only sending servers will not get the update (until max_age is expired), see an invalid MX record and will not send you mail. You won't see that with sending servers that do not support MTA-STS, or servers that do both but prioritize DANE before MTA-STS.

Additionally, the learn text mentioned earlier setting the MTA-STS config mode from "enforce" to "Test", that should be "testing". But that might already been fixed.

GMail does support outbound MTA-STS, but does not support DANE (to my surprise). Some orgs I used for testing have outbound DANE, but do not support MTA-STS: So that explain that very specific difference.