Gmail, Yahoo and Microsoft now enforce authentication on bulk senders. Here is the sequence that gets you to reject without losing legitimate mail.
Gmail and Yahoo began enforcing sender requirements in February 2024, and Microsoft's consumer domains followed in May 2025. Enforcement escalated from temporary deferrals to permanent rejections in November 2025, which means a misconfiguration now loses mail silently rather than retrying.
The first is going straight to reject without a monitoring period, which blocks the invoicing system nobody remembered. The second is collecting aggregate reports and never reading them, which means the monitoring period achieved nothing. Both are avoidable by treating the p=none phase as work rather than a waiting period.
A domain you own but do not send from should publish a null MX record and a DMARC record at p=reject. Otherwise it remains a usable vehicle for spoofing your own brand.
More
PHIPA sets out specific circumstances that make reporting to the Information and Privacy Commissioner mandatory, plus an annual filing most clinics do not know about.
Read the note: When an Ontario clinic must report a privacy breach
The shared responsibility model puts availability on Microsoft and your data on you. Most Ontario businesses we assess have no third party backup of mail, SharePoint or OneDrive.
Read the note: Microsoft does not back up your Microsoft 365 data
A short read on what the federal privacy law expects from a commercial organisation, and the breach reporting obligation that catches people out.
