What is enterprise.protection.outlook.com?

It is the hostname of Exchange Online Protection, the filtering layer in front of Microsoft 365. Inbound mail for every Microsoft 365 tenant passes through it, so it evaluates DMARC for any message claiming to be from your domain that is addressed to a Microsoft 365 customer.

Why am I getting DMARC reports from Microsoft when I do not use Microsoft 365?

Because the reporting organisation is whoever received the mail, not the sender. You need no relationship with Microsoft — you need one customer, prospect, supplier or spoofing victim on Microsoft 365, which covers most domains.

What are Microsoft's DMARC reports especially useful for?

Two things. A large share of corporate mailboxes sit behind Microsoft 365, so these reports are the closest view you have of whether your mail authenticates where it matters commercially. And invoice fraud and vendor impersonation target company mailboxes, so forged mail in your name tends to land at Microsoft.

My own Microsoft 365 mail is failing DKIM alignment — why?

DKIM signing for a custom domain is not enabled by default in Microsoft 365. The tenant default signs with an onmicrosoft.com domain, which passes DKIM but does not align with your From address, so DMARC fails. Enabling DKIM for your own domain in the tenant fixes it.

Learn · DMARC report emails

DMARC report from enterprise.protection.outlook.com

Q: Is a DMARC report from enterprise.protection.outlook.com genuine?

Verify rather than guess. Confirm your domain publishes a rua= address pointing at this mailbox, and confirm the gzip-compressed attachment parses as a real DMARC aggregate report. Real reports never ask you to log in, approve anything or open a document.

A report arrives with Submitter: enterprise.protection.outlook.com in the subject and a .xml.gz attachment, and the immediate reaction is usually the same: we don't use Microsoft — why is Microsoft emailing me about my domain? The answer is that the submitter is whoever received mail claiming to be from you, and Microsoft receives a great deal of it. It's a legitimate DMARC aggregate report.

What enterprise.protection.outlook.com actually is

It's the hostname of Exchange Online Protection, the filtering layer in front of Microsoft 365. Every Microsoft 365 tenant on the planet — every business using Outlook for work email — has its inbound mail pass through it. Which means that when anyone sends a message with your domain in the From address to any Microsoft 365 customer, that infrastructure evaluates your DMARC record and adds the result to a daily tally.

So you don't need a relationship with Microsoft to get these. You need one customer, prospect, supplier or spoofing victim on Microsoft 365. That covers most domains.

This is the single most confusing submitter name in DMARC reporting, and it's worth internalising the general rule: the reporting organisation is the receiver, not the sender. The same logic explains reports from universities, hosting companies and security gateways like Mimecast.

Is it legitimate?

Check rather than guess. Microsoft's aggregate reports carry a subject naming your domain as the report domain and enterprise.protection.outlook.com as the submitter, a gzip-compressed XML attachment, and nothing to click.

Confirm your domain publishes a rua= address pointing at this mailbox — the free DMARC checker shows the live record in seconds.
Confirm the attachment is a real report by opening it in the free DMARC report analyzer, which parses it in your browser without uploading anything.

Reports never ask you to log in, approve anything, or open a document. Anything DMARC-themed that does is not a report.

The filename tells you the scope

The format is fixed by the specification, so you can triage without decompressing:

enterprise.protection.outlook.com!yourdomain.com!1755993600!1756079999.xml.gz

Reporter, then the domain being reported on, then the start and end of the window as Unix timestamps — normally 24 hours apart. Microsoft uses gzip where Google uses ZIP; the XML inside is the same format either way.

What Microsoft's reports are especially good for

Two things, both of which Google's reports cover less well.

Business-to-business reach. A large share of corporate mailboxes sit behind Microsoft 365. If your customers are businesses, Microsoft's reports are the closest thing you have to a view of whether your mail is authenticating where it actually matters commercially.

Spoofing aimed at businesses. Invoice fraud and vendor-impersonation attacks target company mailboxes, which means the forged mail lands at Microsoft. Unfamiliar IPs sending as your domain, showing up in Microsoft's reports and nowhere else, is a pattern worth taking seriously.

Reading the rows themselves is the same job as any other reporter: a source IP, a count, and whether SPF and DKIM passed and aligned to your domain. DMARC aggregate reports explained covers each field, and source IPs in DMARC reports covers how to judge an address you don't recognise.

If you do use Microsoft 365

Then you'll see two distinct things in these reports and it's important not to confuse them: your own outbound mail, which should be passing SPF via include:spf.protection.outlook.com and DKIM with your domain in the d= tag, and everything else claiming to be you.

If your own Microsoft-sent mail is failing DKIM alignment, DKIM signing probably hasn't been enabled for your custom domain — it isn't on by default, and the tenant defaults sign with an onmicrosoft.com domain that doesn't align with your From address. Confirm what's actually published with the free DKIM checker, and check your SPF lookup count with the SPF record checker while you're there.

Making them useful instead of annoying

Microsoft reports arrive daily and they arrive forever. Deleting your DMARC record would stop them, and would also delete your only view of who is impersonating your domain — a bad trade at any volume.

Point rua= at a service that parses them instead. Canny Pigeons receives the reports directly, resolves every source IP to a named sender, tracks your alignment over time and alerts you when something changes — free for one domain, hosted DMARC included. For the report in your inbox right now, the free report analyzer reads it immediately.

Free checks: Report analyzer DMARC checker SPF checker DKIM checker

Reports from other submitters too? Why am I getting DMARC report emails? covers the whole set.