Before sharing my email address with some person or some org, I do an MX DNS lookup on the domain portion of their email address. It’s usually correct. That is, if the result is not of the form *.mail.protection.outlook.com, then that recipient is not using Microsoft’s mail server.
But sometimes I get stung by an exception. The MX lookup for one recipient yielded barracudanetworks.com, so I trusted them with email. But then they sent me an email and I saw a header like this:
Received: from *.outbound.protection.outlook.com (*.outbound.protection.outlook.com…
Is there any practical way to more thoroughly check whether an email address leads to traffic routing through Microsoft (or Google)?
Infosec broadly covers:
Your problem as you describe it boils down to availability (which some would say is the most important infosec factor). I also have a serious availability with Microsoft. When I send email to an MS recipient (back in the days when I was willing to), MS’s servers refuse my msg because MS aggressively implements a strict IP reputation policy. And to be clear, you need not ever send any spam to have a bad IP reputation. You can simply subscribe to an ISP that gives you an IP address which the ISP has published as “residential”. And just like that, the discrimination machine kicks in.
MS does not want mail from self-hosters like myself. They want to force me to dance for them. Even though my email is RFC-compliant, MS wants me to subscribe to a more costly business class of internet service, or to pawn myself to another email service provider.
Either way, MS can fuck off. I will not lick MS’s boots.
First of all, I boycott MS. The boycott is mostly driven by factors unrelated to infosec. Boycotting is no longer just refusal to buy their junk -- boycotting also means to not feed them data because they profit from the data (otherwise, why are they gratis?) I am not generally worried about info in my payloads being specifically exploited in some kind of attack by MS, but I will not feed MS data that it can profit from. I also protest non-US govs throwing away their digital sovereignty and making all their people lick the boots of a privacy-abusing US surveillance advertiser.