nope.
DANE is fine (security wise), but not necessity. do you mean gmail/outlook reject email without DNSSEC+DANE? that’s unrealistic…, DANE enabled providers are still very few for it to be the norm.
and nothing to do with o365 issues.
btw, another dane check for smtp : https://dane.sys4.de/
The problem is most likely not your server.
Microsoft has a history of this.
Regardless of whether your records are correct.
Microsoft has your IP address on a blacklist.
You contact them, they help you, and then the problem reappears.
Use https://www.mail-tester.com/
It’s probably rNds.
Or the private key in DKIM might be incorrect.
Also check:
I solved the problem by changing my IP address.
And for critical services, I subscribed to Zoho Mail for a couple of domains.
As others said, nothing good to expect from company like Microsoft (neither its “Brothers”). Or they make money on you, a way or another, or they block everything from you (Even search engine result after 5 Years).
If you don’t bring them money, directly or indirectly (It might be by having they third party APIs on your site), and don’t bring any kind of shadow around them, or your hosting provider don’t do it for you
(sometime it’s the hosting provider who pay to make sure all IPs are clean); You can be sure you will never get your mail in the right box.
Then (as @lawk said) you may, sometime, find a kind of legal trick which put them in a delicate/tough situation, and they will temporarily “fix” it. But as long as they don’t make money, you will not get anything (They have to be profitable on you if they want to make sure you will not be more profitable than them).
That’s not been my experience. Microsoft/Outlook/Hotmail have historically been more likely to ban IPs semipermanently, which isn’t something Google does (as far as I’ve seen, except for, like dynamically assigned address spaces like home ISPs and such, which everybody blocks). And, the process you have to go through the get unblocked is kind of a pain, and requires signing up to a Microsoft service (free).
But, once you’ve unblocked an IP, if your IP isn’t doing ongoing abusive shit, you won’t get banned again.
If you’re sending a bunch of email to Microsoft mail users and you’re not really careful about doing so responsibly (i.e. they actually asked for the emails you’re sending them and you respond quickly to unsubscriptions and don’t resend to bounding/rejected addresses more than is reasonable), you will get banned again.
So, as I said above: If you need to send a lot of email, you probably want to outsource your deliverability to someone like Mailgun/Sendgrid, whatever. And, if you keep getting blocked by Microsoft after unblocking an IP, it means your server is spamming Microsoft, and you need to figure out which of your users is doing so (or which web app has been compromised).
All this talk about DANE and DNSSEC is not why you’re getting blocked. You do need SPF, you do need DKIM, you do need a valid PTR (that resolves both ways, but if does not need to resolve to your system hostname). But, if you have those and you’re getting blocked over and over, it is because you’re sending spam.
If dnssec is setup wrong this can cause delivery issues. It either needs to be perfect or not on.