How do I fix incoming emails being rejected?

When you say "This is not something Microsoft can fix" you mean this is not something Microsoft are willing to fix. It can clearly be fixed by not mandating these configurations. I appreciate there are good reasons for this mandate but if protecting users from spam is at the cost of blocking legitimate emails then that's not helpful.

I don't really speak on behalf of Microsoft, and I do see your pov, but I will explain a bit further.

These days, many businesses don’t send emails directly from the company that hosts their domain. Instead, they often use third-party services to send email on their behalf. For example, they might use Constant Contact to send newsletters, Square to send receipt and booking confirmation, or Salesforce to send customer service emails. If a company registers its domain (e.g., business.com) with Provider A but uses Provider B to send email on behalf of @business.com, then the company must add Provider B’s SPF, DKIM, and DMARC records into its DNS at Provider A. This ensures that when Provider B sends mail, the messages pass authentication checks and are not flagged as spoofed spam.

Since May of this year, Microsoft has been enforcing strict SPF, DKIM, and DMARC checks for high-volume senders. If senders fail to configure these records properly, Microsoft may reject their incoming emails.

Not every email provider mandates these protocols yet, and many businesses are still not fully compliant. That said, the trend is clear: Microsoft is not the only provider requiring SPF, DKIM, and DMARC. Other major email platforms such as Google, Yahoo, and Apple are also tightening their authentication requirements, and many governments and industry regulators now recommend or mandate them. The shift is industry-wide, driven by the need to combat phishing and spoofing, so organizations should expect these standards to become the norm across all major providers.