Outlook.com Is Bouncing Email From Domains Without DMARC

This one landed close to home this week: a business we were talking to ran into it. They are far from alone. Since November 5, mail administrators around the world have been reporting the same bounce, and most of the domains involved had working SPF and DKIM. What they did not have was DMARC.

What is happening

Microsoft’s consumer email service, the one behind outlook.com, hotmail.com, live.com and msn.com addresses, has started refusing some messages from domains that do not publish a DMARC record. The sender gets a bounce like this:

550 5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records (AS9031519)

Three details make this one easy to miss:

• It is intermittent. One message bounces, the next one goes through. Resending often works, so people shrug and move on, and the next important email bounces too.
• It does not depend on volume. Reports include offices that send a couple of dozen emails a week. Microsoft’s published rule from May 2025 only covered domains sending more than 5,000 messages a day, and it used a different error code, 5.7.515.
• The error can point you the wrong way. If you send from Microsoft 365, the bounce may arrive wrapped in a “5.7.23 Sender Policy Framework violation” message. That sends people to fix their SPF, which is usually not the problem.

Business mailboxes hosted on Microsoft 365 do not appear to be rejecting this way. It is the personal Outlook and Hotmail addresses, which is exactly where many small businesses’ customers are.

What Microsoft has said

Almost nothing. As of November 9 there was no announcement, no post on Microsoft’s sender support pages and no service health entry. Moderators on Microsoft’s support forum have reportedly described it as an issue under investigation.

So we do not know whether this is a new rule rolled out without warning or a filter misbehaving. There are also scattered reports of rejections from domains that do have DMARC, which nobody has been able to confirm yet. We will update this article if Microsoft explains it.

What we do know is what has worked. One deliverability expert removed DMARC from their own test domains and the rejections started. Senders who added a DMARC record saw them stop. That matches what the rest of the industry has been asking for since Google and Yahoo made DMARC mandatory for bulk senders in 2024.

Why so many businesses on Microsoft 365 are missing DMARC

When you connect your own domain to Microsoft 365, the setup walks you through the records it needs to deliver your mail. DMARC is not one of them. Microsoft’s own documentation says it plainly: “There are no admin portals or PowerShell cmdlets in Microsoft 365 for you to manage DMARC TXT records in your custom domains.” You have to create it yourself, at whoever hosts your DNS.

If whoever set up your email did not know that, your domain has been running without DMARC for years, and until now nothing visibly broke.

One more trap: if you look at the headers of a message you sent and see dmarc=bestguesspass, that does not mean you have DMARC. Microsoft’s documentation explains that it means no DMARC record was found and Microsoft guessed.

What to do this week

1. Check whether your domain has DMARC. Our free Email Health Check looks up your SPF, DKIM and DMARC in one go and tells you what is missing.

2. Make sure SPF or DKIM is aligned for every service that sends as you. DMARC only passes when SPF or DKIM passes for your own domain. That includes Microsoft 365 (turn on DKIM signing for your domain in the Defender portal), and also your invoicing system, your newsletter tool, your website’s contact form and anything else that sends with your address in the From line.

3. Publish a DMARC record. At your DNS host, add a TXT record named _dmarc with a value like:

v=DMARC1; p=none; rua=mailto:[email protected]

p=none tells receivers to report, not block, so it will not stop any of your own mail. The rua address receives daily reports that show every service sending as your domain, including the ones you forgot about.

4. Resend what bounced. A 550 error is permanent. Your server will not retry it. Search your sent items for bounces since November 5 and send those messages again.

5. Do not stop at monitoring. A record at p=none fixes the bounce, but it does nothing to stop someone from sending fake invoices in your name. Once the reports show all your legitimate senders passing, the goal is p=quarantine and then p=reject. Our SPF, DKIM and DMARC guide walks through it step by step.

The bigger point

DMARC has been the recommendation for a decade, and the big mailbox providers have been moving from recommending it to requiring it: Google and Yahoo for bulk senders in 2024, Microsoft for bulk senders in 2025, and now, apparently, Microsoft for everyone else, without a warning. Whether or not this week’s behavior turns out to be deliberate, it is the direction everything is going.

Email authentication is one of those things that works quietly until a provider changes a rule, and then customers stop getting your quotes and nobody knows why. If you would rather have someone watching it, that is part of our email security service. Or talk to us and we will look at your domain with you.

Sources: Microsoft Learn, Set up DMARC in Microsoft 365, Microsoft, Outlook requirements for high-volume senders (2025), Windows Latest, MailRoute, Engagor.