Outlook.com is bouncing mail from small domains with no DMARC record

Outlook.com is bouncing mail from small domains with no DMARC record

6 November 2026: Microsoft's consumer mail service has begun refusing some messages from domains that publish no DMARC record, including ordinary low-volume senders, according to the mail security provider MailRoute. The bounce reads "550 5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records", and adding one DNS record is the reported remedy.

Not yet independently verified. Microsoft has announced nothing about this rejection as far as we can find, so the date and scope rest on MailRoute, a mail vendor, and its logs. How widely it applies, and whether it is permanent, is not known. We will update this when it can be confirmed, and remove this note.

How this differs from Microsoft's published rule

Microsoft's stated requirements date from April 2025 and apply to domains sending more than 5,000 messages a day to its consumer addresses. Those senders must pass SPF and DKIM and publish a DMARC policy of at least p=none, aligned with SPF or DKIM, or receive a 550 5.7.515 error.

MailRoute says the rejection it first saw in its own outbound logs on 5 November is different in three ways. It reaches small senders, even a one-line reply from a small office. It was unannounced, with no postmaster notice, blog post or service-health entry as of 6 November. And it does not say which check failed, while a 5.7.515 bounce lists the SPF, DKIM and DMARC results. Most domains MailRoute saw bounced had working SPF, and many had DKIM too.

Why a partial block is easy to miss

The affected addresses are outlook.com, hotmail.com, live.com and msn.com. Only part of the mail from an affected domain is refused, MailRoute says: one message goes through, the next bounces, and a resend may succeed. A later form of the error appends a bracketed code such as (AS9031519).

Businesses that write to people at personal addresses are the most exposed: patients, applicants, parents and homeowners. Invoices and appointment confirmations can fail while the sender assumes a glitch.

The check and the DNS record

Anyone can test a domain from a terminal with dig +short TXT _dmarc.example.com, substituting their own domain. A line starting with v=DMARC1 means a record exists, and no output means it does not.

MailRoute's remedy is a TXT record named _dmarc with the value v=DMARC1; p=none. That policy declares that the domain uses DMARC and tells receivers to take no action on failures, so it does not change how other providers treat the mail. Microsoft's 2025 rule also expects alignment with SPF or DKIM, so a domain adding the record should confirm that one of them matches the visible From address.

Tools for the job

Our email security category lists 11 products, and our email marketing category lists nine, for teams whose sending platform handles these records for them.

Sources

• MailRoute: Outlook is rejecting email without DMARC, 6 November 2026
• Microsoft Defender for Office 365 blog: Strengthening email ecosystem, Outlook's new requirements for high-volume senders, 2 April 2025