By Hamza Faisal
Some of your email may be bouncing right now, and the reason is a single missing DNS record. Since November 5, Microsoft's consumer mail service has been quietly rejecting messages sent from domains that publish no DMARC record — even when the sender's SPF and DKIM checks pass. Microsoft has not announced the change anywhere.
The bounce arrives during the SMTP session, so the message is never delivered and never retried. It reads: "550 5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records (AS9031519)". The rejection comes from the servers behind outlook.com, hotmail.com, live.com and msn.com addresses, and it hits ordinary low-volume senders, not just bulk mailers.
A rejection that ignores working SPF and DKIM
What makes the new bounce so confusing is that it strikes domains whose authentication looks fine. Email security vendor MailRoute, which first spotted the rejections in its own outbound logs on November 5, says the domains it has seen bounced mostly had working SPF, and many had DKIM too. What they were missing was the DMARC record that ties the two to the sender's From address. Without it, Outlook.com now appears to treat the message as unauthenticated.
Independent tests back that up. EasyDMARC reproduced the rejection on November 8 with a domain that had aligned SPF and DKIM but no DMARC record. Another tester sent to 16 Outlook.com and Hotmail mailboxes on November 7 and 8 and saw all 16 refused, while Microsoft 365 business mailboxes accepted the same message — the change appears limited to Microsoft's consumer mailboxes.
The rejections are also intermittent: only some messages bounce, and one sender reported a message being rejected and then delivered when resent 19 minutes later. Reports first surfaced on the mailop mailing list on November 6, and as of November 8 Microsoft had published no blog post, postmaster notice or service-health entry about it.
This is not the old bulk-sender rule
Microsoft does have published sender requirements, but this is not them. In April 2025 it announced that domains sending more than 5,000 messages a day to Outlook.com had to pass SPF and DKIM and publish DMARC, enforced from May 5, 2025 with a different bounce: "550 5.7.515 Access denied". The November rejection breaks from that rule in almost every way: it applies to senders of any volume, it was never announced, and it uses a different error code that does not say which check failed.
That matters because the old rule gave small senders a clear pass. A reply from a small office, a job application or an invoice from a business that never set up DMARC can now bounce with no warning — and the sender may never realise the recipient never saw it.
The fix is one DNS record
The good news is that the fix is small. Publishing a DMARC record — a single TXT record at _dmarc for the domain in the From address, with the value "v=DMARC1; p=none" — stops the rejection. The p=none policy changes nothing about how other receivers treat the mail. Tests found a record at the parent domain works too, and one user reported by Neowin fixed their bounces the same way: once the DMARC record was added, Hotmail accepted the mail again.
There is one condition: DMARC only passes when SPF or DKIM passes for the domain in the From address, so a DMARC record alone will not help if neither lines up. And because Microsoft has not confirmed the change, it could be widened, narrowed or rolled back at any time. For now, any domain that emails Outlook.com addresses without a DMARC record is gambling on every message.
