Outlook.com is rejecting some mail from domains with no DMARC record

Ecosystem NewsSecurity Insights

If mail you send to outlook.com or Hotmail addresses is bouncing, check whether your sending domain publishes a DMARC record. Since November 5, Microsoft’s consumer mail service has been rejecting some messages from domains that don’t.

The bounce reads:

550 5.7.1 – “Message rejected: Message lacks SPF/DKIM/DMARC Auth Records (AS9031519)”

You may also see it without the code at the end:

550 5.7.1 – “Message rejected: Message lacks SPF/DKIM/DMARC Auth Records”

What we know so far

• The bounces hit mail sent to outlook.com, hotmail.com, live.com, and msn.com addresses when the sending domain has no DMARC record.
• Domains with working SPF and DKIM have bounced too, and only some messages fail.
• People on a Microsoft Q&A thread report rejected mail from senders on several different providers, and some of it arrived when the sender tried again.
• Only consumer Outlook appears affected: a domain with no DMARC record was rejected by Outlook.com but accepted by a Microsoft 365 business address.
• Small senders are affected, though Microsoft’s published rule only covers senders at 5,000 or more messages a day.

How this differs from the 5.7.515 bounce

Microsoft’s earlier rule for Outlook.com applies to senders of 5,000 or more messages a day, and senders who fall short get a 550 5.7.515 bounce. That bounce says the sending domain does not meet the required authentication level, and it can list the SPF, DKIM, and DMARC results for the message. The new bounce only says authentication records are missing, so it doesn’t show which check failed.

What Microsoft has said

As of November 9, 2026, Microsoft has acknowledged the ongoing issue as a service degradation and is being investigated. Microsoft has not announced or confirmed the change. As of November 9 they had posted no postmaster notice, blog post or service health entry, and nothing had appeared by November 9.

On a Microsoft Q&A thread, a moderator wrote on November 7 that forum contributors can’t confirm whether the reports have been escalated to Microsoft’s Outlook.com mail protection team. The moderator recommended that affected people send their failed bounce messages to outlook.com support, and told one user that intermittent rejections on two accounts from senders on different providers make this broader than a single obvious configuration issue on the sender’s domain. 

This suggests that this issue is caused by a bug and not a deliberate change to their DMARC requirements. They haven’t elaborated on the root cause yet. 

What to do

Publish a DMARC record for every domain you send mail from. dmarcian’s DMARC Record Wizard walks you through building one, and p=none is the policy to start with. This is part of our suite of free tools and no account is required. Two commenters on a Microsoft Q&A thread report that adding a DMARC record stopped the bounces.

Pair the record with a free dmarcian account so you can start seeing who is sending mail as your domain.

SPF or DKIM must still pass and align with the From domain, meaning the domain they authenticate matches the one in your From address. DMARC passes only when one of them does.

If you are the one receiving the mail, a Microsoft Q&A moderator says a personal outlook.com address doesn’t need DMARC records of its own because Microsoft manages the DNS records for the outlook.com domain. The moderator adds that the rejection more likely concerns the sender’s domain and that adding the sender to Safe senders is unlikely to help because the message is rejected before it reaches your mailbox. The moderator’s advice is to ask the sender to give their email administrator or provider the full bounce message, so they can check the domain’s SPF, DKIM, and DMARC setup.

Don’t park your DMARC policy at p=none

A p=none policy meets Microsoft’s minimum for bulk senders, and it is the right first step because it reports without changing how receivers handle your mail. It asks receivers to take no action on mail that fails DMARC, so spoofed mail in your name still reaches inboxes. The usual path from there is to read your reports, fix the legitimate senders that fail, then move to p=quarantine and on to p=reject.

Mailbox provider requirements have tightened in steps, and each step has bounced mail from senders who were not ready. Gmail and Yahoo set bulk sender rules in February 2024, Microsoft announced its own for Outlook.com in April 2025; on November 5, 2026, Outlook.com began rejecting some mail from domains with no DMARC record, smaller senders included. 

On the regulatory side, PCI DSS 4.0 has required protection against phishing since March 31, 2025 (requirement 5.4.1), and its guidance names DMARC as an example control. 

In the EU, the NIS2 requires cloud and managed service providers to plan for modern email security standards; the European Union Agency for Cybersecurity (ENISA) guidance includes DMARC as an example of such standards.

This post reflects what was known on November 9, 2026.

---

Want to continue the conversation? Head over to the dmarcian Forum.