Outlook Is Now Rejecting Email Without a DMARC Record: What Microsoft's Quiet Change Means for Your Business

Since 5 November, Microsoft's consumer mail services have been quietly bouncing messages from domains that have no DMARC record. Outlook.com, Hotmail, Live and MSN addresses are all affected, and Microsoft has not said a word about it. There was no announcement, no blog post, no service health notice. Mail administrators simply started seeing strange rejections in their logs and began comparing notes.

If your business sends order confirmations, password resets, invoices or a newsletter, and some of your recipients use Microsoft mailboxes, this change concerns you directly. Unlike earlier rounds of email authentication rules, this one does not care how small you are. Low-volume senders are getting caught just as often as the big ones.

In this post we look at what exactly changed, why a working SPF and DKIM setup is suddenly not enough, and how one DNS record fixes the problem before more of your mail silently disappears. Let's sink in!

What Actually Changed on 5 November

The first reports appeared on 5 November 2026. Senders whose domains publish no DMARC policy started receiving a permanent bounce from Microsoft's consumer platforms: 550 5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records (AS9031519). On the first day the same message went out without the AS9031519 code, which made it even harder to search for.

The filtering service MailRoute, whose team documented the change from its own outbound logs, notes that only some messages are rejected. Others from the same domain get through, and a resend may succeed minutes later. That intermittent behaviour is the worst part, because a successful delivery proves nothing about whether your domain is safe.

As of this writing Microsoft has still not acknowledged the change publicly. There is no documentation describing the new requirement, no deadline announced in advance, and no grace period. The rule simply went live.

Why SPF and DKIM Alone No Longer Save You

Here is the detail that surprises most people. The majority of domains hit by these bounces already had working SPF records, and many had DKIM signing configured too. The missing piece was DMARC, and that is exactly what the new filter checks for.

DMARC is the layer that ties SPF and DKIM to the domain your recipients actually see in the From line. SPF confirms the sending server is allowed to send for a domain, and DKIM confirms the message was not altered in transit. But neither of them, on its own, guarantees that the domain in the From address is the one that was authenticated. DMARC closes that gap by requiring at least one of the two checks to pass for the From domain itself, something the industry calls alignment.

There is a common trap here for Microsoft 365 users. Until you enable custom DKIM for your own domain, Microsoft signs your outgoing mail with its onmicrosoft.com domain, and that signature does not count towards DMARC alignment. So a company can believe DKIM is on and still fail.

This Was Coming: From Bulk Senders to Everyone

The move did not come out of nowhere. Google and Yahoo required DMARC from bulk senders back in February 2024. Microsoft followed in May 2025 with its own rule: anyone sending more than 5,000 messages a day to Outlook.com had to pass SPF, DKIM and DMARC or face a 550 5.7.515 rejection.

Most small businesses read the 5,000-a-day threshold and concluded the rules were someone else's problem. That was a reasonable interpretation at the time, but mailbox providers follow a familiar pattern. They start with the bulk senders, announce a deadline, let the industry adapt, and then quietly extend the same requirement to everybody. That last step is what appears to have happened on 5 November.

Outlook.com is now the third major provider to enforce DMARC in two years, and the first to apply it to senders of any size. It is hard to imagine the others will not do the same.

Who Gets Hit the Hardest

The damage lands mostly on transactional email, the messages your systems send automatically. Signup confirmations, password resets, booking notifications, receipts and shipping updates. When these bounce, the customer does not know that Microsoft rejected the message. They know your reset email never arrived, and they blame your product.

Because the rejections are intermittent, the problem is easy to miss for weeks. Support tickets about missing emails trickle in, somebody checks the mailing service dashboard, sees most messages delivered, and closes the ticket. Meanwhile some portion of mail to Hotmail and Outlook addresses keeps vanishing.

Agencies and development teams should pay special attention here. If you manage websites or web applications for clients, each client domain is a separate liability, and most clients have never heard of DMARC at all.

How to Check and Fix Your DMARC Record This Week

First, find out where you stand. Run dig +short TXT _dmarc.yourdomain.com in a terminal, or use a free checker such as MXToolbox's DMARC Lookup. If the answer starts with v=DMARC1, you already have a record and your problem lies elsewhere. If nothing comes back, your domain is exposed.

The minimal fix is one TXT record in your DNS. Create a record named _dmarc with the value v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. The p=none policy is monitoring mode only, so it blocks nothing, while the rua address starts receiving aggregate reports about who sends mail on behalf of your domain. Publish exactly one DMARC record, because duplicates cause receivers to discard both. Propagation usually takes between fifteen minutes and an hour.

Watch out for the gaps your platform leaves. The Microsoft 365 setup wizard adds SPF but not DMARC. SendGrid, Postmark and Amazon SES configure SPF and DKIM for you, and still leave the DMARC record to you. On Google Workspace you should also enable DKIM in the Admin Console, since it is off by default on some older setups.

Practical Takeaways for Teams Building Digital Products

If your business builds or runs anything that sends email, treat authentication as part of the product rather than a DNS detail. A new web application that sends verification emails should not go live without SPF, DKIM and DMARC in place, so it is worth adding the check to your launch checklist next to SSL and backups.

It also makes sense to watch deliverability the way you watch uptime. The aggregate reports that DMARC sends to your rua address are machine-readable XML, and inexpensive tools can turn them into dashboards. Even a monthly glance will tell you whether some forgotten marketing tool or CRM is sending unauthenticated mail under your name.

And if you work with an agency or an outsourced development team, ask them to audit every domain you own, including the ones used only for landing pages. Attackers like to spoof exactly the domains nobody monitors.

Don't Stop at p=none

The record above gets you past Microsoft's new filter, but p=none is a starting point, not a destination. It tells receiving servers to report failures and deliver the mail anyway, which means anyone can still spoof your domain successfully.

The sensible path is to collect reports for a few weeks, confirm that all your legitimate senders pass alignment, and then tighten the policy to p=quarantine, which sends failing mail to spam, and eventually to p=reject, which blocks it outright. Jumping straight to p=reject is tempting but risky, because a misconfigured newsletter tool or helpdesk can disappear from your customers' inboxes overnight.

Final Notes

Microsoft's silent change is annoying in form but reasonable in substance. Authenticated email is becoming the baseline of doing business online, and the providers have stopped waiting for stragglers. The fix costs one DNS record and ten minutes of attention, which is a fair price for keeping your receipts, resets and invoices out of the void.

If DNS records are not something your team touches with confidence, this is routine work for any web development partner, ours included. Check your domain today, add the record if it is missing, and put a reminder in the calendar to review the reports before the end of the month.