Since November 5, Outlook.com (and with it Hotmail, Live and MSN) has been bouncing part of the mail sent from domains that don’t publish a DMARC record. Thomas A. Johnson, from MailRoute, spotted it in their own outbound logs that same day, and other administrators started reporting it at the same time.
The odd part is that Microsoft hasn’t said a word. No notice on its postmaster portal, no blog post, no service health entry. It just started happening.
What the bounce looks like
The sender gets something like this:
550 5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records (AS9031519)
On the first day it came back even without the (AS9031519) code at the end. The message suggests everything is broken, and usually it isn’t: according to MailRoute, most of the rejected domains had working SPF, and many had DKIM too. What they were missing was the DMARC record that ties those two checks to the From address.
What’s different this time
Microsoft already had published rules: since May 2025, anyone sending more than 5,000 messages a day to Outlook.com has to pass SPF, DKIM and DMARC, or gets a 550 5.7.515 Access denied. That rule was for bulk senders, and almost every small business assumed, rightly, that it didn’t apply to them.
This is something else:
- It hits small senders. A one-line reply from an office can bounce.
- It wasn’t announced. As of November 6, nothing had been published.
- It doesn’t say what failed. A
5.7.515lists the SPF, DKIM and DMARC results; this one only says records are missing. - It only rejects part of the mail. One message goes through, the next bounces, and a resend may get in.
That last point is the dangerous one. The sender sees a bounce full of acronyms, assumes it’s a one-off glitch and moves on. And on the other end, the customer never learns they were written to: invoices that don’t arrive, appointment confirmations that get lost, replies that look ignored.
Checking your domain
From any terminal, replacing example.com with your domain:
dig +short TXT _dmarc.example.com
If you get a line starting with "v=DMARC1, you have a record. If you get nothing, you don’t, and that’s exactly the case Outlook is rejecting.
The fix is one DNS record
A TXT record at your DNS provider:
| Field | Value |
|---|---|
| Name | _dmarc |
| Type | TXT |
| Value | v=DMARC1; p=none |
p=none is the safe starting point: it declares that your domain uses DMARC, but asks receivers to take no action on messages that fail. It doesn’t change how Gmail, Yahoo or anyone else treats your mail. If you also want the aggregate reports, add rua=mailto: with an address of yours, and you’ll see who is sending on behalf of your domain.
There’s one condition: DMARC only passes if SPF or DKIM pass for the From domain, which is called alignment. If you send through a service that signs with its own domain, the DMARC record alone isn’t enough. The example in the article is Microsoft 365, which signs with onmicrosoft.com until you enable DKIM for your own domain, and that signature doesn’t count towards DMARC. The same goes for the classic website form that sends through the server’s mail() function, or the newsletter tool you set up years ago and have long forgotten about.
My takeaway
It’s the usual pattern with email: requirements start with the big senders, get announced with a deadline and then, quietly, become the baseline for everyone. Gmail and Yahoo did the same with their 2024 rules, and now it’s Outlook’s turn with small senders, this time without warning.
If you have your own domain, even if you only use it for a blog or for family email, it’s five minutes: the dig, the record and, if you’re up for it, checking that SPF and DKIM are aligned. And it’s not just about getting past Outlook: a domain with DMARC is much harder to spoof, and that p=none is the first step towards p=reject some day.
Source: Outlook.com Is Quietly Rejecting Email From Domains Without DMARC, Thomas A. Johnson, MailRoute.
