Outlook and Hotmail reject email without DMARC: how to fix it

07 November 2026

Since Thursday 5 November 2026, Microsoft rejects part of the email sent to Outlook.com, Hotmail, Live and MSN addresses. It is email from domain names without a DMARC record. The sender gets a bounce with the message "Message lacks SPF/DKIM/DMARC Auth Records". Microsoft did not announce this, and it does not only hit large senders, but also a small office that sends a quote.

Below you read what is going on, how to check if your domain is at risk, and how to fix it.

1. What is going on?

In early 2024 I wrote about improving your email delivery. In that article I explained how SPF, DKIM and DMARC work, and that Google had become stricter for email to Gmail addresses. Now Microsoft does something similar, but without an announcement.

Since 5 November 2026, administrators and email services see bounces from the servers that handle Microsoft's consumer mailboxes. So this is about addresses that end in @outlook.com, @hotmail.com, @live.com and @msn.com (and country versions such as @hotmail.co.uk). As far as we know, business Microsoft 365 mailboxes with their own domain name are not affected.

1.1 The error message

The bounce that the sender gets back looks like this:

550 5.7.1 Message rejected:
Message lacks SPF/DKIM/DMARC Auth Records (AS9031519)

On the first day, the same message came without the (AS9031519) code. Sometimes an SPF error comes before it:

550 5.7.23 The message was rejected because of
Sender Policy Framework violation

The text sounds as if you have no email security at all. Usually it is not that bad. For the domains that have been investigated so far, SPF was often set up correctly, and DKIM often too. What was missing, was the DMARC record.

1.2 Why it is easy to miss

Microsoft does not reject all email from an affected domain, but only a part. One message to a Hotmail address arrives, the next one does not, and if you send it again, it sometimes works. The employee who sent the email sees a bounce full of abbreviations, thinks it is a glitch and moves on. The recipient does not even know there was a message.

For businesses that send a lot of email to consumers, that is a problem. Think of invoices, appointment confirmations, webshop order confirmations, or the reply to a contact form. It then looks as if you ignore someone.

1.3 A quick refresher: SPF, DKIM and DMARC

All three are records in the DNS of your domain name:

SPF (Sender Policy Framework): the list of mail servers that may send email on behalf of your domain.
DKIM (DomainKeys Identified Mail): a digital signature on every email. The recipient uses it to check that the email really comes from your domain and was not changed on the way.
DMARC (Domain-based Message Authentication, Reporting and Conformance): checks if SPF or DKIM matches the domain that the recipient sees as the sender, and tells the recipient what to do if it does not.

You can read a longer explanation in my earlier article.

2. What Microsoft and Google already required

Stricter email rules are not new. They started with the large senders.

When	Who	For whom	What
February 2024	Google (Gmail) and Yahoo	All senders: SPF or DKIM. Bulk senders (more than 5,000 messages per day): everything on the right	SPF, DKIM and DMARC (at least `p=none`), plus easy unsubscribe for newsletters
May 2025	Microsoft (Outlook.com)	Senders of 5,000 or more messages per day	SPF and DKIM must pass, DMARC at least `p=none`. Otherwise: `550 5.7.515 Access denied`
November 2026	Microsoft (Outlook.com)	Small senders too	Part of the email without a DMARC record is rejected with `550 5.7.1`

The rule from May 2025 was meant for newsletters and other large senders. Most small businesses rightly assumed that it did not apply to them. The new rejection is different:

It also hits small senders. A short reply from a small office can already bounce.
It was not announced. On 6 November, Microsoft had not published anything: no notice for postmasters, no blog post, no entry in the service status.
It does not say what is wrong. A 5.7.515 bounce lists the results of SPF, DKIM and DMARC. This message only says that records are missing.

3. Is your domain affected?

Your domain is at risk if it has no DMARC record. You can easily check that online, without technical knowledge.

3.1 Check online

Go to the MXToolbox DMARC Lookup.
Enter your domain name, for example yourdomain.com, and click DMARC Lookup.
You now see if your domain has a DMARC record, and if it contains errors.

Does MXToolbox report that no DMARC record was found? Then your domain is at risk. Ask your hosting provider or website administrator to set up the record. Section 4 shows what it must contain.

Do you want to check everything in one go? Then use the email test of Internet.nl. This free test tool is run by the Dutch government together with the internet community, and it also works in English. It checks your SPF, DKIM and DMARC records and explains what is wrong.

Note: a DMARC record does not mean that all your email arrives. SPF and DKIM must also be set up correctly. You can read more about that in section 4.

3.2 Which domain do you check?

Check the domain in the From address of your email. If you send email from more than one domain name, check all of them.

3.3 For terminal users

On Linux and macOS you can also check it in the terminal. Replace yourdomain.com with your own domain name:

dig +short TXT _dmarc.yourdomain.com

If the answer starts with "v=DMARC1, you have a DMARC record. If you get nothing back, you do not have one.

4. The fix: a DMARC record

4.1 Start with p=none

Add a TXT record in your DNS management:

Field	Value
Type	TXT
Name	`_dmarc` (some DNS providers need `_dmarc.yourdomain.com`)
Value	`v=DMARC1; p=none; rua=mailto:This email address is being protected from spambots. You need JavaScript enabled to view it.`

With p=none you say: my domain uses DMARC, but do nothing yet with email that fails the check. So this does not change how Gmail or other providers treat your email. Microsoft itself uses p=none as the example in its explanation of the 5.7.515 error.

The rua= part is optional. It is the address where providers send a daily report. In it you see which servers send email on behalf of your domain. You need that information later, when you want to make the rules stricter. Note: these are XML files, and there can be a lot of them. So use a separate address.

Publish only one DMARC record for your domain. If there are two, receivers ignore both.

4.2 SPF or DKIM must match your domain

A DMARC record alone is not enough. DMARC only passes when SPF or DKIM passes for the same domain as in your From address. This is called alignment:

SPF must pass for the domain in the technical return address (the envelope sender or Return-Path), and that domain must match your From address.
DKIM must pass with a signature from your domain (the d= domain in the signature), not from the domain of your email service.

One of the two is enough. Because SPF breaks when someone forwards your email, DKIM is the more reliable of the two. So make sure that at least DKIM is set up correctly.

4.3 Check every service that sends email for you

This is where it often goes wrong in practice. A few examples:

Microsoft 365 signs your email with your organisation's own onmicrosoft.com domain, until you turn on DKIM for your own domain name. That signature passes, but it does not count for DMARC. Turn on DKIM for your own domain in the Microsoft Defender portal and add the two CNAME records (selector1 and selector2) to your DNS. Microsoft 365 also does not create a DMARC record for you.
Google Workspace: turn on DKIM in the Admin console and add the google._domainkey record.
Newsletter services: set up the DKIM records that the service gives you, so that your newsletter is signed with your domain.
Your website: contact forms, orders, registration and activation emails, password resets and notifications from extensions of a Joomla website are sent with PHP Mail from the web server by default. That server is often not in your SPF record and does not sign with DKIM for your domain. In Joomla, go to System → Global Configuration → Server → Mail and set Mailer to SMTP. Then send via the mail server of your domain or a reliable SMTP service.

4.4 Checklist

SPF: are all mail servers and services that send email for your domain in your SPF record?
DKIM: does every service sign your email with your own domain?
DMARC: does your domain have exactly one valid DMARC record?
Website: does your Joomla website send email via SMTP instead of PHP Mail?
Bounces: do you get bounces from Outlook.com or Hotmail? Keep the full error message and look which check (SPF, DKIM or DMARC) it mentions.

5. Next: from p=none to stricter

With p=none your email is welcome again at Outlook.com, but your domain is not yet protected against abuse. Anyone can still send email that seems to come from you. So read the DMARC reports for a few weeks. Does all real email from your domain pass SPF or DKIM? Then you can make the rule stricter step by step:

p=quarantine: email that fails the check goes to the spam folder.
p=reject: email that fails the check is rejected.

Do not do this too fast. If you forget a service that sends email for you, p=reject makes receivers reject your own email.

6. What is not known yet

To be fair: Microsoft has not (yet) confirmed this new rejection. The explanation that a missing DMARC record is the cause comes from email services such as MailRoute and mxio, who saw it in their own logs. Suped points out that there are also reports from administrators whose SPF, DKIM and DMARC were set up correctly. So Microsoft may still change the rules, or there may be more going on.

That does not change the advice. A DMARC record with a correct SPF and DKIM setup has been the basis for reliable email for years, and Google and Microsoft already require it from large senders. It is likely that it now becomes the standard for everyone. When you get a bounce, always keep the full error message, so you can see which check failed.

7. Is your email not arriving?

Have you recently started getting bounces from Hotmail or Outlook.com addresses, or do you notice that customers do not receive your email? I have helped several clients with their SPF, DKIM and DMARC settings, also for the email from their Joomla website. Have your email DNS authentication checked.