Since November 5, 2026, Microsoft's person communication assistance has been turning distant several of the email from domains that don't publish a DMARC record. If your business emails customers, vendors or applicants alongside outlook.com, hotmail.com, live.com or msn.com addresses, several of that communication may be bouncing correct now. Nobody announced it. The fix is one DNS record.
Key takeaways
- Outlook.com, Hotmail, Live and MSN now refuse part of the communication from domains that have no DMARC record.
- It hits ordinary, low-volume senders, not lone the bulk senders Microsoft's published rules cover.
- Only several messages bounce, so "my communication is getting through" doesn't average your domain is safe.
- The fix is a sole TXT record, v=DMARC1; p=none, which changes nothing concerning how another receivers treat your mail.
What the bounce looks like
The sender gets a bounce akin this one, followed by a bracketed server name and ID that differ per message:
550 5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records (AS9031519)
On the archetypal day, the identical rejection came rear without the (AS9031519) code:
550 5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records
The wording suggests item is seriously broken. Usually it isn't. The domains we have seen bounced mostly had operating SPF, and many had DKIM too. What they were missing was the DMARC document that ties the two to the From address.
What changed
Microsoft does have published sender rules. Since May 2025, domains that dispatch more than 5,000 messages a day to Outlook.com have had to continue SPF, DKIM and DMARC, or get 550 5.7.515 Access denied. That regulation is aimed at marketers and bulk senders, and most small businesses rightly assumed it didn't use to them.
This new rejection is distinct in the ways that matter:
- It reaches small senders. A one-line answer from a small agency can bounce.
- It wasn't announced. As of November 6, Microsoft has published nothing concerning it: no postmaster notice, no blog post, no service-health entry.
- It doesn't say what failed. A 5.7.515 bounce lists the SPF, DKIM and DMARC results. This one lone says records are missing.
We archetypal saw these bounces in our own outbound logs on November 5. Public reports from another administrators started appearing the identical day.
Why it's uncomplicated to miss
Microsoft refuses lone part of the mail from an affected domain. One communication to a Hotmail location goes through, the next one bounces, and a resend may succeed. That inconsistency is what makes this one dangerous: the individual who sent the communication sees a bounce complete of acronyms, assumes a glitch, and moves on. The client on the another end never knows a communication was sent.
If your endeavor depends on reaching group at individual addresses (patients, homeowners, applicants, parents, members), the disbursal is quiet. Invoices that don't arrive, project confirmations that never land, replies that appearance akin you ignored someone.
Is your domain affected?
Your domain is exposed if it has no DMARC record. You can inspect in a few seconds from any terminal. Replace example.com alongside your domain:
dig +short TXT _dmarc.example.com
A row starting alongside "v=DMARC1 method you have a record. No output method you don't. That's the case this rejection targets.
The fix is one DNS record
Add a TXT document at your DNS host:
- Name: _dmarc
- Value: v=DMARC1; p=none
p=none is the harmless starting point. It declares that your domain uses DMARC and asks receivers to dispatch you reports, but it tells them to obtain no act on failures. Nothing concerning how Gmail, Yahoo or anyone alternatively treats your communication changes.
There is one condition. DMARC passes lone whenever SPF or DKIM passes for the domain in your From address. If neither lines up, a DMARC document solitary won't help. We covered how alignment works, and why it's anywhere most setups go wrong, in SPF, DKIM, and DMARC Are No Longer Optional.
Step-by-step instructions, including the checks for all three records, are in our guide to the Outlook.com 5.7.1 error.
If your communication goes through MailRoute
Mail you dispatch through the MailRoute outbound relay already passes the two checks DMARC needs:
- SPF. Your communication keeps your own domain as its letter cover sender and leaves from servers that include:spf.mailroute.net authorizes.
- DKIM. We sign all outbound communication as your domain, using the keys your mr01, mr02 and mr03 CNAME records item to. Publish all three, so we can rotate keys without your signatures always breaking.
For MailRoute senders, the DMARC document is the entire fix. Once it's in place, Outlook.com sees a domain that authenticates, and DMARC passes on either check. Our guide to publishing DMARC for the MailRoute outbound relay takes you from p=none to implementation whenever you're ready.
If your communication doesn't go through MailRoute
The DMARC document is motionless the fix, but the assistance that sends your communication has to continue SPF or DKIM for your domain. Microsoft 365, for example, signs alongside its own onmicrosoft.com domain until you rotate on DKIM for your own domain, and that signature doesn't figure toward DMARC. Our sister business mxio has a guide to this error for any sender, alongside a checker that tests your domain from the page.
Where this is heading
This is the form all important mailbox provider is following. Requirements commencement alongside the bulk senders, get announced alongside a deadline, and afterward quietly rotate into the baseline for everyone. DMARC at p=none is the flat now, not a finest practice.
That's not a bad thing. Spoofing is how much of today's phishing and endeavor email colony starts, and a domain that authenticates is a domain that's much harder to impersonate. The p=none document that gets your communication delivered to Outlook.com today is additionally the archetypal stage to p=reject, which tells receivers to refuse communication that forges your domain.
If you'd akin a relay that signs your outbound communication correctly from day one, our setup documentation walks through SPF, DKIM and DMARC, and you can start a trial whenever you're ready. Add the document today. It takes a few minutes, and it's one small logic for your communication to disappear.
