Outlook.com Is Bouncing Email Without DMARC Records

If emails you send to someone's Outlook.com or Hotmail address keep bouncing, or a company says it emailed you and nothing ever arrived, you're not imagining it. Since around 5 November, Microsoft's consumer mail service has been rejecting a share of incoming messages with an error saying they lack SPF, DKIM or DMARC records. Microsoft hasn't explained it yet, but the fix that keeps working for senders is a simple DNS record.

What happened

Windows Latest says it saw the problem itself, when a business couldn't get an email through to its Outlook.com inbox, and reproduced it on 8 November. Bounce messages usually read 550 5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records, sometimes alongside a 550 5.7.23 SPF error. Neowin found similar reports on Microsoft's forums and Reddit, and it isn't tied to one email provider. Mail from Zoho and Microsoft 365 is being bounced too.

The clearest explanation so far comes from email admins. Spam Resource collected reports from the Mailop list showing mail to outlook.com and hotmail.com addresses being refused when the sending domain has no DMARC record, even when SPF and DKIM pass. In the same test, mail to a business domain hosted on Microsoft 365 went through fine. Mail provider MailRoute says it sees the same pattern, adds that only part of a domain's mail is rejected, and says it hits small senders, not just the bulk senders Microsoft's 2025 rules were aimed at. As of its 6 November update, Microsoft had posted no notice about it.

Why it matters

This one is sneaky because it's partial. A message gets through, the next one bounces, and a resend a minute later might land. Small businesses, schools, clubs and anyone running email on their own domain can lose invoices, password resets and booking confirmations without noticing. A few people say their domain was blocked even with all three records in place, so DMARC may not explain every case.

What to do

If you use an Outlook.com or Hotmail address: check your Junk folder, and if you're expecting something important (a bank OTP email, a ticket, a job reply), ask the sender to resend or use another channel. There's nothing to change in your own account settings, since the rejection happens before mail reaches you.

If you send from your own domain:

1. Check whether you have a DMARC record. Run nslookup -type=txt _dmarc.yourdomain.com (or dig txt _dmarc.yourdomain.com on Mac and Linux). No answer means you don't have one.
2. Add one at your DNS host (your registrar, Cloudflare and so on): a TXT record named _dmarc with the value v=DMARC1; p=none. Many DNS panels add your domain automatically, so type only _dmarc in the name field.
3. Keep only one DMARC record per domain. Two records break it.
4. Make sure SPF or DKIM actually passes. DMARC on its own won't save mail that fails both.
5. Resend anything that bounced. Old bounces don't retry themselves.

p=none only tells receiving servers you use DMARC. It doesn't make anything stricter, so it's safe to add today.

My take

Whether Microsoft meant to do this or tightened a filter by mistake, I'd add the record anyway. Gmail and Yahoo already push bulk senders toward DMARC, and it costs nothing. The part I'd watch is the handful of reports from domains that already had everything set up. If you're in that group, keep the full bounce message and send it to your email provider, because that's the evidence Microsoft will need.

If DNS is new to you, our guide to private DNS on Android explains what DNS does in plain terms, and our recent post on GitHub's timeouts is another reminder to keep a fallback when a big service gets flaky. I'll update this post if Microsoft confirms what changed.