Microsoft’s email service for Outlook and Hotmail is now blocking messages from domains without a DMARC record, even if they have SPF and DKIM correctly set up.
Senders emailing Outlook.com, Hotmail and Live addresses are receiving the following error message:
550 5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records
Some admins also report a separate SPF validation error, 550 5.7.23, Neowin reported.
Admins began reporting issues on Nov. 4, according to reports on Microsoft’s Q&A forum, Reddit (r/microsoft365, r/sysadmin) and email provider MailRoute.
Expert Insights has also been contacted by several smaller MSPs and their clients who are having emails blocked.
Microsoft has not publicly acknowledged the rejections, and experts we spoke to were split on whether they are the result of a deliberate change or a bug.
Expert Insights has contacted Microsoft for comment.
Small Businesses Caught Out
In April 2025, Microsoft announced that Outlook.com would require SPF, DKIM and DMARC from domains sending more than 5,000 emails a day, and reject non-compliant mail with a different error, 550 5.7.515.
However, it appears in this instance that much smaller senders are being impacted, rather than just large bulk mail senders.
One admin, at a company with around 50 users, found he could not email his own personal Outlook account because the company domain lacked authentication records.
Not every report involves missing records. Several admins say domains with correctly configured SPF, DKIM and DMARC have also been rejected intermittently, Windows Report and Neowin reported.
In one case, a message sent through Zoho was rejected, then delivered when it was resent about 19 minutes later.
Mail logs from one small organization, seen by Expert Insights, showed messages to Hotmail addresses switching between delivered and bounced within minutes on Nov. 6, including the same email sent two minutes apart.
What Admins Can Do
To restore delivery, we have found domains need to publish at least a basic DMARC record (v=DMARC1; p=none) in their DNS. SPF and DKIM on their own are not enough, and mail can still be rejected even with DKIM set up.
Microsoft has not confirmed this as a fix at time of writing.
With smaller businesses most likely to be affected, MSPs should check in with their clients to make sure their domains publish a DMARC record alongside SPF and DKIM, rather than waiting for bounced emails to be reported.
