Microsoft Rolls Back Spam Rule Change That Blocked Emails To Outlook.com

Microsoft says a recent update to its spam rules caused Outlook.com, Hotmail and Live to reject emails from some domains, and the change has been reversed.

Published on Nov 11, 2026
Joel Witts Written by Joel Witts
Microsoft Office apps including Outlook on a screen

Microsoft has rolled back a change to its spam rules that caused personal Outlook.com, Hotmail and Live addresses to reject emails from some business senders.

“We’ve resolved an issue that may have prevented some email messages from reaching Outlook.com, Hotmail and Live addresses, and mail flow has been restored,” a Microsoft spokesperson told Expert Insights. “We’re continuing to monitor to help ensure email is delivered as expected.”

The issue was related to a recent update to Microsoft’s spam rules, which has since been rolled back, according to Microsoft.

Senders do not need to change their settings or take any further action, Microsoft said.

Microsoft said customers can find more details under EX1545193 in the Microsoft 365 admin center.

Since around Nov. 4, admins had reported messages to consumer Outlook addresses bouncing with the error “550 5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records.”

The issue mainly blocked emails from company domains with no DMARC record configured, even when they had SPF and DKIM set up, when sending to personal Outlook addresses.

Mail logs from one small organization, seen by Expert Insights, showed messages to Hotmail addresses switching between delivered and bounced within minutes on Nov. 6.

Anonymized mail log showing emails to Hotmail addresses alternating between delivered and bounced
Mail logs from one small organization, seen by Expert Insights. Recipient addresses and subject lines have been removed.

It particularly caused issues for smaller, low-volume senders, including MSPs and their clients, rather than only the high-volume senders covered by Microsoft’s 2025 authentication requirements.

Publishing a DMARC record alongside SPF and DKIM is still considered good practice, and remains required for domains sending more than 5,000 emails a day to Outlook.com.

This field is for validation purposes and should be left unchanged.

FREE NEWSLETTER

Cyber Weekly

Get curated cybersecurity news, threats and insights delivered free every Thursday.

Written By Written By
Joel Witts
Joel Witts Content Director

Joel is the Director of Content and a co-founder at Expert Insights; a rapidly growing media company focussed on covering cybersecurity solutions.

He’s an experienced journalist and editor with 8 years’ experience covering the cybersecurity space. He’s reviewed hundreds of cybersecurity solutions, interviewed hundreds of industry experts and produced dozens of industry reports read by thousands of CISOs and security professionals in topics like IAM, MFA, zero trust, email security, DevSecOps and more.

He also hosts the Expert Insights Podcast and co-writes the weekly newsletter, Decrypted. Joel is driven to share his team’s expertise with cybersecurity leaders to help them create more secure business foundations.