Microsoft’s consumer email services—Outlook.com, Hotmail, Live, and MSN—have been rejecting some emails from domains without DMARC records since November 5, 2026, according to MailRoute. The rejection is happening without any public announcement from Microsoft, making it easy for senders to miss.
Affected senders receive bounce-back messages stating “550 5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records,” often followed by a bracketed server identifier. Notably, many rejected domains actually had working SPF records and some had DKIM as well—they were simply missing the DMARC record that ties authentication methods to the sender’s From address.
This development differs significantly from Microsoft’s previous enforcement, which has applied since May 2025 to bulk senders transmitting over 5,000 messages daily to Outlook.com. The new rejection targets small senders as well, including single-line replies from small offices. Additionally, it was not announced through typical channels such as postmaster notices or blog posts.
The inconsistency of the rejections compounds the problem. Microsoft refuses only some mail from affected domains—one message may reach a recipient while the next bounces, and resending might succeed. This unpredictability can cause senders to assume a technical glitch and move on, while recipients never receive critical messages like invoices, appointment confirmations, or applications.
Domains can check their DMARC status by running a DNS query for their domain. The fix is straightforward: adding a single TXT record at the DNS host with the name “_dmarc” and value “v=DMARC1; p=none.” This configuration declares that a domain uses DMARC and requests reports from receivers but instructs them to take no action on failures. It does not change how Gmail, Yahoo, or other providers treat the domain’s email.
According to MailRoute, this represents a broader pattern among major mailbox providers. Requirements initially target bulk senders with announced deadlines, then quietly become standard for all senders. DMARC with p=none is now the baseline rather than a best practice. The enforcement supports authentication to make domain spoofing harder and helps prevent phishing and business email compromise attacks.
Key facts
- Outlook.com, Hotmail, Live, and MSN began rejecting emails from domains without DMARC records on November 5, 2026
- The rejection happens silently without public announcement from Microsoft
- Many rejected domains had working SPF records but lacked DMARC authentication records
- Microsoft rejects only some messages from affected domains, creating inconsistent delivery that can go unnoticed
- The fix is adding a single DNS TXT record with value v=DMARC1; p=none
- DMARC pass requires either SPF or DKIM to align with the sender’s From address domain