Outlook.com is rejecting email from domains without DMARC

Your order confirmations to Hotmail customers may be bouncing right now. Since Friday night, mail admins report that Outlook.com is rejecting email from domains that have no DMARC record. This is not only bulk senders. Small domains that pass SPF and DKIM get the bounce too. The fix is one DNS record, and it takes about ten minutes.

What actually happened

Al Iverson of Spam Resource, a long-time email deliverability expert, wrote up the reports on November 7. Admins on the Mailop mailing list started to see rejections on the night of November 6 (US time). The bounce reads:

550 5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records

What we know:

• Who it hits. Outlook consumer addresses: outlook.com, hotmail.com, live.com, msn.com. In Iverson's tests, mail to a Microsoft 365 business domain was still accepted.
• Not every message. Other admins call it "sporadic." Some share of your mail can bounce while the rest gets through.
• Small senders too. Iverson deleted the DMARC record from several low-volume personal domains on November 7. Mail from them to outlook.com bounced with the error above.
• No word from Microsoft. Microsoft has not announced a policy change. It could be a planned change or a mistake that gets rolled back.

The background: in April 2025, Microsoft said that domains sending more than 5,000 messages a day to its consumer addresses must pass SPF, DKIM and DMARC. Enforcement started May 5, 2025. The new bounces hit domains far below that line.

Why the Outlook DMARC rejection matters for your business

Plenty of small businesses still have no DMARC record. The domain was set up years ago, SPF was added for Google Workspace, and nobody touched DNS again. Those domains are the ones bouncing now. What breaks: receipts, invoices, password resets, quote follow-ups. Your customers don't get a bounce. They get silence, then they think you ghosted them.

Don't wait for Microsoft to explain. Even if this rollout is an error, Gmail, Yahoo and Microsoft all point the same way. Do this today:

1. Check your record. Look up the TXT record at _dmarc.yourdomain.com. If there is nothing there, you are exposed.
2. Publish one. Add a TXT record at _dmarc with v=DMARC1; p=none. Monitor-only. It blocks nothing, but it puts a DMARC policy in place.
3. Check every sender. Shopify, Klaviyo, your invoicing tool, your CRM. Each one must pass SPF or DKIM aligned to your domain. A DMARC record with no passing check still fails.
4. Read the reports. Add a rua= address so you get DMARC reports. Then you can see who sends as your domain before you tighten to p=quarantine.

Sources: Spam Resource (Al Iverson), Microsoft Tech Community.