For about three days in early November, mail to Outlook.com, Hotmail and Live addresses bounced for a reason most senders had never seen before: their domain had no DMARC record. Microsoft has since said this was a mistake, not a new rule. But the mail that bounced is gone, and the episode is a clear warning for any domain still sending without DMARC.
What happened
- When: Microsoft’s own window is 6 November, 18:00 UTC to 9 November, 11:02 UTC. Some senders reported the first refusals a day earlier.
- Who was affected: senders writing to consumer Outlook.com, Hotmail.com and Live.com addresses. Microsoft tracked it as incident EX1545193, “Some users may be intermittently unable to send email messages to Outlook.com, Hotmail.com, or Live.com email addresses”.
- The bounce:
550 5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records (AS9031519). Some bounces also carried SPF-related codes. - Which mail: mostly mail from domains with no DMARC record, including low-volume senders that Microsoft’s existing rules do not cover. It was intermittent: some messages from the same domain got through, others bounced.
What Microsoft said
Microsoft’s incident notice blamed “a recent update to the spam enforcement rules”, which caused legitimate mail to be incorrectly marked and blocked. It rolled the update back, called it a fault and said it would review its update procedures. On 11 November a Microsoft spokesperson told The Register the bug was fixed and that it was continuing to monitor.
So this was not a new DMARC requirement. The incident notice does not mention DMARC at all.
What to do now
- Find the bounces. Search your sending logs or bounce reports from 5 to 9 November for
AS9031519or “lacks SPF/DKIM/DMARC Auth Records” on Outlook.com, Hotmail and Live recipients. - Resend what matters. A 550 is permanent: nothing retries it, so that mail never arrived. Resend invoices, quotes, contracts and replies. Codes and password-reset links will have expired, so ask those users to request a new one.
- Unsuppress the addresses. Most email platforms treat a 550 as a hard bounce and stop mailing that address. These addresses are valid, so take them off your suppression list.
- Don’t change anything else because of it. The rule that caused this has been rolled back.
Our advice: publish a DMARC record anyway
This incident was a bug, but it showed which domains Microsoft’s filters treat as suspicious first: the ones with no DMARC record. Mailbox providers keep moving in one direction, and a missing DMARC record is now the easiest way to look like a spoofer.
- No DMARC record yet? Publish one today, starting in monitoring mode (
p=none). Our free DMARC monitor gives you the reporting address for that record and emails you a plain-English report every Monday on who sends mail as your domain. It changes nothing about how your mail is handled, and it costs one DNS record. - Make sure SPF or DKIM passes and aligns. A DMARC record only helps when your mail passes it, which means SPF or DKIM must pass for the same domain as your From address. Check every service that sends as you: your mailbox provider, your newsletter platform, your CRM, your billing system. Our free mail tester checks your SPF, DKIM and DMARC on a real email you send.
- Then move to enforcement. Once the reports show all your legitimate senders passing, step up to
p=quarantineand thenp=reject. That is what actually stops others from spoofing your domain. - Sending 5,000 or more a day to Microsoft? This is already required. Since May 2025 Microsoft expects SPF, DKIM and DMARC from high-volume senders to Outlook.com, Hotmail and Live, and bounces non-compliant mail with
550 5.7.515.
You can check your domain’s DMARC record with our free DMARC checker, and see how exposed your domain is to spoofing with the Spoofing & BEC Check.
Not the same as the 12 November outage
On 12 November a separate Microsoft 365 and Exchange Online outage began, with a different cause. That one delays and queues mail for business mailboxes rather than bouncing it, so the advice there is the opposite: wait, and do not resend.