Skip to content
Sign inGet startedDashboard

BlogDMARC

Outlook is rejecting mail from domains without DMARC. Check yours.

By Julien CoulaudPublished November 9, 20264 min read

Operators started reporting the bounce on the evening of November 6, 2026, US time. Microsoft has not confirmed it, and the rejections are sporadic, so a test that gets through proves little. Check your domain now. If it has no DMARC record, adding one takes five minutes and changes nothing for mail that already passes SPF or DKIM.

Julien Coulaud on X

Founder of Shipmail, the email platform for businesses and their AI agents. Every guide here draws on mail servers running in production.

  • DMARC
  • Outlook
  • Deliverability
  • Bounces
  • Email authentication

Short answer

Since the night of November 6, 2026, Outlook.com, Hotmail, Live and MSN addresses have rejected some mail from domains that publish no DMARC record, with 550 5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records. It happens even when SPF and DKIM pass, and at low volume. Microsoft has not announced it. The fix is one TXT record at _dmarc.yourdomain.com, for example v=DMARC1; p=none.

In short: check DMARC before your next send

  • Who: mail sent to Outlook.com consumer addresses (outlook.com, hotmail.com, live.com, msn.com) from a domain with no DMARC record.
  • The bounce: 550 5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records.
  • Not only bulk senders: a personal domain that passes SPF and DKIM was rejected too.
  • The fix: publish a DMARC record for the domain in your From address, then test before you resend.
[1]

What was reported on November 6 and 7

Posters on the Mailop list reported the rejections from the night of Friday, November 6, 2026. On November 7, Al Iverson of Spam Resource reproduced them with his own personal domains, which are not bulk senders, and quoted the bounce: 550 5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records.[1]

The rejections hit mail that passed SPF and DKIM. What was missing was the DMARC record. They were reported at Outlook.com consumer domains only: mail to a company domain hosted on Microsoft 365 was accepted in the same test.[1]

The rejections are sporadic. One message gets through and the next one bounces, so a single successful test does not mean your domain is safe.[1]

Microsoft's published rules versus the new reports

Microsoft's published rule dates from April 2025. Domains that send more than 5,000 emails a day to Outlook.com must pass SPF and DKIM and publish DMARC with at least p=none, aligned with SPF or DKIM. Mail that fails has been rejected since May 2025, with a different code: 550 5.7.515.[2]

The November reports go further. They show rejections below that 5,000-a-day line, with a new message. Microsoft has not said whether this is a planned policy, a test or a mistake, and it could change or stop without notice. Treat it as real until Microsoft says otherwise: a DMARC record costs nothing to publish.Sources[1]Spam Resource: Microsoft newly rejecting mail lacking DMARC?[2]Microsoft: Outlook's requirements for high-volume senders

  • Published rule, May 2025: domains sending more than 5,000 emails a day to Outlook.com need SPF, DKIM and DMARC at least p=none. Failures bounce with 550 5.7.515. Microsoft announced it.
  • Reported, November 2026: senders at any volume, sporadically, need a DMARC record. Failures bounce with 550 5.7.1 Message lacks SPF/DKIM/DMARC Auth Records. Microsoft has not announced it.
Sources[1]Spam Resource: Microsoft newly rejecting mail lacking DMARC?[2]Microsoft: Outlook's requirements for high-volume senders

Check your record and your alignment

DMARC applies to the domain in the visible From address, not the one in the envelope or the DKIM signature. Check the domain your readers see.[3]

  1. Step 1

    Look before you add

    Look up the TXT record at _dmarc.yourdomain.com. If a record already exists, do not add a second one: two DMARC records count as none. If it says p=quarantine or p=reject, keep it. Do not weaken a working policy to p=none.

  2. Step 2

    Add the record if there is none

    Add a TXT record named _dmarc (your DNS host shows it as _dmarc.yourdomain.com) with the value v=DMARC1; p=none. Microsoft names p=none as the minimum. It asks receivers to change nothing, so it cannot block mail that worked before.

  3. Step 3

    Subdomains inherit

    Mail from mail.yourdomain.com uses the record at _dmarc.mail.yourdomain.com if there is one, and the record of yourdomain.com if not. A record on the main domain covers its subdomains.

  4. Step 4

    Check the message, not only DNS

    A record is not enough if no check aligns. Open a message you sent, read its Authentication-Results header, and confirm that SPF or DKIM passes for your From domain. If a platform sends for you, ask it whether it signs with DKIM for your domain.

Sources[3]RFC 9989: Domain-based Message Authentication, Reporting, and Conformance (DMARC)[2]Microsoft: Outlook's requirements for high-volume senders[1]Spam Resource: Microsoft newly rejecting mail lacking DMARC?

Test the fix before you resend

DNS changes take minutes to a few hours to reach every resolver. Wait until the DMARC checker shows the new record, then test before you resend what bounced.

  • Send a test message to an Outlook.com or Hotmail address you can read.
  • Confirm that it arrives, and check whether it lands in the inbox or in Junk.
  • Read its headers and confirm that DMARC passes for your From domain.
  • Send a few more tests: the rejections were sporadic, so one success proves little.
  • Resend bounced password resets, receipts and invoices only after the tests pass.
[1]

If your domain is on Shipmail

A domain set up for Shipmail mailboxes already has a DMARC record: setup asks you to publish v=DMARC1; p=reject at _dmarc, and the domain is not verified until a DMARC record is there.[4]

A transactional sending subdomain publishes no DMARC record of its own, and it does not need one. You can add it only under a domain already verified in Shipmail, so it inherits that domain's record. If you later replace the record on your domain, keep one at _dmarc.yourdomain.com.Sources[5]Shipmail transactional email documentation[3]RFC 9989: Domain-based Message Authentication, Reporting, and Conformance (DMARC)

Sources5 sourcesVerified 2026-11-09
  1. [1]
    Spam Resource: Microsoft newly rejecting mail lacking DMARC?

    Al Iverson's November 7, 2026 report: from the night of November 6 (US time), Outlook.com consumer domains (outlook.com, hotmail.com, live.com, msn.com) sporadically reject mail from domains without a DMARC record, even when SPF and DKIM pass and at low volume, with 550 5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records. Mail to a Microsoft 365 hosted domain was accepted. Microsoft has not confirmed it. Recommends a DMARC record, even at p=none.

    spamresource.com · 2026-11-09

  2. [2]
    Microsoft: Outlook's requirements for high-volume senders

    Microsoft's April 2025 announcement that Outlook.com requires SPF, DKIM and DMARC (at least p=none, aligned with SPF or DKIM) from domains sending more than 5,000 emails a day, starting May 2025.

    techcommunity.microsoft.com · 2026-10-11

  3. [3]
    RFC 9989: Domain-based Message Authentication, Reporting, and Conformance (DMARC)

    Published May 2026 on the Standards Track; obsoletes RFC 7489 and RFC 9091. Section 4.7 tags: v=DMARC1 (required, first), p (none, quarantine, reject; treated as none if absent), sp (existing subdomains, defaults to p), np (non-existent subdomains), psd, t (test mode y or n, default n), rua and ruf (mailto: report addresses), adkim and aspf (r relaxed or s strict, default r), fo (default 0, ignored without ruf: 0 asks for a failure report when all mechanisms fail to give an aligned pass, 1 when any fails, d when a DKIM signature failed, s when SPF failed). Section 4.1: the policy record is a TXT record at _dmarc.<domain>. With t=y the domain owner is testing and expects failing mail to get the policy one step lower, so quarantine becomes none and reject becomes quarantine; t has no effect on reports. Relaxed alignment means the same organizational domain, strict means identical domains. If several DMARC records are returned for one name, all are discarded. Appendix A.6 removes pct, replaced by t, whose y and n values match pct=0 and pct=100; Appendix C.5.2 lists rf and ri as removed. Section 7.4: in forwarding, SPF will most likely fail while DKIM signatures generally remain valid; a domain publishing p=reject MUST NOT rely only on SPF and MUST apply valid DKIM signatures; domains whose users post to mailing lists should not publish p=reject, or should first publish p=none for at least a month and then p=quarantine for as long.

    rfc-editor.org · 2026-10-11

  4. [4]
    Shipmail DNS setup docs: DMARC record

    Shipmail's DNS setup steps for each registrar end with a TXT record named _dmarc with the value v=DMARC1; p=reject. The GoDaddy steps start from My Products, then DNS, and note that most records appear within 30 minutes.

    shipmail.to · 2026-10-15

  5. [5]
    Shipmail transactional email documentation

    Shipmail transactional email: an app sends from its own sending subdomain of a domain already verified in Shipmail, and replies go to a Shipmail mailbox. Sends count toward the plan's monthly quota, a sender costs nothing extra, Activity shows delivery status, and a retry with the same Idempotency-Key returns the first message. Every email from a sender carries its mailbox's address as Reply-To, so replies arrive in that mailbox's Transactional folder; the sending address itself cannot receive email. On a paid plan, an organization's transactional email starts at a safety limit of 1,000 recipients a day, raised daily to twice the highest clean day of the last 7 days, up to 25,000 automatically; the plan keeps 80% of its daily limit as a floor; a migration review with the last 30 days gets an answer within one business day.

    shipmail.to · 2026-11-09

Questions worth answering

Common questions about outlook rejecting email no dmarc.

What does 550 5.7.1 Message lacks SPF/DKIM/DMARC Auth Records mean?
Outlook.com refused the message because the sending domain did not publish the authentication it expects. In the November 2026 reports, the missing piece was the DMARC record, even when SPF and DKIM passed. Publish a DMARC record for the From domain and send again.[1]
Did Microsoft announce this change?
No. Microsoft's only published rule covers domains that send more than 5,000 emails a day. The November rejections were reported by mail operators and reproduced by Spam Resource, and Microsoft has not said whether they are intended.Sources[1]Spam Resource: Microsoft newly rejecting mail lacking DMARC?[2]Microsoft: Outlook's requirements for high-volume senders
Is p=none enough?
Yes, for this rejection. Microsoft names p=none as the minimum policy, and the reports show mail rejected only when no record existed. Move to p=quarantine or p=reject later, once your reports show that all your real mail passes.Sources[2]Microsoft: Outlook's requirements for high-volume senders[1]Spam Resource: Microsoft newly rejecting mail lacking DMARC?
Does this affect mail to Microsoft 365 business addresses?
It was not reported there. In the test that reproduced the rejection, mail to a domain hosted on Microsoft 365 was accepted. The reports cover outlook.com, hotmail.com, live.com and msn.com.[1]
I send through a newsletter or transactional email service. What do I do?
The DMARC record goes in your own DNS, for the domain in your From address, so you add it, not the service. Then ask the service whether it signs your mail with DKIM for your domain, so that DMARC can pass.Sources[1]Spam Resource: Microsoft newly rejecting mail lacking DMARC?[3]RFC 9989: Domain-based Message Authentication, Reporting, and Conformance (DMARC)

Related guides

More on Shipmail pricing, comparisons, and team workflows.

Email, newsletters and booking pages on your own domain, in one plan.

Get started for free