Table of Contents
Since about November 5, 2026, Outlook.com, Hotmail, Live and MSN inboxes have been bouncing some email from business domains that have no DMARC record, even small senders and even when SPF and DKIM pass. If your quotes, invoices, appointment reminders or newsletters go to customers with those addresses, some of them may never arrive. The fix for most businesses is one DNS entry: a DMARC record set to p=none, which takes about 15 minutes to publish and costs nothing.
We are FOG Digital Marketing in San Antonio, and we set up email authentication for local service businesses every week. This change matters because it was not announced. Nobody at your business got a warning email. The only sign is a bounce message that most owners never see, because it lands in the inbox of whoever set up the domain years ago. Below is what has been reported, what Microsoft has and has not confirmed, and exactly what to check before your next email campaign or invoice run.
Key Takeaways
- Starting around November 5, 2026, senders reported that Outlook.com, Hotmail, Live and MSN addresses rejected some messages from domains with no DMARC record.
- The reported bounce reads “550 5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records” and from November 6 often ends with the code AS9031519.
- As of November 8, 2026, Microsoft had not published any statement about the change, and the rejections were intermittent rather than universal.
- Microsoft’s official rule since May 5, 2025 already requires domains sending over 5,000 emails a day to those inboxes to pass SPF and DKIM and publish a DMARC record of at least p=none.
- The new reports say the DMARC record requirement now appears to reach senders of any size, not only bulk senders.
- Publishing a DMARC record at p=none is low risk, matches Microsoft’s documented starting point, and is the first fix every business should make this week.
What Changed With Outlook and Hotmail Email This Month?
On November 6, 2026, the email security company MailRoute reported that Outlook.com had been “quietly” rejecting mail from domains with no DMARC record since November 5. The email authentication vendor EasyDMARC published its own timeline on November 9 and said it reproduced the bounce on November 8 using a test domain hosted with Zoho. The Windows news site uGetFix, citing Windows Latest and WindowsForum threads, reported the same pattern on November 8. Three independent reports, three different test setups, one consistent error message.
Here is what the reports agree on. The affected recipients are personal Microsoft addresses: outlook.com, hotmail.com, live.com and msn.com. Business mailboxes on Microsoft 365 do not appear to be affected as recipients. The bounce is a hard rejection, which means the receiving server refuses the message outright instead of sending it to junk. Hard bounces are generally not retried automatically, so the message is simply gone unless someone resends it.
The reports also agree on what is still unclear. The rejections are intermittent. One sender in the uGetFix report saw the same message go through about 19 minutes after it bounced. A separate group of senders reported a different bounce, 550 5.7.23, which points at an SPF problem, even though they believed their records were correct. And Microsoft has not said whether this is a deliberate new rule, a test, or a bug.
That last point matters for how you respond. We are not telling you Microsoft announced a new law of email. We are telling you that multiple independent senders saw real customer email bounce, and the most common shared factor was a missing DMARC record. A missing DMARC record was already a problem for anyone sending in volume. Now it looks like a problem for everyone.
What Is a DMARC Record and Why Does Outlook Care?
Email authentication is the set of DNS records that prove an email claiming to be from your business really came from you. There are three pieces, and a DMARC record is the one that ties the other two together.
- SPF (Sender Policy Framework) is a list of the servers allowed to send email for your domain, such as Google Workspace, Microsoft 365, Mailchimp or your CRM.
- DKIM (DomainKeys Identified Mail) is a digital signature added to each message so the receiving inbox can tell it was not altered in transit.
- DMARC (Domain based Message Authentication, Reporting and Conformance) is a short TXT record that tells inboxes what to do when SPF or DKIM fails, and where to send reports about who is sending email in your name.
Microsoft’s own guide to setting up DMARC says a message passes DMARC if one or both of the SPF or DKIM checks pass and line up with the domain in the From address. That lining up is called alignment. It is the reason a business can have SPF and DKIM set up correctly at the email provider and still fail DMARC: the signature belongs to the provider’s domain, not yours.
Outlook cares because spoofed email, where scammers send messages that pretend to come from a real business, is one of the biggest sources of fraud in consumer inboxes. A DMARC record is the public signal that a domain owner is paying attention. A domain with no DMARC record looks, to a filter, like a domain nobody is watching.
How Is This Different From Microsoft’s Existing Sender Rules?
Microsoft already announced strict rules for high volume senders. In its official requirements for high volume senders, posted April 2, 2025 and updated April 30, 2025, Microsoft said domains sending over 5,000 emails a day to Outlook.com, Hotmail and Live must pass SPF, pass DKIM, and publish a DMARC record of at least p=none that aligns with SPF or DKIM. Enforcement began May 5, 2025, with a rejection code of 550 5.7.515. Most small businesses never came close to 5,000 emails a day, so most ignored it.
The table below shows how the documented rule and the newly reported behavior compare.
| Detail | Microsoft Rule Since May 5, 2025 | Reported Since November 5, 2026 |
|---|---|---|
| Who it applies to | Domains sending over 5,000 emails a day | Senders of any size, based on reports |
| What triggers a bounce | Failing SPF, DKIM or DMARC requirements | No DMARC record published at all |
| Bounce code | 550 5.7.515 Access denied | 550 5.7.1, often with AS9031519 |
| Inboxes affected | Outlook.com, Hotmail, Live | Outlook.com, Hotmail, Live, MSN |
| Official confirmation | Yes, Microsoft Defender blog | None as of November 8 |
| Fix | SPF, DKIM and an aligned DMARC record | Publish a DMARC record, then check alignment |
The pattern is familiar. Google and Yahoo also began their sender rules by focusing on bulk senders. When an inbox provider starts enforcing a basic record quietly, it is usually safer to treat it as the new floor than to wait for the press release.
How Do I Know If My Business Email Is Being Rejected?
Most owners find out the hard way: a customer says they never got the estimate. Do not wait for that. Here is exactly what to check this week.
- Look for bounce messages. Search the inbox that sends your invoices and quotes for “5.7.1”, “AS9031519” or “Auth Records”. Also search for “5.7.515” and “5.7.23”.
- Check your email platform reports. In Mailchimp, Constant Contact, Klaviyo, HubSpot or your CRM, filter recent campaigns by hard bounces and look for a cluster of hotmail.com, outlook.com, live.com or msn.com addresses since November 5.
- Look up your DMARC record. Any free DNS lookup tool can check the TXT record at _dmarc.yourdomain.com. If nothing comes back, you have no DMARC record.
- Send yourself a test. Create or borrow a personal Outlook.com address and email it from every tool that sends as your business: your main inbox, your CRM, your booking software and your website contact form.
That last item is the one people skip. Your website form notifications, review request tools and appointment reminder apps often send as your domain through a different server. Each one has to be covered by SPF or DKIM for your DMARC record to pass.
What Is the Step by Step Fix This Week?
5 Steps to Stop Outlook Bounces This Week
List every tool that sends as your domain
Main inbox, newsletter platform, CRM, invoicing, booking app and website forms. Most small businesses have four to seven.
Clean up your SPF record
Keep exactly one SPF record that names each sending service, and stay under the limit of 10 DNS lookups.
Turn on DKIM with your own domain
In Google Workspace, Microsoft 365 and each marketing tool, enable custom DKIM so messages are signed as your domain, not the vendor’s.
Publish a DMARC record at p=none
Add a TXT record at _dmarc with v=DMARC1; p=none; and a rua address pointing to a shared reports mailbox.
Resend what bounced and recheck in 14 days
Hard bounces are not retried, so resend open quotes and invoices, then read the DMARC reports to confirm every tool passes.
A basic DMARC record looks like this: v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com. The p=none part means “do not block anything yet, just report.” Microsoft’s DMARC guide recommends exactly this starting point: start with p=none, monitor the results, then move to quarantine and reject over time. It also recommends sending reports to a dedicated mailbox rather than a person’s everyday inbox, because the reports arrive daily and are written for machines.
If your DNS is managed by your web host, your domain registrar, or the agency that built your website, this is a five minute change for them. If nobody knows where your DNS lives, that is a bigger risk than this bounce, and it is worth fixing now. Our website maintenance services include DNS and email authentication checks for exactly this reason.
Common Mistakes We See Right Now
- Publishing two SPF records. Adding a second SPF record for a new tool instead of merging it into the first one makes both fail.
- Jumping straight to p=reject. A strict DMARC record on day one can block your own CRM or booking app. Start at p=none and tighten after reading two weeks of reports.
- Forgetting the website contact form. Form plugins that send through your web server often fail SPF. Route them through an authenticated SMTP service instead. This is a common gap we find during technical SEO and site audits.
- Assuming Microsoft 365 handles it. Microsoft 365 does not publish a DMARC record for your custom domain on its own. Someone has to add it.
- Not resending. Fixing the DMARC record does not deliver the estimates that already bounced. Pull the bounce list and resend.
Email is still where most service businesses close the sale. A quote that never arrives costs more than a click that never happens. If you run paid ads to a landing page that sends an automatic confirmation email, that confirmation is part of your conversion path, and a missing DMARC record can break it silently. The same goes for login and password reset emails from your website. If your host was involved in a recent security incident like the one in our DreamHost breach checklist, review your email DNS at the same time, and keep plugins current as covered in our WordPress security update guide.
Frequently Asked Questions
Do I need a DMARC record if I only send a few emails a day?
Yes, based on the reports since November 5, 2026, Outlook.com appears to reject some mail from domains with no DMARC record regardless of volume. Even before this, a missing DMARC record hurt inbox placement at Gmail, Yahoo and Outlook. A p=none record is free and takes minutes.Will a DMARC record at p=none block any of my email?
No, a DMARC record set to p=none tells inboxes to take no action on failing messages and only send reports. It is the starting point Microsoft recommends in its own DMARC setup guide.Has Microsoft officially announced this change?
No, as of November 8, 2026 Microsoft had not published a statement about the November rejections. The behavior was reported by MailRoute, EasyDMARC and Windows news sites. Microsoft’s documented rule for senders over 5,000 emails a day has been in place since May 5, 2025.My SPF and DKIM pass. Why would I still fail DMARC?
The most common reason is alignment: your email tool signs with its own domain instead of yours. Turn on custom domain DKIM in each sending tool so the signature matches the domain in your From address.Does this affect email sent to Microsoft 365 business addresses?
So far, no, the reports describe rejections at personal addresses such as outlook.com, hotmail.com, live.com and msn.com, not Microsoft 365 business mailboxes. Many of your homeowner and retail customers use those personal addresses, which is why this still matters.
The businesses that win on email are not the ones with the cleverest subject lines. They are the ones whose messages actually arrive. Spend 15 minutes this week confirming your DMARC record exists, that every tool sending as your domain passes, and that last week’s bounced quotes got resent. If you would rather hand it off, the FOG Digital Marketing team in San Antonio can audit your email authentication and fix it in a single visit.
Is Your Business Email Reaching Outlook and Hotmail Customers?
FOG Digital Marketing checks your SPF, DKIM and DMARC record setup, finds every tool sending as your domain, and fixes the gaps so your quotes, invoices and campaigns land in the inbox. Book a free 30 minute call and we will look up your records live.
Our Blog
Website Design Blogs
DreamHost Breach: 5 Steps Every Website Owner Takes
Bing Webmaster Tools now shows which AI answers cite your website and which questions your competitors win. Here are 6 steps San Antonio business owners can take this...
Google Updated Its URL Rules: What Owners Check
Google Updated Its URL Rules: What Owners Check October 29, 2026 Web Design Table of Contents Google updated its URL structure guidance in late October, and the message...
WordPress 7.1.3 Fixes 7 Holes: Update Your Site Now
WordPress 7.1.3 Fixes 7 Holes: Update Your Site Now October 20, 2026 Web Design Table of Contents WordPress 7.1.3 fixes seven security holes, and the WordPress team says...