Outlook.com rejects legitimate email from domains with missing DMARC or weak SPF after Microsoft authentication change
Since the end of the previous week, Microsoft's consumer mail service Outlook.com has been bouncing some legitimate messages with SPF validation errors and complaints about missing DMARC information (theregister.com). EasyDMARC dates the rejections to November 5, 2026 and reports them against domains that publish no DMARC record, even when SPF and DKIM pass (easydmarc.com). Microsoft has published no advisory on the change, and a moderator in its support forum classed the problem as a “service degradation” (theregister.com). The failures are intermittent, since a resend can succeed, and the bounce text is often vague about the cause. For defenders this is an operational mail-delivery problem with no vulnerability, exploitation or intrusion behind it, but it blocks legitimate mail to Outlook.com users.
Detalhes técnicos
- Microsoft tightened its acceptance rules for high-volume senders in 2025, requiring SPF, DKIM and DMARC for domains sending more than 5,000 emails per day (theregister.com). The current rejections reach smaller senders as well, which the 2025 rules did not cover (theregister.com).
- The rejection seen by EasyDMARC carries the diagnostic “Message lacks SPF/DKIM/DMARC Auth Records” and was logged on November 8, 2026 (easydmarc.com).
- The Register describes a DMARC policy of at least p=none, aligned with SPF or DKIM, as the target configuration (theregister.com).
- A separate, unrelated Microsoft incident hit users in Europe, the Middle East and Africa: a “recent service change” abruptly terminated some connections to Outlook on the web and the Purview and Defender portals. Microsoft reverted it in the Exchange Online front-end infrastructure (theregister.com).
Remediação
- Check that the sending domain has a valid SPF record listing its authorized hosts, DKIM signing enabled, and a DMARC record at least at p=none aligned with SPF or DKIM (theregister.com).
- Retry rejected messages and collect the non-delivery codes, because the failures are intermittent (theregister.com).
- No official Microsoft fix or guidance had been published at the time of research (easydmarc.com). Watch Microsoft’s sender and Outlook.com support channels for an explanation of the rule change.
Relatos divergentes
- The Register describes the 2025 rules as aimed at senders above 5,000 emails per day, and says the new rejections also hit smaller senders (theregister.com). EasyDMARC’s table lists the November 2026 rejection as applying to senders below 5,000 per day, with a DMARC record required (easydmarc.com). The EasyDMARC observation is the more specific of the two.
Linha do tempo
-
Outlook.com rejects legitimate email from domains with missing DMARC or weak SPF after Microsoft authentication change
ler a análise desta fonte ocultar
Since the end of the previous week, Microsoft's consumer mail service Outlook.com has been bouncing some legitimate messages with SPF validation errors and complaints about missing DMARC information (theregister.com). EasyDMARC dates the rejections to November 5, 2026 and reports them against domains that publish no DMARC record, even when SPF and DKIM pass (easydmarc.com). Microsoft has published no advisory on the change, and a moderator in its support forum classed the problem as a “service degradation” (theregister.com). The failures are intermittent, since a resend can succeed, and the bounce text is often vague about the cause. For defenders this is an operational mail-delivery problem with no vulnerability, exploitation or intrusion behind it, but it blocks legitimate mail to Outlook.com users.
Technical Details
- Microsoft tightened its acceptance rules for high-volume senders in 2025, requiring SPF, DKIM and DMARC for domains sending more than 5,000 emails per day (theregister.com). The current rejections reach smaller senders as well, which the 2025 rules did not cover (theregister.com).
- The rejection seen by EasyDMARC carries the diagnostic “Message lacks SPF/DKIM/DMARC Auth Records” and was logged on November 8, 2026 (easydmarc.com).
- The Register describes a DMARC policy of at least p=none, aligned with SPF or DKIM, as the target configuration (theregister.com).
- A separate, unrelated Microsoft incident hit users in Europe, the Middle East and Africa: a “recent service change” abruptly terminated some connections to Outlook on the web and the Purview and Defender portals. Microsoft reverted it in the Exchange Online front-end infrastructure (theregister.com).
Remediation
- Check that the sending domain has a valid SPF record listing its authorized hosts, DKIM signing enabled, and a DMARC record at least at p=none aligned with SPF or DKIM (theregister.com).
- Retry rejected messages and collect the non-delivery codes, because the failures are intermittent (theregister.com).
- No official Microsoft fix or guidance had been published at the time of research (easydmarc.com). Watch Microsoft’s sender and Outlook.com support channels for an explanation of the rule change.
Conflicting Reports
- The Register describes the 2025 rules as aimed at senders above 5,000 emails per day, and says the new rejections also hit smaller senders (theregister.com). EasyDMARC’s table lists the November 2026 rejection as applying to senders below 5,000 per day, with a DMARC record required (easydmarc.com). The EasyDMARC observation is the more specific of the two.