Outlook.com rejects mail from domains without DMARC records with 550 5.7.1 bounces since November 5, 2026, with no Microsoft advisory

Linha do tempo

1. theregister.com ↗ · pub. 09/11/2026 10:30 · coletado 09/11 12:00

   Outlook.com rejects legitimate email from domains with missing DMARC or weak SPF after Microsoft authentication change

   ler a análise desta fonte ocultar

   Since the end of the previous week, Microsoft's consumer mail service Outlook.com has been bouncing some legitimate messages with SPF validation errors and complaints about missing DMARC information (theregister.com). EasyDMARC dates the rejections to November 5, 2026 and reports them against domains that publish no DMARC record, even when SPF and DKIM pass (easydmarc.com). Microsoft has published no advisory on the change, and a moderator in its support forum classed the problem as a “service degradation” (theregister.com). The failures are intermittent, since a resend can succeed, and the bounce text is often vague about the cause. For defenders this is an operational mail-delivery problem with no vulnerability, exploitation or intrusion behind it, but it blocks legitimate mail to Outlook.com users.

   Technical Details

   • Microsoft tightened its acceptance rules for high-volume senders in 2025, requiring SPF, DKIM and DMARC for domains sending more than 5,000 emails per day (theregister.com). The current rejections reach smaller senders as well, which the 2025 rules did not cover (theregister.com).
   • The rejection seen by EasyDMARC carries the diagnostic “Message lacks SPF/DKIM/DMARC Auth Records” and was logged on November 8, 2026 (easydmarc.com).
   • The Register describes a DMARC policy of at least p=none, aligned with SPF or DKIM, as the target configuration (theregister.com).
   • A separate, unrelated Microsoft incident hit users in Europe, the Middle East and Africa: a “recent service change” abruptly terminated some connections to Outlook on the web and the Purview and Defender portals. Microsoft reverted it in the Exchange Online front-end infrastructure (theregister.com).

   Remediation

   • Check that the sending domain has a valid SPF record listing its authorized hosts, DKIM signing enabled, and a DMARC record at least at p=none aligned with SPF or DKIM (theregister.com).
   • Retry rejected messages and collect the non-delivery codes, because the failures are intermittent (theregister.com).
   • No official Microsoft fix or guidance had been published at the time of research (easydmarc.com). Watch Microsoft’s sender and Outlook.com support channels for an explanation of the rule change.

   Conflicting Reports

   • The Register describes the 2025 rules as aimed at senders above 5,000 emails per day, and says the new rejections also hit smaller senders (theregister.com). EasyDMARC’s table lists the November 2026 rejection as applying to senders below 5,000 per day, with a DMARC record required (easydmarc.com). The EasyDMARC observation is the more specific of the two.
2. securityonline.info ↗ · pub. 09/11/2026 05:44 · coletado 09/11 06:00 primeiro registro

   Outlook.com rejects mail from domains without DMARC records with 550 5.7.1 bounces

   ler a análise desta fonte ocultar

   Since November 5, 2026, Outlook.com, Hotmail, Live and MSN have been rejecting part of the inbound mail from domains that publish no DMARC record (securityboulevard.com). The rejected messages receive a 550 5.7.1 bounce stating that the message lacks SPF/DKIM/DMARC authentication records, and Microsoft 365 business tenants do not appear to be affected as recipients (securityboulevard.com). MailRoute detected the change and reports that transactional traffic such as order confirmations, verification codes and support notices is hit (mailroute.net). A separate, older bulk-sender rule (550 5.7.515) applies above 5,000 messages a day from one From domain and requires SPF, DKIM and DMARC to pass (mailroute.net; mailercloud.com). This is an authentication enforcement change, not a vulnerability: no CVE, threat actor or exploitation is reported, so the impact is lost delivery for legitimate senders and weaker spoofing protection on domains that stay unauthenticated.

   Technical Details

   • The bounce carries the diagnostic text 'Message rejected: Message lacks SPF/DKIM/DMARC Auth Records' with status 550, and the remote MTA is live-com.olc.protection.outlook.com (securityboulevard.com).
   • The rejection reaches small domains as well as high-volume senders, so volume does not exempt a domain (mailroute.net).
   • The Microsoft Learn page cited by the article was not opened during this research, and no Microsoft statement on the change was found in the pages opened.

   Remediation

   • Publish a DMARC TXT record at _dmarc., starting with p=none, which stops the rejections once the record is live in DNS (securityboulevard.com; mailroute.net).
   • Move to quarantine or reject once monitoring shows that legitimate mail passes SPF and DKIM, as the article recommends.
   • Resend mail that bounced, because a 5xx is permanent and Outlook.com will not retry it (securityboulevard.com).

   Conflicting Reports

   • The article says enforcement began in early November 2026 and that Microsoft requires an active DMARC policy. securityboulevard.com dates the start to November 5, 2026, and mailroute.net states that a p=none record is enough to stop the rejections, so any DMARC record suffices and the stricter policy is not required.