Microsoft Blocks Mail to Outlook and Hotmail Without DMARC
Since 5 November, Outlook, Hotmail, Live and MSN have been rejecting some emails from domains with no DMARC record, even though Microsoft announced no such change.
SUMO· the number puzzle
Dialo· learn languages by speaking
ediviewer· read EDI files like documents
giftdetect· the right gift in minutesSince 5 November 2026, email administrators have reported that messages sent to hotmail.com, outlook.com, live.com and msn.com addresses are sometimes bounced when the sender's domain publishes no DMARC record. The error reads: "Message rejected: Message lacks SPF/DKIM/DMARC Auth Records". Microsoft has made no official announcement.
Why small senders are affected
The error points to three mechanisms that let a recipient verify where a message comes from. SPF lists the servers allowed to send mail for a domain. DKIM adds a digital signature proving the message was not altered in transit. DMARC checks that these results match the domain shown in the sender's address. The aim is to make phishing by impersonation harder.
Many small organizations already have SPF and DKIM, often set up by their host, but never added DMARC. Since 5 May 2025, Microsoft has required all three for domains sending more than 5,000 messages a day to its consumer mail services. The new rejections appear to hit custom domains of any volume, and reports say a missing DMARC record can be enough even when SPF and DKIM work.
Microsoft has not confirmed that the rule now covers all senders, and its official policy still centers on the 5,000-message threshold. Observations from firms such as MailRoute therefore suggest a de facto tightening that is not yet documented. According to MailRoute, only part of a domain's messages are rejected, and a bounced mail can sometimes get through on a retry. Companies receiving mail on Microsoft 365 do not seem to be affected as recipients.
How to fix it
Free online tools can show whether a domain already publishes DMARC. If it does not, Microsoft's documentation recommends adding a DNS TXT record named _dmarc with the value v=DMARC1; p=none. It is created in the DNS settings of the host or registrar managing the domain. The p=none policy only signals that the domain uses DMARC and does not ask receiving servers to block non-compliant mail.
Microsoft stresses that DMARC does not replace the other mechanisms: SPF or DKIM must still be correctly configured and aligned with the visible sender domain. It remains unclear whether Microsoft will keep, relax or formalize the stricter filtering.
Apps worth a look
SUMO: the number puzzleTap the right tiles, add them up, hit the target. Easy to learn, hard to master. Free, for all ages.
Dialo: learn languages by speakingTalk to an AI conversation partner; every sentence comes back corrected and explained in your language. 9 languages, A1 to C2.
ediviewer: read EDI files like documentsOpen EDIFACT and X12 messages, see every segment explained, convert to JSON/XML, export PDF and Excel. Runs locally, no upload.
giftdetect: the right gift in minutesPick who it is for, the occasion and their personality. The search engine reads product descriptions from local shops and ranks what fits. Free, no sign-up.
More from this day
See all →
XPeng G6 and G9 Electric SUVs Go on Sale in Russia With Yandex
Yandex Market Launches 24/7 Live Shopping Streams in Its App
600,000 Nvidia H200 Chips Reportedly Stuck in Hong Kong Warehouse
