Outlook is quietly rejecting mail from domains with no DMARC record

Since 5 November, mail sent to outlook.com, hotmail.com, live.com and msn.com addresses has started bouncing for domains that have no DMARC record, even when the sender is a small office sending a handful of messages a day. The bounce reads: 550 5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records (AS9031519).

Microsoft’s published rule, in force since May 2025, only required DMARC from domains sending more than 5,000 messages a day to its consumer mail services. This rejection is hitting senders well below that line, including one-off replies. As of 6 November, Microsoft has put out no postmaster notice, blog post or service-health entry about the change, so this is being pieced together from administrators comparing notes on bounced mail, not from an official source.

The fix is a single DNS TXT record:

_dmarc.yourdomain.com  TXT  "v=DMARC1; p=none"

p=none asks receivers to report failures without rejecting anything, so it’s safe to add even if you’ve never set up DMARC before.

Why it matters: if your app sends transactional mail (password resets, contact form replies, notifications) from a domain with no DMARC record, some of it may now be silently failing to reach Outlook, Hotmail or MSN recipients, with no change on your end to explain it.

The caveat: Microsoft hasn’t confirmed this is deliberate or permanent, so what’s described here is observed behaviour, not an official policy change.