Outlook.com and other Microsoft consumer email services begin partially rejecting mail from domains without DMARC starting November 5
Email security service provider MailRoute and others reported that, starting November 5, 2026, Microsoft consumer email services (outlook.com, hotmail.com, live.com, msn.com) began rejecting some mail from domains not configured with DMARC records. The rejection error is “550 5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records (AS9031519)”. This phenomenon affects low-volume senders, even when SPF and DKIM have passed.
Previously, in May 2025, Microsoft required bulk senders that send more than 5,000 emails per day to configure SPF, DKIM, and DMARC, otherwise returning error 550 5.7.515. This time, the rejection uses a different error code and there has been no official announcement from Microsoft. Independent tests showed that after deleting the DMARC record for a low-volume domain, mail sent to outlook.com was rejected, while mail sent to Microsoft 365-hosted domains could still be delivered. Publishing a TXT record of “v=DMARC1; p=none” can stop the rejection.
Original sources:
Title: Outlook.com Is Quietly Rejecting Email From Domains Without DMARC Publisher: MailRoute (Thomas A. Johnson) Publication date: 2026-11-06 URL: https://mailroute.net/blog/outlook-rejecting-email-without-dmarc Nature of source: service provider observation report Verification status: This reading covered the relevant English report and test records, verification date 2026-11-08 Supporting content: supports the statements that consumer email has been partially rejecting mail from DMARC-less domains since November 5, the error code, the impact on low-volume senders, and the lack of an official announcement
ABAB AI Insight
This rejection targets Microsoft consumer email servers (*.olc.protection.outlook.com) and is different from the Microsoft 365 enterprise email path. Tests showed that the same DMARC-less email was rejected by consumer mailboxes but could be received by 365 domains. The rejection occurs at the SMTP stage; the recipient does not see the email, and the sender receives a bounce.
Compared with Microsoft’s 2025 bulk sender rules, this time the error code is different and the scope has expanded to low-volume domains. Email operators and independent testers reproduced the rejection by deleting their own DMARC records, and delivery resumed after adding a record. As of November 8, Microsoft had not published a relevant announcement or service status update.
A DMARC record itself does not change how other providers, such as Gmail, handle mail. p=none only states that the domain uses DMARC and requests reports; it does not require rejecting failed mail. Many custom domains have SPF and DKIM configured but lack DMARC, which is what triggered this issue.
This change alters the acceptance threshold of Microsoft consumer email for domains without DMARC. The observation indicators are whether Microsoft issues an official explanation or adjusts its policy, and whether other major email providers follow similar requirements.
ABAB News · Cognitive Law
Consumer email and enterprise email use different paths, so the handling result for the same email can differ between the two systems.
A rejection policy without an official announcement can be confirmed through bounce codes and independent tests, but that does not mean it has become a public policy.