Since November 5, Microsoft’s Outlook.com has been silently bouncing email from domains with no DMARC record. No advance warning. No postmaster announcement. No official acknowledgment as of today. The bounce reads: 550 5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records (AS9031519). If you send transactional email — signups, password resets, receipts, notifications — to anyone at outlook.com, hotmail.com, live.com, or msn.com, some of your messages are failing permanently right now. The fix is one DNS record.
Check if You Are Affected
Run this from any terminal:
dig +short TXT _dmarc.yourdomain.comIf the output starts with "v=DMARC1, you have a DMARC record and you are fine. If you get nothing — or an NXDOMAIN response — you are at risk. Prefer a web tool? MXToolbox’s DMARC Lookup will check any domain in seconds.
One important note: having SPF and DKIM is not enough. Most affected senders already had both. DMARC is the record that connects your SPF and DKIM results to the domain in your From address. Without it, Microsoft now considers authentication incomplete.
The Fix: Add One DNS TXT Record
Go to your DNS host — Cloudflare, Route 53, GoDaddy, Namecheap, wherever you manage DNS — and add:
| Field | Value |
|---|---|
| Type | TXT |
| Name | _dmarc |
| Value | v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com |
| TTL | 3600 (or auto) |
The p=none policy does not block any email. It only signals to receiving servers that you have a DMARC policy in place, which is all Microsoft is currently checking for. This is a monitoring record, not an enforcement record. You will not accidentally block your own email by adding it.
Two constraints: publish exactly one DMARC record per domain, and it must start with v=DMARC1. Duplicate records cause receivers to discard both. After adding the record, expect propagation in 15 minutes to one hour.
Platform Notes
Microsoft 365: The Microsoft 365 setup wizard adds SPF and MX records for custom domains automatically, but it does not create a DMARC record. You must add it manually at your DNS host — not in the Microsoft 365 admin center. While you are there, also enable DKIM in the Microsoft Defender portal under Email & Collaboration > Policies > DomainKeys Identified Mail, then publish the two CNAME records it generates.
SendGrid, Postmark, AWS SES: These services configure SPF and DKIM when you verify your domain, but none add DMARC for you. After verifying your sending domain in any of these platforms, add the DMARC TXT record separately at your DNS host.
Google Workspace: Same pattern — enable DKIM in Admin Console and publish the generated record, then add _dmarc as a separate TXT record at your DNS host.
What to Do After p=none
Once your DMARC record is live and you are receiving aggregate reports at the rua address, review them for a few weeks. The reports show which servers are sending email that claims to be from your domain. When you are confident everything legitimate is covered, escalate the policy:
p=quarantine— failing mail goes to spam instead of bouncingp=reject— failing mail is blocked outright
Do not jump straight to p=reject without reviewing reports first. It will block your own email if any sending service is not aligned with your domain.
The Bigger Picture
This is the third major email provider to enforce DMARC in two years. Google required it for bulk senders in February 2024. Yahoo followed that same month. Now Microsoft is extending the same requirement to any sender, regardless of volume — without documenting the change. The direction the industry is heading is clear: DMARC is mandatory infrastructure, not an optional hardening step. If you run any domain that sends email, add the record today and begin the path to enforcement.
Need to verify your full email authentication setup? Internet.nl’s email test checks SPF, DKIM, and DMARC alignment in one pass. The Microsoft Q&A thread tracking affected senders is active if you want to follow ongoing reports from the community.
