Outlook DMARC Requirements: Why Your Email Is Suddenly Bouncing

Outlook DMARC requirements officially cover domains that send more than 5,000 emails a day, but since November 5, 2026, Outlook.com, Hotmail, Live and MSN addresses have been rejecting some mail from domains with no DMARC record at all, according to email security firm MailRoute. If your messages started bouncing with an Outlook DMARC error, the first fix is one DNS entry: a TXT record named _dmarc with the value v=DMARC1; p=none.

Microsoft has not confirmed the change. As of November 6, 2026, MailRoute reports, Microsoft had published no postmaster notice, blog post or service-health entry about it. So two things sit side by side: the documented Outlook bulk sender requirements, which Microsoft spelled out in 2025, and a newer, unannounced pattern that rests on one vendor's logs (single secondary report). This explainer separates the two, then covers what DMARC is and how to add it.

Outlook DMARC requirements: what changed on November 5, 2026

The documented part first. On April 2, 2025, Microsoft announced new requirements for high-volume senders on Outlook's consumer service. Any domain sending more than 5,000 emails per day must pass SPF and DKIM, and must publish a DMARC policy of at least p=none that aligns with the sender's domain.

Enforcement began on May 5, 2025. At first, Microsoft said, mail that failed the checks would be routed to Junk rather than refused. The same post, updated on April 30, 2025 (version 4.0), says outright rejection with the code 550 5.7.515 would follow at a date still to be announced.

The reported part is different. MailRoute says that from November 5, 2026, Microsoft's consumer domains started refusing some messages from domains that have no DMARC record, with no mention of volume. The bounce text it logged reads:

550 5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records (AS9031519)

On the first day, MailRoute adds, the same message appeared without the (AS9031519) code. Microsoft has not said whether this is a planned rollout, a test or something else.

What is DMARC in email?

DMARC, short for Domain-based Message Authentication, Reporting and Conformance, is a short DNS record that tells receiving mail servers how to treat a message that claims to come from your domain but fails authentication. It works with SPF and DKIM, two older checks:

• SPF (Sender Policy Framework) is a DNS record listing the servers allowed to send mail for your domain.
• DKIM (DomainKeys Identified Mail) adds a cryptographic signature to each message, which the receiver verifies against a public key in your DNS.

DMARC ties them to the address people actually see. Per MailRoute, a message passes DMARC only when SPF or DKIM passes for the domain in the From address. A message can pass SPF for some other domain, such as a mailing service's, and still be an Outlook DMARC fail for yours. That matching is what "aligned" means in Microsoft's rule.

The policy tag says what you want done with failures. p=none means "watch, but take no action," which is the minimum Microsoft asks bulk senders for. Stricter settings exist; for how Outlook treats them, Microsoft's 2023 post on new DMARC policy handling defaults is the place to start.

Why is Outlook rejecting emails from my domain?

If Outlook is rejecting your emails over authentication, there are two likely cases, and the bounce code hints at which one you are looking at.

If you send more than 5,000 messages a day to Outlook consumer addresses and your SPF, DKIM or DMARC setup is incomplete, you fall under Microsoft's documented rule. Microsoft's announced rejection code for that case is 550 5.7.515 Access denied, sending domain does not meet the required authentication level.

If you are a small sender and the bounce reads 550 5.7.1 ... Message lacks SPF/DKIM/DMARC Auth Records, you match the pattern MailRoute describes: a domain with no DMARC record at all, refused regardless of volume.

Two details make this failure awkward to diagnose:

• It is partial. MailRoute says only some messages from affected domains are refused. One email that arrives does not prove your domain is fine.
• Safe Sender lists will not save you. Microsoft's FAQ for the bulk rule says Safe Sender lists are not honored for this enforcement, so asking recipients to whitelist you does not help with that check.

The two Outlook DMARC error codes differ: 5.7.515 is the one Microsoft documented, while the reported bounces carry 5.7.1. Our reading, not a sourced fact: the November 5 rejections may come from a separate mechanism, not the bulk-sender rollout. Neither source says so, and Microsoft has not commented.

Do I need DMARC for Outlook?

Yes, if you send more than 5,000 emails a day to Outlook consumer addresses: Microsoft's Outlook bulk sender guidelines require it. If you send less, Microsoft's published requirement does not name you, but MailRoute's report suggests domains with no DMARC record can now get some mail refused anyway.

That makes the cost comparison lopsided. A p=none record takes a few minutes to publish and, by design, asks receivers to take no action on failures. Skipping it now risks bounces at outlook.com, hotmail.com, live.com and msn.com addresses, per MailRoute.

There is one common trap for small businesses setting up a DMARC record on Microsoft 365. MailRoute notes that the default DKIM signature Microsoft 365 applies uses your onmicrosoft.com domain, and that signature does not count toward DMARC for your own domain. Until you enable DKIM for your custom domain, your mail can lack DKIM alignment even though it is technically signed.

How do I check if my domain has a DMARC record?

You can check if your domain has a DMARC record with one terminal command. MailRoute suggests:

dig +short TXT _dmarc.example.com

Replace example.com with your domain. If the command prints nothing, you have no DMARC record. If it prints a line starting with v=DMARC1, you have one.

Log in to wherever your DNS is hosted and create:

• Type: TXT
• Name: _dmarc
• Value: v=DMARC1; p=none

Then work through the rest of the short list:

1. Confirm SPF. Make sure every service that sends as your domain (your mailbox provider, newsletter tool, invoicing app) is covered. Microsoft's FAQ warns that an SPF record needing more than 10 DNS lookups may fail the check, so trim includes you no longer use.

1. Turn on DKIM for your own domain. On Microsoft 365 that means enabling custom-domain DKIM, not relying on the onmicrosoft.com default.

1. Re-test. Send to an Outlook.com or Hotmail address several times, since rejections are partial, and read any bounce codes closely.

What we checked: the gap and the 5,000 threshold

This SyntaxRadar calculation uses only dates and figures from Microsoft's post and MailRoute's report.

The rate is the useful number. Sending 3.5 messages a minute, every minute of every day, is a high bar, and for roughly 18 months Microsoft's written rule left every domain below it out of scope. If MailRoute's logs reflect a real policy, that line has moved for domains with no DMARC record, and it moved without an announcement.

If you run a small team's infrastructure, our guide to the OpenSSH vulnerability 2026 fix is another case of a quiet change you only catch by checking your own systems. Our explainer on what botnets are covers the hijacked-device side of the spam problem that authentication checks are built to fight. And if you are weighing which services can act on your behalf, our piece asking is Plaid safe to use walks through a similar trust question for your bank account.

What to watch next

The open question is whether Microsoft confirms the November 5 behaviour and, if so, whether it attaches a code and a volume rule to it. Watch the Microsoft Tech Community post for a dated announcement of the 550 5.7.515 rejection phase, and watch your own bounce logs for either code.

Until then, treat the Outlook DMARC requirements as covering everyone. One TXT record, plus SPF and DKIM set up for your own domain, puts you on the right side of both the documented rule and the reported one.