--- title: "Outlook DMARC Requirements: Why Your Email Is Suddenly Bouncing" url: https://syntaxradar.com/radar/outlook-dmarc-requirements-email-bouncing author: "Abdul Rehman, Lead Systems Architect and Technical Director" publishedAt: 2026-11-09T17:00:00.000Z dateModified: 2026-11-09T17:00:00.000Z category: "#SYSTEMS-ARCH" topic: "outlook dmarc requirements" primarySource: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/strengthening-email-ecosystem-outlook%E2%80%99s-new-requirements-for-high%E2%80%90volume-senders/4399730 summary: "Outlook DMARC requirements explained: the 5,000-a-day bulk rule, the reported Nov 5, 2026 rejections, what DMARC is and the one DNS record that fixes it." --- # Outlook DMARC Requirements: Why Your Email Is Suddenly Bouncing **Short answer:** Since November 5, 2026, Outlook.com, Hotmail, Live and MSN have been rejecting some mail from domains with no DMARC record, per MailRoute. Microsoft has not confirmed it; its documented rule covers senders of 5,000+ emails a day. **Takeaway:** Microsoft only documents DMARC as mandatory for senders of 5,000+ emails a day, but MailRoute reports Outlook now refuses some mail from any domain without a record, so every domain should publish v=DMARC1; p=none. **Key figures (as reported by the source):** - Documented bulk-sender threshold: 5,000+ emails per day - Bulk rule enforcement began: May 5, 2025 - Reported rejections began: November 5, 2026 (per MailRoute) Outlook DMARC requirements officially cover domains that send more than 5,000 emails a day, but since November 5, 2026, Outlook.com, Hotmail, Live and MSN addresses have been rejecting some mail from domains with no DMARC record at all, [according to email security firm MailRoute](https://mailroute.net/blog/outlook-rejecting-email-without-dmarc). If your messages started bouncing with an Outlook DMARC error, the first fix is one DNS entry: a TXT record named `_dmarc` with the value `v=DMARC1; p=none`. Microsoft has not confirmed the change. As of November 6, 2026, MailRoute reports, Microsoft had published no postmaster notice, blog post or service-health entry about it. So two things sit side by side: the documented Outlook bulk sender requirements, which Microsoft spelled out in 2025, and a newer, unannounced pattern that rests on one vendor's logs (single secondary report). This explainer separates the two, then covers what DMARC is and how to add it. ### Outlook DMARC requirements: what changed on November 5, 2026 The documented part first. On April 2, 2025, Microsoft [announced new requirements for high-volume senders](https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/strengthening-email-ecosystem-outlook%E2%80%99s-new-requirements-for-high%E2%80%90volume-senders/4399730) on Outlook's consumer service. Any domain sending more than 5,000 emails per day must pass SPF and DKIM, and must publish a DMARC policy of at least `p=none` that aligns with the sender's domain. Enforcement began on May 5, 2025. At first, Microsoft said, mail that failed the checks would be routed to Junk rather than refused. The same post, updated on April 30, 2025 (version 4.0), says outright rejection with the code `550 5.7.515` would follow at a date still to be announced. The reported part is different. MailRoute says that from November 5, 2026, Microsoft's consumer domains started refusing some messages from domains that have no DMARC record, with no mention of volume. The bounce text it logged reads: `550 5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records (AS9031519)` On the first day, MailRoute adds, the same message appeared without the `(AS9031519)` code. Microsoft has not said whether this is a planned rollout, a test or something else. ### What is DMARC in email? DMARC, short for Domain-based Message Authentication, Reporting and Conformance, is a short DNS record that tells receiving mail servers how to treat a message that claims to come from your domain but fails authentication. It works with SPF and DKIM, two older checks: - **SPF** (Sender Policy Framework) is a DNS record listing the servers allowed to send mail for your domain. - **DKIM** (DomainKeys Identified Mail) adds a cryptographic signature to each message, which the receiver verifies against a public key in your DNS. DMARC ties them to the address people actually see. Per MailRoute, a message passes DMARC only when SPF or DKIM passes for the domain in the From address. A message can pass SPF for some other domain, such as a mailing service's, and still be an Outlook DMARC fail for yours. That matching is what "aligned" means in Microsoft's rule. The policy tag says what you want done with failures. `p=none` means "watch, but take no action," which is the minimum Microsoft asks bulk senders for. Stricter settings exist; for how Outlook treats them, Microsoft's 2023 post on [new DMARC policy handling defaults](https://techcommunity.microsoft.com/blog/exchange/announcing-new-dmarc-policy-handling-defaults-for-enhanced-email-security/3878883) is the place to start. ![Three cards showing how SPF, DKIM and DMARC check your email and stop an Outlook DMARC fail](/uploads/blog/outlook-dmarc-requirements-email-bouncing/img1.webp) ### Why is Outlook rejecting emails from my domain? If Outlook is rejecting your emails over authentication, there are two likely cases, and the bounce code hints at which one you are looking at. If you send more than 5,000 messages a day to Outlook consumer addresses and your SPF, DKIM or DMARC setup is incomplete, you fall under Microsoft's documented rule. Microsoft's announced rejection code for that case is `550 5.7.515 Access denied, sending domain does not meet the required authentication level`. If you are a small sender and the bounce reads `550 5.7.1 ... Message lacks SPF/DKIM/DMARC Auth Records`, you match the pattern MailRoute describes: a domain with no DMARC record at all, refused regardless of volume. Two details make this failure awkward to diagnose: - **It is partial.** MailRoute says only some messages from affected domains are refused. One email that arrives does not prove your domain is fine. - **Safe Sender lists will not save you.** Microsoft's FAQ for the bulk rule says Safe Sender lists are not honored for this enforcement, so asking recipients to whitelist you does not help with that check. The two Outlook DMARC error codes differ: `5.7.515` is the one Microsoft documented, while the reported bounces carry `5.7.1`. Our reading, not a sourced fact: the November 5 rejections may come from a separate mechanism, not the bulk-sender rollout. Neither source says so, and Microsoft has not commented. ### Do I need DMARC for Outlook? Yes, if you send more than 5,000 emails a day to Outlook consumer addresses: Microsoft's Outlook bulk sender guidelines require it. If you send less, Microsoft's published requirement does not name you, but MailRoute's report suggests domains with no DMARC record can now get some mail refused anyway. That makes the cost comparison lopsided. A `p=none` record takes a few minutes to publish and, by design, asks receivers to take no action on failures. Skipping it now risks bounces at outlook.com, hotmail.com, live.com and msn.com addresses, per MailRoute. There is one common trap for small businesses setting up a DMARC record on Microsoft 365. MailRoute notes that the default DKIM signature Microsoft 365 applies uses your onmicrosoft.com domain, and that signature does not count toward DMARC for your own domain. Until you enable DKIM for your custom domain, your mail can lack DKIM alignment even though it is technically signed. ![Outlook DMARC requirements timeline: bulk rule May 5, 2025, reported rejections November 5, 2026, 549 days apart](/uploads/blog/outlook-dmarc-requirements-email-bouncing/img2.webp) ### How do I check if my domain has a DMARC record? You can check if your domain has a DMARC record with one terminal command. MailRoute suggests: `dig +short TXT _dmarc.example.com` Replace `example.com` with your domain. If the command prints nothing, you have no DMARC record. If it prints a line starting with `v=DMARC1`, you have one. Log in to wherever your DNS is hosted and create: - **Type:** TXT - **Name:** `_dmarc` - **Value:** `v=DMARC1; p=none` Then work through the rest of the short list: 1. **Confirm SPF.** Make sure every service that sends as your domain (your mailbox provider, newsletter tool, invoicing app) is covered. Microsoft's FAQ warns that an SPF record needing more than 10 DNS lookups may fail the check, so trim includes you no longer use. 2. **Turn on DKIM for your own domain.** On Microsoft 365 that means enabling custom-domain DKIM, not relying on the onmicrosoft.com default. 3. **Re-test.** Send to an Outlook.com or Hotmail address several times, since rejections are partial, and read any bounce codes closely. ### What we checked: the gap and the 5,000 threshold This SyntaxRadar calculation uses only dates and figures from Microsoft's post and MailRoute's report.
ItemInputResult
Bulk rule enforcement startsMay 5, 2025 (Microsoft)Junk folder first, 550 5.7.515 rejection "to be announced"
Reported rejections startNovember 5, 2026 (MailRoute, single secondary report)Some mail refused from domains with no DMARC record
Gap between the twoMay 5, 2025 to November 5, 2026549 days, about 18 months
Bulk threshold as a rate5,000 emails per day รท 1,440 minutesAbout 3.5 emails per minute, around the clock
The rate is the useful number. Sending 3.5 messages a minute, every minute of every day, is a high bar, and for roughly 18 months Microsoft's written rule left every domain below it out of scope. If MailRoute's logs reflect a real policy, that line has moved for domains with no DMARC record, and it moved without an announcement. If you run a small team's infrastructure, our guide to the [OpenSSH vulnerability 2026 fix](/radar/openssh-vulnerability-2026-alpine-fix) is another case of a quiet change you only catch by checking your own systems. Our explainer on [what botnets are](/radar/what-are-botnets-android-tv-boxes) covers the hijacked-device side of the spam problem that authentication checks are built to fight. And if you are weighing which services can act on your behalf, our piece asking [is Plaid safe to use](/radar/is-plaid-safe-to-use-with-claude) walks through a similar trust question for your bank account. ### What to watch next The open question is whether Microsoft confirms the November 5 behaviour and, if so, whether it attaches a code and a volume rule to it. Watch the [Microsoft Tech Community post](https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/strengthening-email-ecosystem-outlook%E2%80%99s-new-requirements-for-high%E2%80%90volume-senders/4399730) for a dated announcement of the `550 5.7.515` rejection phase, and watch your own bounce logs for either code. Until then, treat the Outlook DMARC requirements as covering everyone. One TXT record, plus SPF and DKIM set up for your own domain, puts you on the right side of both the documented rule and the reported one. ## Frequently asked questions ### What is DMARC in email? DMARC is a DNS record that tells receiving mail servers what to do when a message claiming to come from your domain fails authentication. It builds on SPF and DKIM, and a message passes only when SPF or DKIM passes for the domain in the visible From address. The minimal version, p=none, asks receivers to watch but take no action. ### Why is Outlook rejecting emails from my domain? Either you send more than 5,000 emails a day and fail Microsoft's documented SPF, DKIM and DMARC checks, or your domain has no DMARC record at all. MailRoute reports that since November 5, 2026, Outlook consumer domains refuse some messages from domains without one, with the bounce 550 5.7.1 Message lacks SPF/DKIM/DMARC Auth Records. Microsoft has not confirmed that change. ### Do I need DMARC for Outlook? Microsoft requires it for domains sending more than 5,000 emails a day to Outlook consumer addresses, at a policy of at least p=none and aligned with your domain. For smaller senders the written rule does not apply, but MailRoute's report of rejections for domains with no record makes publishing one a sensible step for everyone. ### How do I check if my domain has a DMARC record? Run dig +short TXT _dmarc.yourdomain.com in a terminal, replacing yourdomain.com with your own domain. No output means no DMARC record. To add one, create a TXT record named _dmarc with the value v=DMARC1; p=none at your DNS host, then make sure SPF and custom-domain DKIM are also set up. ### How do I fix an Outlook DMARC error? Publish a DMARC record, a TXT record named _dmarc with the value v=DMARC1; p=none, at your DNS host. Then confirm SPF covers every service that sends as your domain, enable DKIM for your custom domain on Microsoft 365, and re-test several times, since MailRoute says the rejections are partial. ## Source Based on Microsoft's Tech Community post and MailRoute's bounce logs. https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/strengthening-email-ecosystem-outlook%E2%80%99s-new-requirements-for-high%E2%80%90volume-senders/4399730 --- Published on SyntaxRadar (https://syntaxradar.com). Canonical URL: https://syntaxradar.com/radar/outlook-dmarc-requirements-email-bouncing. Last modified 2026-11-09T17:00:00.000Z.