Incoming emails being blocked due to lack of SPF/DKIM/DMARC records on my @outlook.com account

Rodney Graham 50

Is there a way yet to get @outlook.com email addresses to have proper DMARC auth records because in the past you could still receive emails without a problem, you just had to warn people your emails might end up in spam.

Now people sending me emails are getting messages about my email address being blocked due to lack of SPF/DKIM/DMARC records on my @outlook.com account.

Please see the attachment for the full error message.

How do I get my outlook email receiving properly again, I don't want to go over to gmail because of this.

Thanks

Kath Daly 10 Reputation points

2026-11-06T21:16:27.6166667+00:00

I am experiencing exactly the same problem, starting around 4–5 November 2026.

It is affecting two separate personal Outlook.com accounts, with emails being intermittently rejected from multiple senders using different providers, including Google and Zoho.

I have the same 550 5.7.1 authentication rejection error, including AS9031519.

Oneexample yesterday (5 November). A sender using Zoho had an email rejected at 15:50, then resent it at 16:09 and it arrived successfully.

I examined the full headers of the successful email. Microsoft's own authentication results show SPF=pass, DKIM=pass and compauth=pass.

I appreciate that individual messages can have different authentication results, but the sudden onset, intermittent failures and reports from multiple Outlook.com users suggest this needs investigating as a possible wider Microsoft filtering issue.

Can Microsoft confirm whether these reports are being escalated to its Outlook.com mail protection team, rather than handled individually as unrelated sender configuration problems?
AG 10 Reputation points

2026-11-07T03:52:03.0833333+00:00

This is insane. Why is Microsoft doing this? I’m not going to ask an email sender to do something they are not familiar with doing. At this point - Gmail maybe won.
AG 10 Reputation points

2026-11-07T03:54:53.49+00:00

I didn’t get messages for 6 hours today. Now certain people are saying my email is blocked. What is going on??
Vikki-T 14,115 Reputation points Microsoft External Staff Moderator

2026-11-07T11:45:01.93+00:00

Hi Kath Daly,

Thank you for providing these detailed test results. The fact that the rejection is intermittent, affects two separate Outlook.com accounts, and occurs with senders using different providers makes this broader than a single obvious sender-domain configuration issue.

That said, the authentication results from the successfully delivered message do not necessarily show how the earlier rejected message was evaluated. The most useful evidence would be the complete non-delivery reports from several failed attempts, especially the timestamps, sending IP addresses, authentication details, rejecting server, and the full AS9031519 error text.

As this is a user-to-user support forum, contributors cannot confirm whether these reports have already been escalated to Microsoft’s Outlook.com mail protection team or access any internal investigation. I recommend submitting the failed NDRs through Outlook.com’s Help > Still need help? option while signed in. Please mention that the issue is intermittent, affects two accounts, and involves multiple unrelated sending providers. Those details may help Microsoft distinguish a broader filtering issue from an individual sender configuration problem.

In the meantime, please retain both the failed NDRs and the headers of successfully delivered retries, with personal information redacted before posting them publicly.
Vikki-T 14,115 Reputation points Microsoft External Staff Moderator

2026-11-07T11:45:40.7666667+00:00

Hi AG,

I understand why this is concerning, especially when messages stopped arriving for several hours and different senders are now reporting that delivery is being blocked.

The rejection does not necessarily mean that your Outlook.com account itself has been blocked. It may refer to how a particular incoming message or sending domain was evaluated. However, since you appear to be seeing failures from more than one sender, it would be helpful to confirm whether all of them received the same error.

Could you ask one or two affected senders to send you a screenshot or copy of the complete bounce message, including the numerical error code? Please remove any email addresses or other personal information before posting it here.

If senders from several unrelated email providers are receiving the same rejection, report the issue through Outlook.com’s Help > Still need help? option and include the complete error messages and approximate failure times. This is a user-to-user support forum, so contributors cannot inspect Microsoft’s mail filtering systems or confirm whether your account is affected by a service-side issue, but those details will give Outlook.com Support the evidence needed to investigate.
Kath Daly 10 Reputation points

2026-11-07T13:12:20.2633333+00:00

Just to say i spent about an hour yesteray trying to report this through outlook.com's help optoin and got sent round in circles and eventually the chat was ended abruptly and with no chance to get a copy even of the transcript. Hugely frustrating waste of my time
Hornblower409 19,070 Reputation points

2026-11-08T02:19:42.5066667+00:00

@Kath Daly said

spent about an hour yesteray trying to report this through outlook.com's help optoin

I am sorry you got caught in the Microsoft Support labyrinth. But it would not have done you any good anyway. This is not a problem that Support can fix.

About all you can do at this point is to Submit a Problem Report if mail is being rejected when sent to your Outlook.com or Hotmail.com mailbox mailbox.

See the Answer by "Hornblower409 Nov 2026"
at https://learn.microsoft.com/en-us/answers/a/13036152
in https://learn.microsoft.com/en-us/answers/questions/6063210/
J S 0 Reputation points

2026-11-09T01:17:24.2166667+00:00

My own husband cannot send me emails due to the SPF error message he keeps receiving. How can this be fixed? Preferably on Microsoft’s end. I can’t be sure how many other emails are not getting through either.
Hornblower409 19,070 Reputation points

2026-11-09T01:40:25.8466667+00:00

@J S said

How can this be fixed? Preferably on Microsoft’s end

So far there has been no official acknowledgement of the issue from Microsoft, so no ones knows when they might fix it. At the moment the only workaround involves the sender making changes to their mailbox configuration.

See the Answer by "Hornblower409 Nov 2026"
at https://learn.microsoft.com/en-us/answers/a/13036152
in https://learn.microsoft.com/en-us/answers/questions/6063210/

I can’t be sure how many other emails are not getting through either.

Yes. We are all facing that problem as well.
S.S 5 Reputation points

2026-11-09T07:14:09.66+00:00

If you're on the sending side and getting this bounce, here's what I'd check first. It takes about 10 minutes.

First, see if your domain even has a DMARC record. Just type it into mxtoolbox.com/dmarc. If it says no record found, that's most likely your problem right there.

If it's missing, go to wherever your DNS is (GoDaddy, Namecheap, Cloudflare, whoever) and add a TXT record:

Name: _dmarc Value: v=DMARC1; p=none; rua=mailto:******@yourdomain.com

Don't worry about p=none. It just monitors and won't block anything. The rua part gets you daily reports so you can see who's sending mail as your domain, which is good to know anyway.

Next, make sure SPF and DKIM are actually passing for your domain. This is the one that trips people up. If you're on Microsoft 365, DKIM signs with your onmicrosoft.com domain by default, not your real one, so you have to go into the Defender portal (Email authentication settings > DKIM) and turn it on for your domain. On Google Workspace it's under Admin console > Apps > Gmail > Authenticate email.

Then test it. Send yourself something at an Outlook or Hotmail address and look at the headers. You want spf=pass, dkim=pass, dmarc=pass.

If you're still getting bounces after all that, save the whole bounce message, not just a screenshot of the error. Microsoft needs the timestamp, the rejecting server and the full AS9031519 line to look into it.

Also, if anyone here already has DMARC set up and passing and is STILL getting bounced, please post it (with your info removed). That's what will prove this is on Microsoft's end and not just missing records, and it's probably the only thing that gets this escalated.

Answer accepted by question author

Vikki-T 14,115 Microsoft External Staff Moderator

Hi Rodney Graham,

Your personal @outlook.com address does not need separate SPF, DKIM, or DMARC records added by you. Microsoft manages the DNS records for the outlook.com domain, so there is no setting in your mailbox that allows you to create or modify them.

The rejection message is more likely referring to the authentication of the sender’s domain. Please ask the affected sender to provide the complete non-delivery report to their email administrator or provider so they can check the sending domain’s SPF, DKIM, and DMARC configuration.

It would also help to determine the scope of the issue:

If messages fail only from one company or domain, the sender’s email administrator will need to investigate.
If messages from several unrelated providers are being rejected, ask each sender for the complete error message and then contact Outlook.com Support through Help > Still need help? while signed in to your account.

Microsoft’s explanation of this authentication error is available here: Fix NDR error 550 5.7.515 in Outlook.com.

Adding the sender to Safe senders is unlikely to resolve this specific error because the message is being rejected before it reaches your mailbox. Thank you so much for your understanding.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Laura 0 Reputation points

2026-11-08T06:14:49.34+00:00

Bonjour

Depuis mon adresse OVH et via Outlook, les mails dirigés vers Hotmail.com sont rejetés :

[moderator's note: PII removed] said: 550 5.7.1

Message rejected: Message lacks SPF/DKIM/DMARC Auth Records (AS9031519)

[moderator's note: PII removed] (in reply to end of DATA command)

Problème chez OVH ou Microsoft ?

Merci
YvonneS 0 Reputation points

2026-11-09T00:05:56.2+00:00

I don't understand what SPF, DKIM etc mean. For the past few days, emails sent from my gmail account to other people's hotmail/outlook accounts are not getting through - they are bouncing, with messages I do not understand. Can anyone help me?
Hornblower409 19,070 Reputation points

2026-11-09T00:39:47.3166667+00:00

@Laura said

Emails sent from my OVH address [to] Outlook are being rejected ... Message lacks SPF/DKIM/DMARC Auth Records (AS9031519) ... Problem with OVH or Microsoft?

The problem is with the Microsoft mail servers. There is a workaround that might fix the problem - Add a DMARC record to your OVH mailbox.

[External Non-Microsoft Site] https://docs.ovhcloud.com/en/guides/web-cloud/domains/dns-zone-dmarc
Helen Keegan 25 Reputation points

2026-11-09T00:42:58.2233333+00:00

No the problem is with Microsoft, not the sender. I am NOT asking our customers to adjust their settings, it is clearly a Microsoft issue, stop passing the buck
Hornblower409 19,070 Reputation points

2026-11-09T00:54:22.6066667+00:00

@Helen Keegan said

I am NOT asking our customers to adjust their settings ... it is clearly a Microsoft issue, stop passing the buck

Anyone who has been researching this problem has always, and repeatedly, said "the problem is with the Microsoft mail servers". There has never been any doubt. Asking the senders to modify their mailbox configuration is a workaround.
Helen Keegan 25 Reputation points

2026-11-09T01:00:16.33+00:00

How many customers do you have @Hornblower409 . Because I can assure you, the amount I have, I haven't got the time or patience to do a workaround. The way I see it, the customer can work it out, not me. It's not my email affected, I'm with Gmail, so why the hell would I run around and waste my time fixing issues with their emails, give me a break.
LCS 0 Reputation points

2026-11-09T07:08:23.65+00:00

I agree, this is Microsoft's problem, not the sender's. You can not heap the blame on others- their emails were getting sent fine before with the same settings- so it is obviously a change in Microsoft that caused the issue. You need to fix your system to not block emails sent through a variety of different domains. This needs urgent fixing as all our communication are affected!
Kath Daly 10 Reputation points

2026-11-11T07:35:55.1533333+00:00

Does anyone know whehter microsoft are doing anything to resolve this issue? It is impacting my business and I have no way of knowing whether or when it is resolved.
David R 0 Reputation points

2026-11-11T08:11:11.96+00:00

Hi Kath,

Yes, Microsoft has now confirmed the issue was caused by a faulty update to their spam filtering system. The change has been rolled back and incident EX1545193 was marked as resolved on November 9.

I've updated my original answer with the latest information and a link to Microsoft's official confirmation:

https://learn.microsoft.com/en-us/answers/a/13037462

Unfortunately, previously rejected emails will need to be resent.
Kath Daly 10 Reputation points

2026-11-11T08:44:44.1033333+00:00

Many thanks David. Bw Kath

9 additional answers

Helen Keegan 25 Reputation points

2026-11-08T20:01:51.8633333+00:00

This is clearly a hotmail/outlook/live email issue, NOT our senders. You need to fix on your end not us expecting to send to our customers what they need to do as they have told me they have sent 100's of emails to other domains and none bounce back just those that have outlook, live and hotmail in their email address. Don't be ridiculous trying to put the blame on other domains, it's not their issue. Best thing I can advise people, change to gmail accounts and advise your customers/suppliers of the change
Was this answer helpful?

10+ people found this answer helpful.
Kath Daly 10 Reputation points

2026-11-08T20:11:19.1133333+00:00

Yes agree it’s infuriating to expect us or those mailing us to spend time trying to sort an issue that is clearly not down to us

David R 0 Reputation points

2026-11-08T20:16:12.7233333+00:00

I understand your frustration, and I agree that Microsoft should have communicated such a change beforehand.

But both things can be true. Microsoft may have suddenly tightened its security checks, while some sending domains are missing the authentication records now being required. The fact that emails are delivered successfully to Gmail and other providers doesn't rule this out, since different providers enforce different requirements.

I experienced this exact issue myself. My Microsoft 365 emails to a Live address were rejected with the same error. I checked my domain's public DNS and discovered that the DMARC record was missing, even though Microsoft's message headers reported DMARC as passing.

I added the missing record, resent the same email to the same recipient, and it was delivered successfully.

You don't have to take my word for it. Just pick one of the senders whose emails are bouncing and enter their domain here:

https://lookup.mxtoolbox.com/dmarc.aspx

If the DMARC record is missing, you may have found the reason. Their email administrator can then correct it.

I'm not saying Microsoft has handled this well, or that this explains every case. But it's a simple check that could help get your emails working again without having to switch providers.

Kath Daly 10 Reputation points

2026-11-08T20:18:38.16+00:00

I have had two differebt senders experience this issues and in bith cases somw of their emails to me havw come through and some

have not on the same day - in one case the email was blocked and then 20 mins later they resent and it came through
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
David R 0 Reputation points

2026-11-08T14:45:59.8366667+00:00
UPDATE – November 10, 2026: Official Microsoft confirmation

Microsoft has now confirmed that this was an issue on their side, caused by a faulty update to their spam filtering rules.

Official Microsoft 365 Service Health report:
- Incident: EX1545193
- Status: Service restored
- Affected services: Exchange Online
- Start: November 6, 2026, 7:00 PM (GMT+1)
- Resolved: November 9, 2026, 12:02 PM (GMT+1)
Root cause (Microsoft's own words):

"A recent update to the spam enforcement rules caused email messages to be incorrectly marked and blocked, which led to impact."

Final status – November 10, 2026:

"We've fully rolled back this update and confirmed that mail flow has been restored and impact is resolved."

Microsoft also states that they are reviewing their update procedures and improving their mail detection logic to prevent similar false positives.

What this means for affected users:

The issue was caused by Microsoft's filtering system, not necessarily by incorrectly configured sending domains.

My original workaround of adding a missing DMARC record successfully restored delivery, but Microsoft has now confirmed that the underlying incident was on their side.

Emails previously rejected with an NDR will need to be resent.

Source: Microsoft 365 Admin Center → Health → Service Health → EX1545193 (final incident report, November 10, 2026).

Also, see the November 10 update from Daniel-Vo (Microsoft External Staff), referencing incident EX1545193.

https://learn.microsoft.com/en-us/answers/questions/6063210/spf-validation-error?page=1

Original post – November 8, 2026

The information below documents my original investigation and the workaround that resolved the issue at the time. It is preserved for reference, but the incident has now been resolved by Microsoft.

Possible fix for AS9031519 – simple check for anyone missing emails in Hotmail, Live or Outlook

I've experienced this exact issue and managed to resolve it.

Emails from my Microsoft 365 account to a Outlook/Live address were rejected with:

550 5.7.1 Message lacks SPF/DKIM/DMARC Auth Records (AS9031519)

The interesting part was that Microsoft's own message headers reported SPF, DKIM and DMARC as passing.

However, when I checked the sender domain's public DNS, the DMARC record was actually missing.

After adding v=DMARC1; p=none, I sent another test email to the same recipient, and it was successfully delivered.

You can check this yourself, even if you're just a regular Hotmail, Live or Outlook user. No administrator access or technical knowledge is required.
1. Find the email address of someone whose emails aren't reaching you.
2. Look at the domain after the @ sign. For example, ******@company.com means the domain is company.com.
3. Open https://lookup.mxtoolbox.com/dmarc.aspx
4. Enter the sender's domain and run the check.
5. If it says DMARC Record Not Found, you have identified why their emails are being rejected.
You can also check using Windows PowerShell:

Resolve-DnsName _dmarc.company.com -Type TXT -Server 1.1.1.1

Replace company.com with the sender's domain.

If no DMARC record exists, contact the sender and ask them to have their email provider or IT administrator check the domain's DMARC configuration.

Important: Even if the email headers report dmarc=pass, don't assume a public DMARC record exists. My Microsoft 365 message showed this result despite the record being missing.

This issue has also been investigated by email provider MailRoute, which reports that Microsoft started rejecting some emails from domains without DMARC on November 5, including smaller senders:

https://mailroute.net/blog/outlook-rejecting-email-without-dmarc

MailRoute also reports that the rejection is intermittent. Some emails from the same domain may get through while others bounce, so successful delivery doesn't necessarily mean the domain is correctly configured.

~~Microsoft appears to have introduced stricter authentication checks,~~ although I haven't seen an official announcement confirming the change.

A missing DMARC record is not proof of the cause in every case, but it's a simple and useful first check that anyone can perform.

Hopefully this helps others identify the problem without spending unnecessary time changing settings in their own Outlook accounts.
Was this answer helpful?

4 people found this answer helpful.
Hornblower409 19,070 Reputation points

2026-11-08T15:26:28.1666667+00:00

@David R

Appreciate your contribution. But instead of duplicating your whole answer in each Question you want to apply it to, you might consider using one Answer as the "original" and only including a link to that Answer in all the other post.

e.g. The direct link to your Answer above is https://learn.microsoft.com/en-us/answers/a/13037462

So you could reference this Answer in another post with something like:

See the Answer by "David R Nov 2026" at https://learn.microsoft.com/en-us/answers/a/13037462

Not only does this save a lot of space, in already crowded threads, but if you need to update your Answer you only have to make the changes in one place.

Linda Carter 0 Reputation points

2026-11-09T05:12:05.4733333+00:00

YOU are the best! You have the only fix even when Microsoft can't imagine they are broken! Great job! My email system is now fixed. Thank you
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
AI answer

2026-11-06T06:22:41.4266667+00:00
You cannot add SPF, DKIM, or DMARC records to a personal @outlook.com address; the rejected sender or its email provider must authenticate the domain from which the incoming message was sent.

The server name in the NDR—namprd04.prod.outlook.com—is the Microsoft server that rejected the incoming message. It does not mean your @outlook.com address lacks records.

What to do

Send the complete NDR to the person whose message bounced.

Ask them to forward it to their email administrator or provider with this request:

Outlook.com rejected this message with 550 5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records. Please check the authentication results for the sending domain and configure SPF, DKIM signing, and DMARC alignment.

Their administrator should verify:

The sending server is authorized by the domain’s SPF record.

The message has a valid DKIM signature.

A valid DMARC record is published.

SPF or DKIM aligns with the domain shown in the visible From address.

Microsoft documents that authentication failures can cause messages to be rejected, and that correcting the sender’s DNS or sending-server configuration is normally the sender’s responsibility.^1^

If the sender delivers at least 5,000 messages per day to Microsoft consumer mailboxes from the same From domain, Microsoft’s high-volume-sender requirements apply: SPF and DKIM must both pass, a DMARC record must exist, and DMARC validation must pass through aligned SPF or DKIM.[^2^](https://support.microsoft.com/outlook/fix-ndr-error-550-5-7-515-in-outlook-com#why-did-i-get-this-bounce-message "Fix NDR error "550 5.7.515" in Outlook.com | Microsoft Support") The NDR you received does not establish whether that sender meets this threshold, so their administrator must check.

Determine the scope

Ask two or three people using different email providers to send a short test message:

Only one domain fails: its administrator/provider needs to fix that domain’s authentication.

Several unrelated domains fail: retain each complete NDR, including timestamp, SMTP code, rejecting server, and authentication results.

Properly authenticated senders also fail: escalate to Outlook.com support because this may require Microsoft to inspect the rejection rather than a mailbox setting change.

Adding someone to Safe senders is unlikely to correct this particular rejection because the message is refused during the SMTP transaction, before it reaches your mailbox.

Escalate when necessary

In Outlook.com:

Select Help from the top menu.

Enter the complete error text.

If self-help does not resolve it, scroll to Still need help?

Select Yes and provide the redacted NDRs from multiple senders.

That is Microsoft’s documented support route for users who can sign in.^3^

Do not publish or change DNS records for outlook.com; Microsoft owns that domain, and personal Outlook.com users cannot administer its DNS.

References

Security Operations guide for email authentication in Microsoft 365

Fix NDR error "550 5.7.515" in Outlook.com | Microsoft Support

How to get support for Outlook.com | Microsoft Support
AI-generated content may be incorrect. Read our transparency notes for more information.
Was this answer helpful?

2 people found this answer helpful.
Hornblower409 19,070 Reputation points

2026-11-07T08:40:11.0833333+00:00

@Rodney Graham said

Now people sending me emails are getting messages about my email address being blocked due to lack of SPF/DKIM/DMARC records on my @outlook.com account.

There have been multiple reports on this issue. It could be a Microsoft service issue or a change in Outlook.com authentication enforcement.

See the Answer by "Hornblower409 Nov 2026"
at https://learn.microsoft.com/en-us/answers/a/13036152
in https://learn.microsoft.com/en-us/answers/questions/6063210/

Also has instructions on how to Submit a Problem Report if mail is being rejected when sent to your Outlook.com or Hotmail.com mailbox mailbox.
Was this answer helpful?

1 person found this answer helpful.
Alon Krongold 5 Reputation points

2026-11-08T10:00:54.6866667+00:00

Dear Microsoft Support,

I have been experiencing serious problems receiving legitimate business emails at my personal Hotmail account since approximately November 4–6, 2026.

I can send emails normally, but incoming emails from certain senders, including companies in different countries and with different email domains, are being rejected.

The senders receive the following error:

550 5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records (AS9031519).

My account is over 10 years old, and this issue is significantly affecting my international business operations.

I have found reports from other Hotmail and Outlook users experiencing exactly the same error since November 5–6, 2026.

I would like Microsoft to investigate whether this is related to a recent change or problem in Outlook.com’s inbound email authentication system.

Please escalate this issue to the Outlook.com mail protection/deliverability team.

I would appreciate an explanation and a solution as soon as possible.

Thank you.

Hornblower409 19,070 Reputation points

2026-11-08T12:22:04.9166667+00:00

@Alon Krongold said

I would like Microsoft to investigate ... escalate this issue to the Outlook.com mail ... team ,,,

This is a user-to-user forum. If you want to contact Microsoft Support, you have to initiate the contact using one of the standard channels:

MS 365 - Qualified Subscriber Support
https://www.microsoft.com/en-us/microsoft-365/support

All others
https://support.microsoft.com/home/contact

an explanation and a solution as soon as possible

There have been multiple reports on this issue. It could be a Microsoft service issue, a change in Outlook.com authentication enforcement, or both.

See the Answer by "Hornblower409 Nov 2026"
at https://learn.microsoft.com/en-us/answers/a/13036152
in https://learn.microsoft.com/en-us/answers/questions/6063210/

Also see that Answer for instructions on how to Submit a Problem Report if mail is being rejected when sent to your Outlook.com or Hotmail.com mailbox mailbox.

The current best workaround is for your senders to add at least a minimal DMARC record (e.g. v=DMARC1; p=none; ) to their DNS Records.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Incoming emails being blocked due to lack of SPF/DKIM/DMARC records on my @outlook.com account

9 additional answers

UPDATE – November 10, 2026: Official Microsoft confirmation

What to do

Determine the scope

Escalate when necessary

Your answer