A domain that sends a handful of emails a day, with SPF and DKIM in place but no DMARC record, may now see Outlook.com bounce some of its messages with a 550 error. According to MailRoute's logs, the bounces started on November 5, 2026, and Microsoft has not announced them. The fix is one DNS record, as long as your SPF or DKIM already aligns with the From domain.
What changed
Since May 5, 2025, Microsoft has required domains that send more than 5,000 messages a day to Outlook.com, Hotmail, Live and MSN to pass SPF and DKIM and to publish DMARC (at least p=none) aligned with one of them. Non-compliant senders get 550 5.7.515 Access denied. It was a bulk-sender rule, and plenty of teams with modest transactional mail assumed it didn't apply to them.
On November 6, 2026, email provider MailRoute reported that since the previous day Outlook.com has also been rejecting mail from small senders whose domain has no DMARC record. The bounce it quotes is not the 2025 one:
550 5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records (AS9031519)On the first day it arrived without the AS9031519 code. On November 8 the post reached the Hacker News front page with more than 270 points, and the thread adds more cases: domains with SPF and DKIM but no DMARC failing only towards Outlook while Gmail delivered fine, and admins whose bounces stopped once they published the record. According to MailRoute, as of November 6 Microsoft had posted nothing on its postmaster site, its blog or its service health page.
My read is that Microsoft is now applying, at any volume, the most basic part of what it asked of bulk senders in 2025: the domain must publish a DMARC policy.
Why it's hard to spot
The rejection is partial. MailRoute sees only some messages from an affected domain bounce, so the symptom is intermittent: one Hotmail user gets the password-reset email and the next one doesn't. The error text also doesn't say which check failed, unlike 5.7.515, so it is easy to mistake for an SPF problem. More than one person in the Hacker News thread found out from a customer complaint.
If your application sends alerts, invoices or sign-in codes from your own domain through a third-party provider, this is the classic case: SPF and DKIM were set up when the service was onboarded, and nobody bothered with DMARC because volume never got near 5,000.
Outlook.com vs Gmail
| Requirement | Gmail | Outlook.com (since May 2025) | Outlook.com (observed since Nov 5, 2026) |
|---|---|---|---|
| Any sender | SPF or DKIM | — | DMARC record published |
| More than 5,000 messages a day | SPF, DKIM and DMARC (p=none is fine) | SPF, DKIM and aligned DMARC (p=none is fine) | Same |
| Error when non-compliant | — | 550 5.7.515 | 550 5.7.1 … Auth Records |
Gmail still recommends DMARC for everyone but only requires it for bulk senders. Outlook.com is now the stricter of the two for small senders.
How to publish DMARC without breaking anything
Check whether you have a record. No output means there isn't one:
dig +short TXT _dmarc.yourdomain.comPublish a TXT record at
_dmarc.yourdomain.comwith the valuev=DMARC1; p=none. Withp=noneyou don't ask any receiver to reject or junk failing mail, so it doesn't change how Gmail or anyone else treats you.Check alignment. Open the headers of a message received at Outlook.com and look at the SPF, DKIM and DMARC results. For DMARC to pass, the DKIM signing domain or the envelope sender domain (Return-Path, 5321.MailFrom) must match the From domain.
Go through every service that sends on your behalf (CRM, billing, transactional email platform): it must sign with DKIM for your domain, or use your domain in the MailFrom and be included in your SPF. On Microsoft 365, enable DKIM for your custom domain.
Once everything passes consistently, tighten the policy step by step from
nonetoquarantineand thenreject, as Microsoft itself recommends.
Gotchas
p=nonewithout alignment isn't enough. Publishing the record removes the reason for this bounce, but if neither SPF nor DKIM aligns with the From, DMARC still fails and you are exposed to Microsoft's filtering.- Forwarding and mailing lists. Forwarding breaks SPF, and a list that rewrites the message can break DKIM. Microsoft recommends ARC for forwarders; on your side, make sure you sign with DKIM, which survives forwarding better than SPF.
- The rule isn't documented. Everything known about the 5.7.1 bounce comes from provider and admin logs, not from Microsoft. If the threshold or the error text changes, your bounces will show it first, so this is a good time to alert on 5xx responses from Microsoft domains.
Sources
- Outlook.com Is Quietly Rejecting Email from Domains Without DMARC · MailRoute, 2026-11-06
- Outlook.com Is Quietly Rejecting Email from Domains Without DMARC (discussion) · Hacker News, 2026-11-08
- Strengthening Email Ecosystem: Outlook's New Requirements for High-Volume Senders · Microsoft Tech Community, 2025-04-02
- Fix NDR error "550 5.7.515" in Outlook.com · Microsoft Support
- Email sender guidelines · Google Workspace Admin Help