If your website or business sends email from its own domain, some of it may be bouncing at Microsoft's consumer mailboxes. Email security firm MailRoute says it first saw the rejections in its own outbound logs on 5 November 2026, and other administrators reported them the same day. Al Iverson of Spam Resource says reports on the Mailop list began on the night of 6 November (US time).
Which inboxes: outlook.com, hotmail.com, live.com and msn.com, Microsoft's consumer domains. Mail to Microsoft 365 business domains was accepted in Iverson's tests. The bounce reads 550 5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records. Since the first day, MailRoute has seen (AS9031519) added at the end.
Who is affected: domains that publish no DMARC record. That includes small, low-volume senders, not only the bulk senders covered by Microsoft's May 2025 rule, which applies to domains sending more than 5,000 messages a day. Both sources say SPF and DKIM passing is not enough. Iverson removed DMARC from his own small test domains and saw them rejected. The rejections are sporadic, so one delivered message doesn't mean your domain is safe.
Not confirmed: MailRoute says that, as of 6 November, Microsoft had published no postmaster notice, blog post or service-health entry. Iverson says he isn't sure the change is intended. The fix below comes from what these email services saw in their logs, not from Microsoft.
