Microsoft’s email security filters are blocking legitimate business emails, causing issues for some users. The problem started on November 5 and is ongoing, with some emails to Outlook, Hotmail, Live, and MSN being rejected if they don’t have a domain-based message authentication, reporting, and conformance (DMARC) record.
Frank Dickson of Dickson Research noted that the issue may indicate both a policy change and a bug. He pointed out that requiring DMARC for all senders makes email safer, but doing so without notice and with an error message that points to the wrong problem creates problems.
Email Security Issues
DMARC is meant to protect against spoofing, phishing, and business email compromise. Microsoft had a rule in place since May 2025 requiring DMARC for domains sending more than 5,000 messages a day to consumer mailboxes. However, as of November 5, emails from small senders are being bounced due to lack of DMARC, Sender Policy Framework (SPF), or DomainKeys Identified Mail (DKIM).
Senders are receiving Non-Delivery Reports (NDRs) citing 550 5.7.1 or 550 5.7.23 errors, but the issue is inconsistent, with some messages getting through while others are rejected. Users have reported error messages on Microsoft’s community forum, including one that said the message couldn’t be delivered because Hotmail couldn’t confirm it was sent from a trusted location.
A Microsoft external staff moderator called the issue a “service degradation” that is currently under active investigation. Email security company MailRoute noted that enterprises can determine if their domain is impacted by using a command to check for a DMARC record.
DMARC and Email Authentication
DMARC relies on two foundational email authentication tools: SPF and DKIM. SPF verifies whether the sending server’s IP address is allowed to send email on behalf of a domain, while DKIM adds a cryptographic signature to the message to prove it wasn’t altered and actually belongs to the domain it says it is coming from.
DMARC checks the two and identifies whether the domain listed on the “from” address aligns with the validated domains. It tells receivers what to do with forgeries, Dickson explained.
Because Microsoft, at least to this point, has only required DMARC for larger senders, it is not standard across the board. Many small senders reasonably concluded it did not apply to them. This includes small and medium-sized businesses, nonprofits, schools, and professional practices that may not have updated their domain settings in years.
Dickson advised that enterprises should search mail logs, email platforms’ bounce reports, and help desk tickets for entries citing “Message lacks SPF/DKIM/DMARC” since November 5 and resend time-sensitive transactional mail first. Then, they should fix the cause by confirming every domain sending mail publishes a DMARC record.
Microsoft 365 customers who never turned on DKIM for their own domains should do it now, he advised. However, a basic monitoring record (p=none) stops bounces without changing how others treat mail, as long as SPF or DKIM lines up with the From domain. The goal is to have a p=reject record, which tells receivers to refuse anyone forging the domain name.
Inventorying every service that sends email as the organization is also key, Dickson noted. This includes the CRM, billing system, HR platform, and marketing tools. Most organizations cannot produce this list, which makes it difficult to protect the domain.
Customers, patients, job applicants, and others use Hotmail, Outlook, Live, and MSN. When invoices, password resets, appointment confirmations, and offer letters go missing, the customer may think they’re being ignored, not that the message is not getting through.
Google and Yahoo began requiring DMARC for bulk senders in February 2024, and Microsoft followed in May 2025. Dickson noted that requirements start with big senders and then become the floor for everyone. The rollout may have been botched, but the destination is not in doubt.
The command to check for a DMARC record, as suggested by MailRoute, is dig +short TXT _dmarc.example.com, replacing example.com with the domain name. A response starting with v=DMARC1 means there is a DMARC record, while no reply means there isn’t.
