Outlook.com Is Bouncing Mail Without DMARC: SPF and DKIM Alignment, and Why to Move to p=quarantine

Introduction

Since November 5, 2026, Outlook.com, Hotmail, Live and MSN mailboxes have been bouncing some mail from domains that don’t publish a DMARC record, and it’s hitting small, low-volume senders, not just the bulk senders Microsoft’s published rules cover. On November 9 Microsoft acknowledged it as a service degradation it’s investigating. If your clients’ WordPress sites send contact form notifications, WooCommerce receipts or password resets to Microsoft consumer addresses, some of that mail may already be failing.

This sits on top of the rule Microsoft has enforced since May 2025 for high-volume senders. Publishing a DMARC record is the quick fix, but a record alone doesn’t make DMARC pass: SPF or DKIM has to pass and align with the From domain. This post covers what changed, how alignment actually works, how to fix it in Cloudflare DNS, Google Workspace and Microsoft 365, and why you should plan to move from p=none to p=quarantine.

TL;DR

• What: Since November 5, 2026, Outlook.com has been rejecting some mail from domains with no _dmarc record with 550 5.7.1 ... Message lacks SPF/DKIM/DMARC Auth Records (AS9031519). On November 9 Microsoft called it a service degradation under investigation, so it may be a bug rather than a new rule.
• Already in force: since May 2025, domains sending 5,000+ messages a day to Outlook.com must pass SPF and DKIM and publish DMARC (at least p=none), or get 550 5.7.515.
• Fix: publish one DMARC record per sending domain, and make sure SPF or DKIM passes for the same domain as the visible From address (alignment).
• Policy: p=none is Microsoft’s minimum. p=quarantine isn’t required, but it’s where you should be heading once reports show every legitimate sender aligned.
• Check: dig +short TXT _dmarc.example.com for every domain your sites send from, then read the Authentication-Results header on a test message.

How It Works: SPF, DKIM, DMARC and Alignment

Every message has two “from” identities. The envelope sender (MAIL FROM, Return-Path) is what SPF checks. The header From is what the recipient sees in their mail client. DKIM signs the message with a domain of its own, shown as d= in the signature.

SPF and DKIM on their own only prove that some domain vouched for the message. DMARC ties them back to the header From: it passes only when SPF passes for a domain matching the From domain, or DKIM passes with a d= domain matching the From domain. That match is alignment. You need one aligned pass, not both.

Alignment comes in two modes. Relaxed (the default) accepts the same organizational domain, so mail.example.com aligns with example.com. Strict (aspf=s, adkim=s) needs an exact match. Microsoft doesn’t require strict alignment, and on a fleet where third-party services send from subdomains, strict mode mostly creates failures. Leave it relaxed unless you have a specific reason.

The classic WordPress failure looks like this: the site sends as wordpress@example.com through the server’s local MTA, the envelope sender is something like user@server-hostname, SPF passes for the hostname (not example.com), and nothing signs with DKIM for example.com. Every individual check “passes”, yet DMARC fails because nothing aligns.

What We Know So Far

The May 2025 high-volume sender rule

Microsoft announced in April 2025 that domains sending more than 5,000 messages a day to its consumer service (outlook.com, hotmail.com, live.com) must pass SPF, pass DKIM, and publish DMARC with at least p=none, aligned with SPF or DKIM. The plan initially said non-compliant mail would go to Junk; Microsoft revised that and started rejecting it from May 5, 2025 with:

550; 5.7.515 Access denied, sending domain [SendingDomain] does not meet the required authentication level.

Strengthening Email Ecosystem: Outlook’s New Requirements for High-Volume Senders

Microsoft’s announcement of SPF, DKIM and DMARC requirements for domains sending over 5,000 messages a day to Outlook.com.

techcommunity.microsoft.com

The November 5, 2026 bounces

Starting November 5, 2026, several senders have reported Outlook.com rejecting some mail from domains with no DMARC record, including low-volume senders. toSend (the sending platform from WPManageNinja, the team behind FluentSMTP and FluentCRM) says a few hundred of its customers’ messages bounced on the first day, almost all from domains without DMARC. MailRoute and its sister company mxio report the same from their logs. The reported bounce:

550 5.7.1 Message rejected: "Message lacks SPF/DKIM/DMARC Auth Records (AS9031519)"

Three senders tell the same story, written up separately. mxio adds a reference code on messages from November 6 onward (shown above), and toSend’s version of the bounce doesn’t include it. What they agree on:

• There was no announcement: no postmaster notice, blog post or service-health entry. toSend points to a Microsoft Q&A thread where other senders report the same bounce. (Microsoft’s November 9 response is covered below.)
• The affected domains weren’t bulk senders, and in the cases traced they already had SPF and DKIM set up correctly. The missing piece was the _dmarc record.
• It’s intermittent. Some messages from an affected domain get through, so one delivered test doesn’t prove a domain is fine.
• The fix all three recommend is a plain v=DMARC1; p=none; record. toSend explicitly warns against jumping straight to p=reject.
• Treat bounced messages as lost. mxio says Outlook.com doesn’t retry 5xx rejections, so they need resending. toSend’s platform treats the bounce as soft and pauses the recipient briefly rather than suppressing it, but that’s toSend’s handling, not Microsoft’s. Check how your SMTP provider handles it, so Outlook.com recipients don’t get suppressed for good.

Several people have since reproduced it. Deliverability testers including EasyDMARC, Spam Resource and DmarcKoff deleted or skipped the DMARC record on test domains and got the same 550 5.7.1 from Outlook.com on November 7 and 8, and EasyDMARC’s test domain had aligned SPF and DKIM. A Microsoft 365 business mailbox accepted the same mail. The rejections come only from Microsoft’s consumer servers (*.olc.protection.outlook.com), not from Exchange Online business tenants (*.mail.protection.outlook.com).

November 9: Microsoft calls it a service degradation

On November 9, a Microsoft moderator on the Microsoft Q&A thread “SPF validation error” said there’s an ongoing Exchange service issue affecting mail to Outlook.com, Hotmail and Live addresses. The moderator said it’s classified as a service degradation and that engineers are investigating the cause, as reported by The Register and LazyAdmin. Microsoft hasn’t given a fix date, posted a postmaster notice or documented the AS9031519 code. A Reddit user cited incident ID EX1540236, but LazyAdmin couldn’t find it in the Service Health of any tenant they manage, so treat that ID as unconfirmed.

That changes the picture. This may be a bug in Microsoft’s rollout rather than a deliberate new rule, and LazyAdmin collected Q&A reports from domains with SPF, DKIM and DMARC all passing in the headers that still get rejected now and then. A DMARC record has fixed it for many senders, but it isn’t a guaranteed fix. Publish the record anyway. It’s what Outlook.com’s bulk rule and Gmail already expect, and it’s the only lever you control.

Is p=quarantine required?

No. Neither Microsoft’s published rule nor the November reports require an enforcing policy; p=none satisfies both. We still recommend getting to p=quarantine, for reasons covered below. Just don’t let anyone tell a client their mail is bouncing because they’re on p=none.

WordPress Sites and Hosting Panels

This isn’t a server vulnerability, so GridPane, RunCloud, cPanel and the rest aren’t “affected” in the usual sense. What matters is how each site sends mail and what the domain’s DNS says.

Sites sending through PHP mail() and a local MTA are the most likely to fail alignment, because the server rarely signs with the site’s domain. Sites using an SMTP plugin with a transactional provider are usually fine for DKIM, provided the provider’s DKIM records were actually added for the domain and the plugin sends from that domain. For the background on server-side sending, see Sending Email from your Server using an MTA or Null Mailer.

The domains that get missed are the ones nobody thinks of as “email domains”: brochure sites whose only mail is a contact form, staging domains, and old client domains that still send WooCommerce receipts. If a domain appears in a From header, it needs a DMARC record.

Fixing It

1. Inventory what sends as the domain

List every service that sends with the domain in the From address: the mailbox provider (Google Workspace or Microsoft 365), the WordPress site, the newsletter tool, the CRM, the helpdesk, invoicing. Each one needs either an aligned DKIM signature or an aligned SPF pass. DKIM is the better target, because SPF breaks on forwarding and many providers use their own envelope domain.

2. Publish a DMARC record in Cloudflare DNS

In the Cloudflare dashboard, add a TXT record named _dmarc on the zone. Start in monitoring mode with reporting turned on:

Type: TXT
Name: _dmarc
Content: v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com

Publish exactly one _dmarc record per domain; two records make the result undefined and receivers may ignore both. Subdomains without their own record inherit the parent’s policy, so you only need extra records where a subdomain should behave differently (use sp= on the parent to set a separate subdomain policy).

If the zone is on Cloudflare, its DMARC Management feature (under Email Security in the zone) is free for Cloudflare customers and will add a Cloudflare reporting address to your rua and turn the aggregate XML into a list of sending sources with pass/fail. That list is what you need before tightening the policy.

While you’re in the zone, check SPF: one v=spf1 record only, and no more than 10 DNS lookups. An SPF record over the limit returns PermError, which DMARC treats as a fail. Cloudflare’s DMARC Management includes an SPF audit that flags this.

3. Google Workspace: turn on custom-domain DKIM

Workspace doesn’t sign with your domain until you set it up. In the Admin console go to Apps → Google Workspace → Gmail → Authenticate email, select the domain, generate a 2048-bit key, and add the TXT record it gives you (by default named google._domainkey) in Cloudflare. Once it resolves, come back and click Start authentication. Google says it can take up to 48 hours to start working. SPF for Workspace is include:_spf.google.com.

4. Microsoft 365: don’t rely on onmicrosoft.com signing

This is the trap that catches a lot of tenants. Microsoft 365 signs outbound mail with your *.onmicrosoft.com domain by default, so DKIM shows as pass, but it doesn’t align with your custom domain in the From address. Microsoft’s own docs say a message needs to be DKIM-signed by the domain in the From address.

In the Defender portal (Email & collaboration → Policies & rules → Threat policies → Email authentication settings → DKIM), select the custom domain, create the two CNAME records it shows in Cloudflare, and enable signing. The records follow this pattern:

selector1._domainkey  CNAME  selector1-example-com._domainkey.TENANT.onmicrosoft.com
selector2._domainkey  CNAME  selector2-example-com._domainkey.TENANT.onmicrosoft.com

Newer tenants may be shown a target under dkim.mail.microsoft instead; copy whatever the portal gives you rather than typing the pattern by hand. In Cloudflare, leave these CNAMEs as DNS only (grey cloud). Each subdomain you send from needs its own DKIM setup. SPF for Microsoft 365 is include:spf.protection.outlook.com.

5. Move to p=quarantine

p=none keeps you compliant but does nothing to stop someone spoofing the domain. Once a few weeks of aggregate reports show every legitimate source passing with alignment, step up:

v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc-reports@example.com

Raise pct to 100 as the reports stay clean, then consider p=reject. Microsoft’s docs still use pct for this staging; the updated DMARC standard (RFC 9989) replaces it with a t=y test flag, so check what your report tool expects. The order matters: quarantine on a domain whose WordPress site sends unaligned mail sends its contact forms and receipts to Junk at every receiver that honours the policy, so fix alignment first.

Two more reasons to get there. Microsoft 365 tenants sending from a domain at p=quarantine or p=reject have failing outbound mail routed through Microsoft’s high-risk delivery pool, which protects the main pool’s reputation. And BIMI, if a client wants their logo in the inbox, requires an enforcing policy. We’ll cover that in Setting up BIMI for a WordPress site.

Checking Your Domains

1. Check the records

dig +short TXT _dmarc.example.com
dig +short TXT example.com | grep spf1
dig +short TXT google._domainkey.example.com
dig +short CNAME selector1._domainkey.example.com

2. Sweep the fleet for missing DMARC

Put every client domain in a file, one per line, and look for the gaps:

while read -r d; do
  printf '%s: ' "$d"
  dig +short TXT "_dmarc.$d" | grep -q 'v=DMARC1' && echo ok || echo MISSING
done < domains.txt

3. Read the Authentication-Results header

Trigger a real message from each source (a password reset, a form submission, a test order) to an Outlook.com or Gmail address and view the original. You want dmarc=pass, plus either spf=pass with smtp.mailfrom on your domain or dkim=pass with header.d on your domain. A dkim=pass header.d=TENANT.onmicrosoft.com or header.d=sendgrid.net is a pass that doesn’t align.

4. Watch for the bounce codes

Search your SMTP plugin logs, transactional provider logs and MTA logs for 5.7.515, 5.7.509 (DMARC fail against a reject policy) and Auth Records. If a domain has a passing, aligned DMARC result and still bounces, mxio suggests opening a case at olcsupport.office.com with the full bounce.

Online Tools

If you’d rather not run dig, or you need something to show a client, these free tools cover the same checks.

Check a domain’s records

• MXToolbox: DMARC, SPF and DKIM lookups, plus SPF lookup counts. The one most clients have already heard of.
• Microsoft Remote Connectivity Analyzer: Microsoft’s own tester, which can check a domain’s SPF, DKIM and DMARC.
• OpenSiteTools: our open-source, self-hostable set of website and domain diagnostic tools, including DNS and email checks. Run it on your own infrastructure if you’d rather not paste client domains into third-party sites.

Send a test email

• LearnDMARC: send a message to the address it gives you and watch the SPF, DKIM and DMARC checks run step by step. The best way to explain alignment to a client.
• aboutmy.email: from Steve Atkins of Word to the Wise. It reads the headers of the message you actually sent, not just DNS, so it catches a DKIM signature that passes but doesn’t align.
• mail-tester.com: a quick authentication and spam score that’s easy for clients to read.

Read a bounce or message header

• Google Admin Toolbox Messageheader: paste the full headers to see the SPF, DKIM and DMARC results and the delivery path.
• Microsoft Message Header Analyzer: Microsoft’s equivalent, better at Exchange Online and Outlook.com headers.

Monitor DMARC reports

• Cloudflare DMARC Management: free for zones on Cloudflare, covered in Fixing It above.
• DMARC Report: a hosted DMARC monitoring service with a free tier. We use it for our own client domains.
• Postmark DMARC Digests: free weekly summaries of your aggregate reports by email, with no dashboard to log in to.

FAQ

Do I need strict alignment for Outlook?

No. Relaxed alignment (the default) meets Microsoft’s requirement. Strict alignment is an extra restriction you opt into, and it often breaks services sending from subdomains.

Does this affect Microsoft 365 business mailboxes?

The May 2025 rule and the November bounces are about Microsoft’s consumer service (outlook.com, hotmail.com, live.com, msn.com). Exchange Online has its own inbound handling, and it already honours senders’ quarantine and reject policies.

My client only sends a few emails a day. Do they still need this?

Yes. The November reports are specifically about low-volume senders being rejected for having no DMARC record. A one-line p=none record is cheap insurance.

Is this a new Microsoft policy or a bug?

Nobody outside Microsoft knows yet. The bounces look like a policy aimed at domains without DMARC, but Microsoft is treating them as a service degradation under investigation, and some domains with DMARC in place are bouncing too. Publish the record either way. It costs nothing, and it’s where the Gmail, Yahoo and Outlook rules are all heading.

Updates

• November 10, 2026: Added an Online Tools section with free record checkers, test-email tools, header analyzers and DMARC report services. Microsoft still hasn’t announced a fix for the AS9031519 bounces.
• November 9, 2026: Initial post.

Sources

• Microsoft: Strengthening Email Ecosystem: Outlook’s New Requirements for High-Volume Senders
• Microsoft Support: Fix NDR error 550 5.7.515 in Outlook.com
• Microsoft Q&A: SPF validation error (thread with the moderator’s service degradation update)
• The Register: Outlook.com bounces legit emails as Microsoft’s authentication crackdown goes sideways
• LazyAdmin: Fix Message lacks SPF/DKIM/DMARC Auth Records (AS9031519)
• Engagor: Microsoft AS9031519: Outlook Rejects Mail Without DMARC
• DMARCDKIM: Outlook: Message lacks SPF/DKIM/DMARC Auth Records
• toSend: Outlook 550 5.7.1 “Message lacks SPF/DKIM/DMARC Auth Records”: the fix
• MailRoute: Outlook.com Is Quietly Rejecting Email From Domains Without DMARC
• mxio: Fix Outlook.com Error 550 5.7.1: Message Lacks SPF/DKIM/DMARC Auth Records
• Microsoft Learn: Set up DMARC to validate email in Microsoft 365
• Microsoft Learn: Set up DKIM to sign mail from your Microsoft 365 domain
• Google Workspace: Set up DKIM
• Cloudflare: DMARC Management is now generally available
• DMARCguard: Microsoft DMARC Enforcement