www.it-connect.fr
Microsoft Bug Caused Outlook and Hotmail Rejections Over Missing DMARC
Between November 6 and 9, 2026, some emails sent to Outlook.com, Hotmail, and Live addresses were rejected, especially when the sender’s mail domain did not have a DMARC record. This led many to believe Microsoft had changed its policy. In reality, it was a bug, now fixed. Here’s what we know.
Since November 5, many of you have reported problems sending emails to recipients with a Microsoft address: "550 5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records (AS9031519)". It turns out this issue affected mail domains without a DMARC record, even with a low email volume. In short: no DMARC = email rejected.
Since May 2025, Microsoft has required domains sending more than 5,000 emails per day to its consumer mailboxes to have SPF and DKIM, and to publish a DMARC record. I had published an article about this: Microsoft va durcir les règles d'envoi d'e-mails vers Outlook dès le 5 mai 2025. In response to these email delivery issues, many concluded that this requirement now applied to everyone.... That is not the case.
Microsoft acknowledges a bug on its side
Microsoft eventually stated that this behavior was accidental. It was logged as an incident under ID EX1545193 in the Microsoft 365 admin center service health dashboard. Titled "Some users may be intermittently unable to send email messages to Outlook.com, Hotmail.com, or Live.com email addresses", it confirms that some users were intermittently unable to send emails to those addresses.
The Redmond company also provided more details about the cause of this issue: "A recent update to anti-spam rules caused certain emails to be incorrectly flagged and blocked," Microsoft said. The American giant rolled back this update... Still, the incident had an impact from November 6 at 7:00 PM to November 9 at 12:02 PM (Paris time).
Microsoft’s message does not mention DMARC. So there is no new requirement: the May 2025 rule still applies only to large senders.
What you should do now
Mail flow has been restored, but your rejected emails will remain rejected. Here’s what you can do:
- Resend the rejected emails: a 550 error is a permanent rejection, so the sending server will not retry delivery. Messages refused between November 6 and 9 will never be delivered unless you resend them.
- Monitor for ongoing rejections: if AS9031519 still appears on messages sent after November 9 at noon, analyze them with message trace and open a support request (this applies if you use Microsoft 365 as the sender).
- Do not rely on code 5.7.23: with Microsoft 365, Exchange Online returned these rejections with error 550 5.7.23, which refers to an SPF policy violation. Many admins reflexively checked their SPF record... which was correct. The real cause was in the rest of the message.
In any case, this incident is a reminder: configure DMARC on your mail domain if you have not done so already (it provides extra protection against spoofing). If your domain does not have one, take the opportunity to publish a minimal p=none record, with a rua address to receive aggregated reports.
nslookup -type=TXT _dmarc.votredomaine.fr
_dmarc.votredomaine.fr TXT "v=DMARC1; p=none; rua=mailto:dmarc@votredomaine.fr"To go further, my tutorial SPF, DKIM et DMARC pour les débutants explains the role of each record, and this guide details la configuration de DKIM et DMARC pour les e-mails envoyés depuis Office 365.
Were you affected by these rejections, and did this episode push you to publish a DMARC record?
