For several days this month, many businesses found that emails to their customers were bouncing back. The emails had not gone to spam. Microsoft had refused them.
The emails were going to Hotmail, Outlook.com, Live and MSN addresses, Microsoft’s free personal email services. Microsoft’s servers sent them back with this message:
550 5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records
What happened
The first bounces were reported on 5 November 2026. They mostly hit businesses whose email domain had no DMARC record. DMARC is a short entry in your domain settings that tells other mail servers what to do with emails that pretend to come from you.
Many of the affected businesses had done nearly everything right. Their other two email security records (SPF and DKIM) were set up and working. Their emails still bounced. Some businesses with all three records in place reported bounces too.
Microsoft did not warn anyone. For days, business owners and IT providers were left to work out for themselves why invoices, quotes and replies were not arriving.
Microsoft later admitted the problem in a notice to its business customers. It said that an update to its spam rules had wrongly blocked emails, and that the update had been rolled back. Microsoft’s notice gave the problem as running from 6 November to 9 November. Bounces had been reported a day before that.
Why it matters
There is an irony here. For years, Hotmail and other free email accounts have been a favourite tool of scammers, because anyone can open one in minutes. Yet in this case it was business owners who found their email turned away, and who were left to change their own domain settings to get it through.
Microsoft has had a rule since May 2025 that large senders, those sending more than 5,000 emails a day to its personal email services, must have SPF, DKIM and DMARC in place. It has not announced that rule for small businesses. For a few days, it was in effect applied to them without notice.
Microsoft calls it a mistake. But Google, Yahoo and Microsoft have all been tightening their rules on email security over the past two years. Most email specialists expect DMARC to become a requirement for everyone sooner or later. This time the bounces stopped after a few days. Next time they might not.
What you should do now
- Check you have a DMARC record. If your domain has no DMARC record, add one. It is a single entry in your domain’s DNS settings.
- Check your SPF and DKIM records. Every service that sends email as your business needs to be included, such as your accounting software, your website forms and your newsletter tool. Microsoft 365 customers in particular should check that DKIM signing is switched on for their own domain, not just the default Microsoft one.
- Resend anything that bounced. Microsoft does not retry rejected messages. If a customer did not get your invoice or quote between 5 and 9 November, they still have not got it.
How QLine IT can help
If you are not sure whether your business email is set up properly, we can check your SPF, DKIM and DMARC records and fix anything missing. Contact us or call 0330 520 4884.
Read more about the main types of email attacks that these records help to stop.
