Since 5 November 2026, Microsoft has been rejecting some email sent to Outlook.com, Hotmail, Live, and MSN addresses when the sender’s domain is missing a setting called a DMARC record. Every active domain on our DNS that’s set up for email now has that record. If your domain’s DNS is with us, you don’t need to add it.

The bounce message

An email to an Outlook.com or Hotmail address comes back with a message like this:

550 5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records (AS9031519)

If your email is with Microsoft 365, the same rejection arrives under a heading that mentions error 5.7.23 and a “Sender Policy Framework violation”. That heading points you to your SPF record, the list of services allowed to send your email, even when that record is correct. The line to look for is the one about Auth Records, further down.

It doesn’t seem to happen to every email. One can get through and the next bounce, so it’s easy to miss. It also reaches businesses that send very little email: the customers who wrote to us about it are small businesses. Email to a business that uses Microsoft 365 with its own domain doesn’t seem to be affected.

As of 10 November, Microsoft hasn’t announced the change or said why it’s happening.

What a DMARC record is

Your domain’s DNS is its public list of settings: where your website lives, where your email is delivered, and which services may send email in your name. A DMARC record is one line in that list. It tells other mail servers what to do with email that claims to come from your domain but doesn’t pass their checks.

The record we added is the mildest kind:

v=DMARC1; p=none

It doesn’t ask mail servers to block or hold back anything. The bounce message is about missing records, so we added the mildest one.

What we did on 9 November

We went through every domain whose DNS we host, and added the record above wherever a domain was set up for email and didn’t have one.

We also added an SPF record to domains that use Google Workspace or Microsoft 365 and didn’t have one, because DMARC relies on it.

We didn’t change any DMARC record that was already working. If you or your IT provider set yours up, it’s as you left it.

If an email bounced

If an email to an Outlook.com or Hotmail address bounced, send it again. A bounced email isn’t retried automatically.

If one still bounces, forward the bounce message to support@championweb.com and we’ll check your domain’s email settings.

If your DNS is hosted somewhere else

Some domains keep their DNS with another company, such as a website builder. There, the record needs to be added by whoever manages it: a TXT record named _dmarc with the value v=DMARC1; p=none. If you’re not sure where your DNS is hosted, write to us and we’ll tell you.

Stricter settings

The mildest setting is the right place to start. The stricter ones, quarantine and reject, tell mail servers to hold back email that fails the checks, which makes it harder for someone else to send email pretending to be you. They also hold back your own email if a service you send through isn’t set up correctly, so they’re worth moving to only once everything that sends for you passes. If you’d like to tighten yours, or add DKIM (a signature your email provider puts on each message), write to support@championweb.com and we’ll help you set it up.