Emails to Outlook and Hotmail Bouncing? What the 'Message Lacks SPF/DKIM/DMARC' Error Means

If you found this page, an email you sent probably just bounced back with something like this:

550 5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records (AS9031519)

Outlook.com, Hotmail, Live and MSN (all run by Microsoft) are turning away some email they cannot confirm really came from the sender's own domain. This page shows you how to check whether that is your problem, no technical skills needed, and what to do next.

Checked against provider logs and public reports on 9 November 2026.

The short answer: the receiving server could not confirm your email came from your domain, and some providers have reported missing DMARC records in cases like this. The fix is one small text entry in your domain's settings, and publishing that record is the step providers recommend. The full bounce message and your email settings are needed to confirm the cause. You do not need to understand it to get it fixed: run the check in Step 1, then hand the change to whoever manages your domain in Step 3.

Is this your problem?

Probably yes, if you send from your own domain and only Outlook.com, Hotmail, Live or MSN addresses are rejecting the mail. The pattern looks like this:

• Emails to Outlook.com, Hotmail, Live or MSN addresses bounce with the error above
• Emails to Gmail and other providers still arrive normally, which is the pattern providers report
• It started in early November 2026

This fix is for people who send from their own domain, like you@yourbusiness.com.au. If you send from a free address like @gmail.com or @outlook.com, you cannot change that provider's domain settings yourself, so the check below will not be yours to make.

Step 1: Check your domain in your browser (about a minute)

Your domain is the part after the @ in the email address you send from. For you@yourbusiness.com.au, the domain is yourbusiness.com.au. A missing DMARC record, which is a small public note about your domain's email, matches this bounce, and you can check for one without installing anything:

1. Go to MXToolbox DMARC Check.
2. Type your domain into the box and run the check.
3. Note what it returns. The next section explains what each result means.

How to read the result

• A line starting with v=DMARC1: a record exists. That does not rule the bounce out on its own, because a record that does not match how your email is actually sent can fail too.
• "No record found": there is probably no record, which matches the bounce. Confirm you typed the domain correctly.
• Nothing, moments after adding one: DNS changes take time to show up. Check again later rather than assuming the change failed.
• You send from a subdomain: for you@shop.yourbusiness.com.au, check the main domain as well, because receivers fall back to it.

If you would like a second opinion, dmarcian's Domain Checker and EasyDMARC's DMARC checker do the same lookup and explain what each part of the record means. Google's Check MX tool checks your domain's wider email settings.

Not sure what to make of the result? Whoever manages your website, domain or email can help you read it.

Step 2 (optional): See where a test email actually lands

Warmy's email deliverability test gives you a list of test addresses at Gmail, Outlook, Yahoo and other providers. You send one email to the whole list and it reports where that email landed at each provider.

Two things to know: use a plain dummy message with nothing private or client-related in it, because a third party receives whatever you send. And treat the result as a sample of one email at those addresses at that moment, not a verdict on everything you send. A spam result at the Outlook addresses alongside inbox results elsewhere is a useful clue, nothing more.

Step 3: Hand it to whoever looks after your email

Adding the missing record is a small settings change in the account where your domain is managed. It is quick for someone who works with domains, but it has to be done in the right place and checked against your existing email setup, so it is a job for whoever looks after your website or email: your web designer, IT support, or your email provider's support team.

Send them this page and the full bounce message. That gives them the error code, the likely cause, and the checks you have already done, which is a solid place to start.

Two neighbouring problems worth ruling out while you are here. If the mail is landing in spam rather than bouncing, the fix is a different one: an SMTP plugin will not solve it. And if the messages that stopped arriving are contact form notifications from your website, that failure has its own set of causes.

Rather not deal with it yourself? I run a $150 diagnostic on the issue, then quote the fix. Send me the bounce message and I will tell you what it is. I work remotely with businesses across Perth and Western Australia, and anywhere else in Australia.

Technical background: what SPF, DKIM and DMARC actually do

Everything below is for the person making the change, and for anyone curious. You do not need it to get the problem fixed.

What the three checks are

When your email arrives, the receiving mail server checks whether it really came from an approved sender for your domain. It can use up to three checks:

• SPF is the list of mail servers allowed to send for your domain, like the list of couriers a company authorises to send its post
• DKIM adds a digital signature to the message, which shows whether the signed parts were changed along the way
• DMARC is a short public note that ties those two checks to your domain and tells receivers what to do when they fail

The bounce message says the receiving server found none of these it could use.

What's actually known so far (and what isn't)

Everything known about this wave of rejections comes from email providers' own testing and logs, not from Microsoft. It could be a deliberate change, a test, or something that gets rolled back. What providers have reported:

• It started around 5 November 2026. MailRoute first spotted it in its logs and mxio dates the first rejections to 5 November. In the cases providers examined, the missing DMARC record was the common factor, often on domains where SPF and DKIM were already set up correctly.
• It is inconsistent. The same domain can have one email accepted and the next rejected. One email getting through does not mean you are in the clear.
• It seems to only affect consumer Microsoft addresses. In one provider's testing, business email hosted on Microsoft 365 accepted the same messages that Outlook.com and Hotmail refused. dmarcdrift's write-up makes the same "unconfirmed, watch this space" point.
• It is separate from Microsoft's published rules for bulk senders, meaning domains sending over 5,000 emails a day, which have been around since May 2025 and produce a different error code (550 5.7.515, from Microsoft's announcement).

Treat publishing the record as a well-supported troubleshooting step after checking, not a guaranteed fix. The bounces have been intermittent, and some look-alike cases turn out to have other causes, such as an SPF failure.

The DMARC record to publish: TXT at _dmarc, v=DMARC1; p=none

Once the missing record is confirmed, the step email providers recommend is publishing a DMARC record: one small text entry in the domain's DNS settings. DNS is the internet's address book for your domain, the same place that points it at your website and your email.

Field	Value
Type	TXT
Name	_dmarc
Value	v=DMARC1; p=none

What to know about it:

• p=none asks for no DMARC-based action. It tells mail servers not to reject or quarantine email because of DMARC while you watch what the checks show. Receivers still apply their own spam filtering.
• Only publish one. More than one DMARC record on the same name can make receivers treat the setup as invalid, as if there were no record at all.
• It works together with the existing setup. The record passes when SPF or DKIM matches the domain in the From address. By default, matching at the organisational-domain level is enough; this is called relaxed alignment. A stricter exact-match mode exists but is not the default. One common gap, depending on configuration: Microsoft 365 can sign email with Microsoft's own domain instead of yours until DKIM is switched on for your domain, and that does not count.
• Some DNS hosts fill in your domain for you. On those, entering the full _dmarc.yourdomain.com accidentally creates _dmarc.yourdomain.com.yourdomain.com. Check how yours behaves. Yes, really.
• Reports are optional but useful. An optional rua tag says where to send summary reports about email using your domain. Only point it at an address that exists and that you control. The Cloudflare option below handles this for you if you would rather not run a reports mailbox.

A DNS change takes effect as the old record's TTL expires, usually within minutes. Messages that already bounced have to be sent again.

Free monitoring, if the domain's DNS is on Cloudflare

If the domain's DNS is managed by Cloudflare, there is a free tool that watches this for you. DMARC Management is available on every plan, and setup takes a few minutes: log in to the Cloudflare dashboard, pick the domain, go to Email, then DMARC Management, and select Enable.

Cloudflare checks whether the domain has a DMARC record. If it does not, it offers to add one. If it does, it adds its own reporting address so it can receive the summary reports mail servers send about the domain. The dashboard then shows who is sending email as the domain and whether their mail passes the identity checks. Handy for spotting things like an old newsletter service or ticketing system still sending from the domain with broken settings.

Its limits, so you read it correctly:

• It can only show what receiving servers report, and not all of them send reports. A quiet dashboard does not prove nothing is failing.
• First reports can take up to 24 hours to appear.
• It only works on the main domain (yourdomain.com, not blog.yourdomain.com).
• It is monitoring. It tells you what is failing; fixing it is still on you.

Worth checking whatever happens: any domains set up once and forgotten. An old brand. A domain that only sends automated emails from an app. A system a supplier configured years ago. Those are the ones nobody has looked at in years.

---

FAQ

Why are my emails to Hotmail and Outlook.com suddenly bouncing?

Since around 5 November 2026, Microsoft's consumer mail servers have been rejecting some email from domains without a DMARC record, the common factor in every rejection providers have examined. Microsoft has not announced the change; this is what email providers observe in their own logs and testing.

What does "Message lacks SPF/DKIM/DMARC Auth Records" mean?

In plain English, the receiving mail server could not confirm the email really came from the sender's domain. SPF is the list of servers allowed to send for a domain, DKIM is a signature that shows whether the signed parts of the message were changed, and DMARC is the note that ties the two to the domain. In the reported cases, the missing piece was the DMARC record.

How do I fix error 550 5.7.1 AS9031519?

After checking that the record is missing, email providers recommend publishing a DMARC record for the domain in your From address: one TXT record in your DNS settings, named _dmarc, with the value v=DMARC1; p=none. Providers report the bounces stopping where a missing record was the problem. It is a troubleshooting step rather than a guarantee, since the bounces are intermittent and some look-alike cases have other causes. If you do not manage your domain settings yourself, hand it to whoever looks after your website or email.

What is a DMARC record?

A small text entry in your domain's DNS settings. It tells receiving mail servers how to handle email that fails identity checks, and it links your SPF and DKIM setup to the domain in your From address. A p=none policy asks receivers to take no DMARC-based action while you monitor; it is a monitoring stance, not a delivery guarantee.

How do I check if my domain has a DMARC record?

Free websites check it for you. Type your domain (the part after the @ in your email address) into MXToolbox's DMARC Check; dmarcian's Domain Checker and EasyDMARC's DMARC checker work too. A result starting with v=DMARC1 means a record exists, though whether it is set up correctly still needs checking. No result usually means there is no record, but rule out a lookup error or a just-added record that has not shown up yet. If you send from a subdomain, check the main domain too.

Is Cloudflare DMARC Management free?

Yes. It is available on all Cloudflare plans for domains using Cloudflare DNS. Enabling it adds Cloudflare's reporting address to your DMARC record (or offers to create a record), and your first reports can take up to 24 hours to appear.