If your business emails have suddenly started bouncing back from Hotmail or Outlook.com addresses, you’re not alone. We’re seeing this across multiple clients, including messages to contacts they have emailed successfully for years.
Quick fix: check your DMARC record
If you want the short version before the detail:
- Using Cloudflare? Adding a missing record can be one click. Open your domain, go to Email → DMARC Management and enable it. If Cloudflare offers to create a missing DMARC record, review the settings and click Add.
- Start with p=none while checking your setup. SPF and DKIM still need to be correct.
- Once the DNS update takes effect, retest and resend bounced messages.
- See the full fix below.
The bounce may say SPF validation error, 550 5.7.23 or Message lacks SPF/DKIM/DMARC Auth Records (AS9031519).
The leading explanation is that Microsoft appears to be checking email authentication more strictly. A missing DMARC record, one of your domain’s email settings, is a common factor in the reports. Microsoft has not publicly confirmed whether this is an intended change or a fault, so it is worth checking your setup rather than assuming there is a general outage.
Why are emails to Hotmail suddenly bouncing back?
Your business email uses settings that help receiving providers check whether a message is genuinely from your domain. The three main settings work together:
- SPF: Identifies the servers authorised to send your email.
- DKIM: Adds a digital signature that helps verify your messages.
- DMARC: Checks whether authentication matches the domain shown in your From address and publishes a policy for handling failures.
Many businesses already have SPF configured but have never added DMARC. That missing setting appears to be behind many of the recent delivery failures.
Email provider MailRoute reports seeing these rejections since around 5 November 2026. The rejected messages it examined came from domains without DMARC, including some with SPF and DKIM already in place. Its findings are in MailRoute’s note on the Outlook “Message lacks SPF/DKIM/DMARC Auth Records” rejection.
What does SPF validation error 550 5.7.23 mean?
The general SPF error heading does not tell the whole story. Further down the delivery failure, you may see the more specific message Message lacks SPF/DKIM/DMARC Auth Records (AS9031519).
For this particular combination, do not assume your SPF record needs replacing. Check whether your domain has a valid DMARC record, then have your email provider verify SPF and DKIM as well.
Keep the complete bounce message. The detailed rejection text is more useful than the subject line alone.
Which email addresses are affected?
Reports mainly concern messages sent to Microsoft’s personal email services:
- hotmail.com
- outlook.com
- live.com
- msn.com
Businesses using Microsoft 365, Fastmail and other providers have reported problems sending to these addresses. Operators have also reported intermittent failures, so some messages may still get through. The original discussion is in the mailop mailing list thread “Microsoft requiring DMARC now or just us?”.
Using the Outlook application does not necessarily mean someone is affected. Outlook is also used to access business mailboxes and accounts hosted elsewhere.
How to fix emails rejected by Hotmail or Outlook.com
Ask whoever manages your domain and email to check the following. The domain settings may be managed separately from your website or email account.
Using Cloudflare? Adding the missing DMARC record can be one click
If your domain’s DNS is already managed by Cloudflare, you do not need to type the record in manually. Its free DMARC Management tool can create a missing record for you.
Open your domain in the Cloudflare dashboard, go to Email → DMARC Management and enable it. If Cloudflare finds no DMARC record, it offers to create one. Click Add, and that part is done.
Check the proposed policy and start with p=none while reviewing your email setup. This can resolve the missing-record issue, but SPF and DKIM still need to be correct. Allow time for the DNS change to take effect, then retest and resend any bounced messages.
See Cloudflare’s guide to enabling DMARC Management.
1 Check whether your domain has DMARC
You can check this without logging in to your website or email account:
- Open MXToolbox’s free DMARC checker.
- Enter the part after the @ in your business email. For hello@yourbusiness.com.au, enter yourbusiness.com.au.
- Run the check. Look for whether a DMARC record was found.
No record found? Use Cloudflare’s option above if you manage your DNS there. Otherwise, ask your IT provider or whoever manages your domain’s DNS to add it. This is done in your domain’s DNS settings, not in Outlook.
These are the details to give them:
- Record type: TXT
- Name: _dmarc
- Value: v=DMARC1; p=none
Record already found? Ask your provider to review it alongside SPF and DKIM. Do not add a second record. A warning about the policy not being enforced is different from a missing record: p=none is a valid starting policy.
2 Check SPF and DKIM
Adding DMARC does not correct other authentication problems. Your administrator should confirm that your sending services are authorised by SPF and that DKIM signing is configured correctly.
This includes services sending invoices, website enquiries and marketing emails using your domain. Passing SPF or DKIM alone does not necessarily mean DMARC passes. The authenticated domain also needs to match your From domain under DMARC’s alignment rules.
For Microsoft 365, publishing DKIM records and enabling signing are separate parts of the setup. The exact DNS values need to come from your Microsoft 365 account. Follow Microsoft’s guide to setting up DKIM for Microsoft 365.
3 Retest and resend failed messages
Once the updated records are visible publicly, send fresh test messages to the affected addresses.
Because the reported failures can be intermittent, test more than once and check for any new bounces. Messages that have already bounced need to be sent again.
If an urgent invoice, contract or other important message has failed, contact the recipient another way while the delivery issue is being resolved.
Common questions
Does this affect small businesses?
Yes. Businesses sending only a few emails a week have reported the same error.
What if adding DMARC does not fix it?
Send the full bounce message to your email provider so they can check what is still failing.
My Hotmail account is not receiving business emails. What should I do?
Ask the sender to check for a bounce and pass it to their email provider. The missing setting belongs to their domain.
Need help with rejected business emails?
Contact Thrive with the complete bounce message so we can check the error and your domain’s email settings.
