--- title: Outlook.com Is Quietly Rejecting Email from Domains... description: Outlook.com, Hotmail, Live and MSN have quietly started bouncing some email from domains that lack a DMARC record, starting November 5, 2026. Unlike... canonical: https://daily.dev/posts/outlook-com-is-quietly-rejecting-email-from-domains-without-dmarc-dnjfyqxuk twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Outlook.com Is Quietly Rejecting Email from Domains Without DMARC | daily.dev og:description: Outlook.com, Hotmail, Live and MSN have quietly started bouncing some email from domains that lack a DMARC record, starting November 5, 2026. Unlike... og:url: https://daily.dev/posts/outlook-com-is-quietly-rejecting-email-from-domains-without-dmarc-dnjfyqxuk og:image: https://api.daily.dev/og/posts/dnjFYQXuk.png og:image:alt: Outlook.com Is Quietly Rejecting Email from Domains Without DMARC og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Outlook.com Is Quietly Rejecting Email from Domains Without DMARC **[Hacker News](https://daily.dev/sources/hn)** · 6 min read · 1 upvotes · 0 comments ## Summary Outlook.com, Hotmail, Live and MSN have quietly started bouncing some email from domains that lack a DMARC record, starting November 5, 2026. Unlike Microsoft's existing rule targeting senders of over 5,000 messages a day, this new rejection hits small, low-volume senders too, and Microsoft hasn't published any notice about it. The bounce reads '550 5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records' and only some messages are rejected, making the problem easy to miss. The fix is adding a single DNS TXT record at '_dmarc' with the value 'v=DMARC1; p=none', though DMARC only passes if SPF or DKIM already aligns with the domain in the From address. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### why is my email to Outlook.com or Hotmail addresses bouncing with 'Message lacks SPF/DKIM/DMARC Auth Records' Outlook.com, Hotmail, Live and MSN started rejecting some mail from domains without a DMARC record starting November 5, 2026. This is separate from Microsoft's existing rule for bulk senders sending over 5,000 messages a day. The bounce only shows that authentication records are missing, not which one failed, and Microsoft hasn't published any official notice about it. _Teams chasing silent delivery failures track infrastructure changes like this one on daily.dev._ ### how do I check if my domain has a DMARC record Run 'dig +short TXT _dmarc.example.com' from a terminal, replacing example.com with your domain. A line starting with '"v=DMARC1' means a record exists; no output means it doesn't, which is the condition triggering Outlook.com's new rejections. _Developers auditing email deliverability keep DNS checks like this handy via daily.dev._ ### what DMARC record should I add to stop Outlook.com from rejecting my email Add a TXT record named '_dmarc' with the value 'v=DMARC1; p=none'. This declares that the domain uses DMARC and requests reports without instructing receivers to reject or quarantine failing mail, so nothing changes about how Gmail, Yahoo, or other providers handle the mail. DMARC still only passes if SPF or DKIM aligns with the domain in the From address. _Admins locking down domain authentication settings follow fixes like this through daily.dev._ ## Community take How the wider developer community reacted, aggregated from 1 discussion and 120 comments across hackernews (as of 2026-11-10). **TL;DR:** Many developers agree DMARC enforcement is overdue and a quick fix, but there's strong frustration that Microsoft rolled it out silently and that Outlook/Hotmail's mail handling remains unreliable and opaque beyond just this change. **Sentiment:** 35% positive · 30% mixed · 35% skeptical **The case for** - Setting up DMARC is a one-time, ~15-minute fix that most senders should have done long ago. - A hard bounce with a clear error message is better than silently dropping mail, since it tells senders exactly what to fix. - Enforcing authentication standards helps curb spoofing and phishing abuse of non-sending domains. **The pushback** - Microsoft gave no real warning, leaving low-volume senders and their customers blindsided by bounced mail. - Several people argue DMARC with p=none adds little real security value when SPF/DKIM already align. - Outlook/Hotmail has a long history of unrelated delivery problems (silent drops, opaque blocklists, spam misclassification) that make trusting their mail handling difficult. - Critics see this as another way a few dominant providers (Microsoft, Google) centralize control over an ostensibly open protocol, squeezing out small/self-hosted senders. **By community** - hackernews (heated): Discussion splits sharply between people who see DMARC enforcement as overdue and trivial to fix, and those angry about the lack of notice and Outlook's broader history of unreliable, opaque mail delivery. **Hottest debate:** Whether DMARC (especially with p=none) actually provides meaningful security benefit versus being a largely symbolic checkbox given SPF/DKIM already handle authentication. **Open questions** - Is there an official, clear standard governing how receivers should treat domains with no DMARC record at all? - Will Outlook's other long-standing delivery problems (silent drops, unexplained blocklisting) be addressed alongside this DMARC enforcement? - How will this policy affect forwarded mail and mailing lists that rely on forwarding rather than direct sending? **Highlights** > "Since November 5, 2026, Microsoft's consumer mail service has been turning away some of the email from domains that don't publish a DMARC record. If your company emails customers, vendors or applicants with outlook.com, hotmail.com, live.com or msn.com addresses, some of that mail may be bouncing right now. Nobody announced it. The fix is one DNS record." I'm personally seeing this with some email systems I manage - email sent from a domain that has proper SPF and DKIM signatures, but had no DMARC record started bouncing this weekend. > — [xmddmx on hackernews](https://news.ycombinator.com/item?id=50416159) > Under RFC 7489 [1], a domain with no DMARC record simply has no DMARC policy, the receiver is able to enforce whatever policy it likes. Most receivers have chosen to treat this as p=none for the last decade (Microsoft included). This is changing to now so that mail with no record is simply refused. Nothing in the standard prohibits this. a DMARC of p=none might be seen as ambiguous - SPF and DKIM have their own jobs and they work. However, the point of DMARC is not a new way of enforcing mail authentication. Instead it is a way of making certain that the mail is internally consistent and furthermore provides two additional things. 1. it indicates if the domain owner has thoroughly gotten their mail to authenticate (in which case they adopt a p=reject), and 2. it provides a feedback mechanism that allows the domain owner to know if they are seeing authentication and deliverability problems in such a way that they can fix those broken mail flows. [1] https://www.rfc-editor.org/info/rfc7489/ > — [jared\_stewart on hackernews](https://news.ycombinator.com/item?id=50417778) > No, not delivering is much better. You get a clean error message that tells you exactly what to do, it can be fixed in minutes. Spamfoldering email for not having DMARC would be a mistake, it might be years before low volume senders notice and figure out what's wrong (if they ever do). > — [mike\_hearn on hackernews · 1 comments](https://news.ycombinator.com/item?id=50417017) > Gmail only requires DMARC for senders that send >5000 emails per day. Below that it's not required. That rule only appeared in 2024 so I wouldn't say it's been required for a very long time. Perhaps you're thinking of DKIM, which is different. > — [mike\_hearn on hackernews](https://news.ycombinator.com/item?id=50416987) > It's not enough. I have a domain that I had a very long time but it is on an undesirable tld. I got it long before it was problematic. Outlook always puts my mail in the SPAM folder even though I have done everything I could. I even deliver through a trusted provider. Not on any spam list. DMARC, DKIM, SPF all set up. No dice. > — [BadBadJellyBean on hackernews](https://news.ycombinator.com/item?id=50417565) **Source threads** - [hackernews](https://news.ycombinator.com/item?id=50416158) · 125 points · 120 comments ## Similar posts on daily.dev - [SPF, DKIM, and DMARC explained for developers](https://daily.dev/posts/spf-dkim-and-dmarc-explained-for-developers-mbs1noovg) · Flavio Copes · 2 upvotes · 1 comments - [DMARC Has Been Public Since 2012. 68.4% of Company Domains Still Don't Enforce It.](https://daily.dev/posts/dmarc-has-been-public-since-2012-68-4-of-company-domains-still-don-t-enforce-it--fqi9oizmo) · Hacker News · 0 upvotes · 0 comments - [Email Deliverability Issues in 2026: 9 Common Problems and Fixes](https://daily.dev/posts/email-deliverability-issues-in-2026-9-common-problems-and-fixes-zqgpuodut) · Security Boulevard · 0 upvotes · 0 comments - [DMARC reports are the only outside view of your mail](https://daily.dev/posts/dmarc-reports-are-the-only-outside-view-of-your-mail-bzxwpayb1) · /dev/io · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#microsoft](https://daily.dev/tags/microsoft), [#dns](https://daily.dev/tags/dns) [View this post on daily.dev](https://daily.dev/posts/outlook-com-is-quietly-rejecting-email-from-domains-without-dmarc-dnjfyqxuk) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Outlook.com Is Quietly Rejecting Email from Domains Without DMARC","url":"https://daily.dev/posts/outlook-com-is-quietly-rejecting-email-from-domains-without-dmarc-dnjfyqxuk","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/outlook-com-is-quietly-rejecting-email-from-domains-without-dmarc-dnjfyqxuk"},"datePublished":"2026-11-08T20:33:02.244Z","dateModified":"2026-11-10T02:23:51.401Z","description":"Outlook.com, Hotmail, Live and MSN have quietly started bouncing some email from domains that lack a DMARC record, starting November 5, 2026. Unlike...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9a8a5052e74c188eef86174db50c8596?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9a8a5052e74c188eef86174db50c8596?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Hacker News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Hacker News","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/hn","url":"https://daily.dev/sources/hn"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/outlook-com-is-quietly-rejecting-email-from-domains-without-dmarc-dnjfyqxuk","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,microsoft,dns","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Hacker News","item":"https://daily.dev/sources/hn"},{"@type":"ListItem","position":3,"name":"Outlook.com Is Quietly Rejecting Email from Domains Without DMARC"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/outlook-com-is-quietly-rejecting-email-from-domains-without-dmarc-dnjfyqxuk#faq","mainEntity":[{"@type":"Question","name":"why is my email to Outlook.com or Hotmail addresses bouncing with 'Message lacks SPF/DKIM/DMARC Auth Records'","acceptedAnswer":{"@type":"Answer","text":"Outlook.com, Hotmail, Live and MSN started rejecting some mail from domains without a DMARC record starting November 5, 2026. This is separate from Microsoft's existing rule for bulk senders sending over 5,000 messages a day. The bounce only shows that authentication records are missing, not which one failed, and Microsoft hasn't published any official notice about it. Teams chasing silent delivery failures track infrastructure changes like this one on daily.dev."}},{"@type":"Question","name":"how do I check if my domain has a DMARC record","acceptedAnswer":{"@type":"Answer","text":"Run 'dig +short TXT _dmarc.example.com' from a terminal, replacing example.com with your domain. A line starting with '\"v=DMARC1' means a record exists; no output means it doesn't, which is the condition triggering Outlook.com's new rejections. Developers auditing email deliverability keep DNS checks like this handy via daily.dev."}},{"@type":"Question","name":"what DMARC record should I add to stop Outlook.com from rejecting my email","acceptedAnswer":{"@type":"Answer","text":"Add a TXT record named '_dmarc' with the value 'v=DMARC1; p=none'. This declares that the domain uses DMARC and requests reports without instructing receivers to reject or quarantine failing mail, so nothing changes about how Gmail, Yahoo, or other providers handle the mail. DMARC still only passes if SPF or DKIM aligns with the domain in the From address. Admins locking down domain authentication settings follow fixes like this through daily.dev."}}]} ```