Getting Rejected at Microsoft with 550 5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records (AS9031519)

Reports are that Microsoft appears to have quietly launched a new DMARC policy that requires all senders, regardless of volume, to publish DMARC, SPF and DKIM records for email acceptance. If you are receiving the message:

550 5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records (AS9031519)

when you send email to Outlook.com, Hotmail, MSN or Live email addresses, you need to update your email configuration quickly to maintain email delivery.

What does 550 5.7.1 Message rejected mean?

For Business Senders to Microsoft Email Services

As of November 4th-5th, 2026, it appears that Microsoft now requires DMARC, SPF and DKIM records for delivery acceptance at the server level. This means that email sent to Microsoft email services could be rejected entirely at the server, i.e. not even allowed on the servers, much less the spam folder, without valid SPF, DKIM and DMARC records. While this effect has been reported to be sporadic, including some rejected messages with headers indicating “dmarc=pass” that later proved to be missing a DMARC record, it’s best to assume that Microsoft is increasing their security against spam, phishing and scammers. By becoming fully DMARC compliant, you can protect your valuable business email like invoices, orders, password resets, marketing campaigns, etc.

For Recipients on Microsoft Email Services

If you are an email recipient hosting your inboxes at a Microsoft service (Hotmail, Outlook.com, Office365, etc.) this is beneficial, despite the temporary loss of some email. Your email address is not being blocked. Microsoft is protecting the email you receive from potentially bad actors, reducing spam and the risk of fraud and phishing. If legitimate senders are having trouble reaching your inboxes or saying something like “emails to hotmail are bouncing”, they have some configuration work to do to achieve DMARC authentication (see below) and get to your inbox. Forward this post to help them out.

What do senders need to do?

First, SPF, DKIM and DMARC are all interacting pieces of DMARC compliance: SPF and DKIM each prove a message is legitimate, and, at the recipient, DMARC checks that they match the From address and tells Microsoft what to do when they don’t. It is important to verify the validity of your SPF, DKIM and DMARC records:

  • An SPF record defines IP addresses that can send on your behalf. Check your SPF with our free SPF Lookup Tool.
  • A DKIM record provides a digital key to verify your emails’ digital signature. By DKIM signing outbound email you can claim ownership. Check your DKIM Record(s) with our free DKIM Lookup Tool.
    (Note: you need to know your DKIM selector(s) for each sender you are using.)
  • A DMARC record enables you to define email addresses to receive feedback on your email and a policy for how to treat non-compliant email. Check your DMARC record with our free DMARC Lookup Tool.

Second, if any of your records are missing or incorrect, make updates to your records. Our lookups provide specific errors and detailed descriptions of the problem. Follow the problem details recommendations provided to correct your SPF, DKIM or DMARC records, these will help improve your email delivery. MxToolbox also provides free tools to help you generate new records:

Next, confirm everything with MxToolbox’s free Outlook Compliance tool to test your email configuration’s compliance with Microsoft, Google and Yahoo bulk sender rules, including SPF, DKIM and DMARC compliance. Test each of your internal and 3rd party email sources to ensure all are properly configured.

Finally, DMARC is not a “set and forget” technology. To maintain DMARC compliance, you need to receive and analyze DMARC XML reports about the email coming from your domain. DMARC XML reports are sent daily from each inbox provider and contain details of that day’s individual sender. You can review them individually in our free DMARC XML tool to check on email delivery. Problems could affect your email delivery, including:

  • New senders missing from your SPF records.
  • Senders missing DKIM signatures.
  • Senders attempting to use your domain in Fraud and Phishing emails.

DMARC requires on-going management and maintenance in order to achieve the best email delivery and managing individual XML reports on a daily basis becomes cumbersome.

MxToolbox provides a complete email delivery suite designed to protect your email delivery reputation, including SPF, DKIM and DMARC management, and get your email to the inbox. MxToolbox Delivery Center has:

  • Adaptive Blacklist monitoring to alert you to issues with your senders’ reputation
  • DMARC Compliance reporting and monitoring to maintain compliance with Microsoft, Google and Yahoo bulk sender requirements
  • Step-by-step workflows to achieve DMARC Enforcement and protect your domain from being used in fraud and phishing
  • BIMI Management and hosting to get your logo in the Inbox.
  • Inbox Placement analysis with Google Postmaster Spam rates to analyze the potential inbox performance of your campaigns and your spam rates, so you can get your message to the inbox.

Get ahead of email delivery issues with MxToolbox.