Microsoft Outlook consumer addresses reportedly reject mail from domains with no DMARC record
Email admins report Microsoft Outlook Consumer addresses rejecting mail from sending domains with no DMARC record, even when SPF and DKIM pass. Microsoft 365 business domains appear unaffected, and the cause is not confirmed.
What happened
From various email admins on Mailop mailing list and others, it seems that Microsoft Outlook Consumer emails are rejecting their email, when there isn't a DMARC record in their sending domain in DNS. The place which compiled reports on that - Spam Resource - claims to know that the message is rejected even if emails pass SPF and DKIM. It's "550 5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records" bounce. Spam Resource author isn't sure if it's intentional policy change of Microsoft or not.
Why it matters
Microsoft current bulk sender requirement is for bulk sending more than 5000 messages a day to Microsoft domains. The reports you're hearing about are from senders that don't necessarily fit the bulk definition, so it sounds like there may have been a change in the last day or two. So that would mean that a sender that isn't bulk but doesn't have DMARC may find their messages to consumer outlook addresses being rejected.
The detail that SPF and DKIM passes don't prevent the rejection is the part to note. On this reading, a missing DMARC record can be enough on its own to trigger the bounce.
Very limited seems like. These reports are about Outlook Consumer domains. Nothing seems to affect microsoft hosted business domains (Microsoft 365). According to spam resource.
And also in a sporadic way. So some people have said it is sporadic, not all may be affected. So you may try sending a test send and if it goes through that doesnt mean it is exposed for a domain.
Spam Resource recommends that if a domain does not have a DMARC record, it should get one now - even if it's with a p=none. And if they're not able to do DNS / servers, to go to their email service provider / CRM / marketing automation.
What to do
- Check DNS for a DMARC record on every domain you send from. Include the domains used by your ESP, CRM, transactional mail and any subdomains used in the visible From address. The reported rejections hinge on the sending domain having no DMARC record.
- Publish a DMARC record with p=none where none exists. Spam Resource recommends adding one now, even at p=none.
- Search recent bounce logs for the 550 5.7.1 code. That is the rejection text senders are reporting. Filter by Microsoft consumer recipient domains, and look across several sends, because the rejections have been described as sporadic.
- Do not take SPF and DKIM passes as cover. Reported rejections occur even when both pass. Confirm the DMARC record exists rather than relying on your platform's authentication dashboard alone.
- Ask your platform for help if you cannot edit DNS. Spam Resource advises senders who cannot manage DNS or servers to contact their email service provider, CRM or marketing automation platform.
- Check where you sit against Microsoft's bulk threshold. The bulk requirement applies above 5,000 messages per day to Microsoft domains. Senders who do not necessarily meet that definition are the ones newly reporting problems.
- Watch for a statement from Microsoft. The author does not know whether the change is intended. Reports that the rejections reach Microsoft 365 business domains, which so far appear unaffected, would widen the scope.