Is Outlook rejecting emails from your business? Since about November 5, senders writing to Outlook.com and Hotmail addresses have been getting a bounce that reads 550 5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records, sometimes even when their email settings look correct. Microsoft has not explained it publicly as of November 9, but there is still useful work a BC business can do today.
What the Outlook 550 5.7.1 bounce means
The reports centre on mail going to Microsoft’s free personal accounts: outlook.com, hotmail.com and live.com. Reports from Microsoft 365, Google and Zoho senders have turned up on Microsoft’s support forums and on Reddit. Some bounces carry a slightly different code, 550 5.7.23, which points specifically at an SPF check. Others include the tag AS9031519.
The odd part is how inconsistent it is. One message sent through Zoho was refused, then delivered when it was sent again about 20 minutes later. One administrator said mail to Gmail addresses arrived while mail to Hotmail addresses was refused.
The three checks named in the error are simple once you strip away the acronyms:
- SPF is a public list of the mail servers allowed to send for your domain.
- DKIM is a digital signature that proves a message came from your domain and was not altered.
- DMARC checks that SPF or DKIM matches the domain in the From address your customer sees, and tells receiving servers how to treat mail that does not.
All three live in your domain’s DNS settings, usually managed wherever your domain or website is hosted.
Why valid SPF records can still bounce
Nobody outside Microsoft knows the cause yet. Two explanations are in play, and both may be partly true.
The first is a missing DMARC record. The email security company MailRoute reports that it began seeing domains without DMARC rejected on November 5, and at least one administrator said failures stopped after adding the record. Microsoft 365 does not publish a DMARC record for your custom domain on its own, so many small offices have never had one.
The second is something on Microsoft’s side. Plenty of administrators say all three records are in place and mail still bounces now and then. A moderator on Microsoft’s support forum wrote that intermittent failures across different providers look broader than one sender’s configuration, while noting that forum contributors cannot confirm whether it has been escalated.
Microsoft does have a published rule for high-volume senders, in place since May 2025, for domains sending more than 5,000 messages a day to Outlook.com. Its bounce code is 550 5.7.515. The bounces reported this week carry different codes and are reaching people who send nowhere near that volume, but whether the two are connected is not known.
What this means for your business
The bounce your staff can see is the easy part. The harder part is mail nobody is watching. Invoicing software, booking reminders and website contact forms often send their failure notices to a mailbox no one checks.
Picture a Langley contractor sending a quote to a homeowner who has kept the same Hotmail address for twenty years, or an Abbotsford clinic whose reminder for next week’s visit bounces. Neither side knows anything went wrong until someone phones to ask.
Our advice to Fraser Valley offices is to treat this as two jobs: fix what is yours now, and do not chase what is Microsoft’s. Adding a missing record is cheap and worth doing regardless of how this story ends. Rewriting a working setup because of one bounce is how a small problem becomes a bigger one.
What to do this week
- Keep the whole bounce message. The code and tag matter. 5.7.1, 5.7.23 and 5.7.515 are different problems, and support will ask for the details.
- Look up your domain. Use a free DNS checker, or ask your IT provider, to confirm you have one SPF record, working DKIM and a DMARC record at _dmarc.yourdomain.ca. A domain should have only one SPF record.
- Turn on DKIM for your own domain. In Microsoft 365 this is a separate step in the Defender portal, and it needs two DNS records added.
- Add DMARC if it is missing. Create a TXT record named _dmarc with the value v=DMARC1; p=none. With p=none, a failed check changes nothing about how the message is handled, which makes it a low-risk first step. The record does not fix anything by itself: your SPF or DKIM still has to line up with the domain people see you sending from.
- List everything that sends as you. Accounting tools, booking systems, newsletters, website forms and office scanners all count. Each one needs to be covered by SPF or DKIM.
- Resend, then pick up the phone. Try a failed message again after 20 or 30 minutes. If it is a quote, an invoice or anything with a deadline, call the customer.
Hold off on moving to a strict DMARC policy such as p=reject for now. That setting can block your own legitimate mail if one of those tools is not set up properly, and it is the wrong change to make while the cause is unclear.
If the bounces continue with everything in place, send the full message to Microsoft, including timestamps, the sending IP address and the authentication results. Business customers can open a case in the Microsoft 365 admin centre.
If you only have a personal Outlook.com address and people tell you their mail to you bounced, there is nothing for you to add, because Microsoft manages those records. Ask the sender to check their domain and to forward you the full bounce. Then sign in to Outlook.com yourself and report it under Help, then Still need help.
Need a second set of eyes on your email?
DNS records are a small thing to get right and an annoying thing to get wrong. We are based in Surrey and look after offices through IT support in Langley, IT support in Abbotsford and across the Fraser Valley. If you would like someone to check your SPF, DKIM and DMARC and tell you plainly what is fine and what is not, our managed IT team can help. Call 604-375-2629.