Outlook rejects email from domains without DMARC records

MailRoute has reported a notable shift in inbound filtering by Microsoft consumer mailboxes, with Outlook[.]com starting in early November 2026 to reject messages from custom domains that do not publish DMARC records. The consequence is unexpected delivery failures for routine transactional emails and low-volume communications such as order confirmations, verification codes, and customer support notices.

Administrators sending to consumer accounts may see non-delivery receipts with the code 550 5.7.1, indicating the incoming message lacks the required cryptographic authentication headers. While many affected domains already publish valid SPF and DKIM records, Microsoft now requires an active DMARC policy, and the enforcement spans consumer services including Hotmail[.]com, Live[.]com and MSN[.]com. Microsoft Learn discussions corroborate that delivery can drop without prior warning, placing domains without complete authentication at immediate risk.

The piece outlines the three essential authentication layers—SPF, DKIM, and DMARC—and explains that DMARC verifies alignment between authenticated identities and the visible sender address, while also dictating how to handle messages that fail validation. It advises administrators to audit public DNS zone records promptly and notes that many modern hosting platforms offer standard TXT templates for DMARC.

A cautious approach recommended in the article is to start with a p=none monitoring policy to observe delivery telemetry before moving to strict quarantine or reject policies. The article emphasises that older domains are frequently missing DMARC entries, and asserts that establishing verified cryptographic records is necessary for reliable delivery across enterprise ecosystems.