How to Fix 550 5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records.

The affected customers’ mail administrators or providers must configure valid SPF, DKIM, and DMARC authentication for their sending domains; a free Outlook.com recipient cannot add or repair those records.

The rejection shown in the screenshot occurs during SMTP delivery, before the message reaches your mailbox. It therefore is not something that can normally be corrected through Outlook.com rules, Junk Email settings, or the Safe Senders list. A closely matching Outlook.com case likewise identifies the sender’s authentication configuration as the long-term fix.^1^

What each affected customer should do

Send the complete bounce message—not only the screenshot—to the customer’s email administrator or provider and ask them to:

1. Inspect the failed message’s authentication results
   • Identify the visible From domain (5322.From).
   • Identify the envelope/return-path domain (5321.MailFrom).
   • Check the reported SPF, DKIM, and DMARC results.
2. Correct SPF
   • Publish one valid SPF TXT record.
   • Include every service and IP address that legitimately sends mail for the domain.
   • Ensure the actual sending service is authorized.
   • For DMARC to pass through SPF, the envelope sender domain must align with the visible From domain.
3. Enable and validate DKIM
   • The outbound system must add a valid DKIM signature.
   • The DKIM signing domain must align with the visible From domain if DKIM is being used to satisfy DMARC.
4. Publish DMARC
   • Publish a valid DMARC TXT record for the From domain.
   • Ensure DMARC passes through aligned SPF or aligned DKIM.
5. Check third-party senders
   • If a CRM, invoicing platform, marketing service, gateway, or relay sends the messages, it must use the customer’s authenticated domain.
   • The service’s required SPF include/IP must be present, and DKIM should sign with the customer’s domain.

Microsoft documents these authentication and alignment checks for Outlook.com delivery failures.[^2^](https://support.microsoft.com/outlook/fix-ndr-error-550-5-7-515-in-outlook-com#how-do-i-fix-this "Fix NDR error "550 5.7.515" in Outlook.com | Microsoft Support") Microsoft’s security operations guidance also assigns broken SPF or DKIM configuration to the sender and recommends correcting authorized sending sources and domain alignment.^3^

Customers can temporarily send from a different, properly authenticated domain or email provider while their normal domain is repaired.

Why only some customers are affected

Authentication is evaluated for each sending domain and its delivery infrastructure. Consequently, one customer’s messages can be rejected while other senders continue to reach the same Outlook.com mailbox.

Microsoft also applies stricter requirements to high-volume domains. If an affected domain sends at least 5,000 messages per day to Microsoft consumer addresses, Microsoft requires SPF and DKIM to pass, a DMARC record to exist, and DMARC alignment to pass through SPF or DKIM.[^2^](https://support.microsoft.com/outlook/fix-ndr-error-550-5-7-515-in-outlook-com#how-do-i-fix-this "Fix NDR error "550 5.7.515" in Outlook.com | Microsoft Support") That threshold should not be assumed without confirmation from the sender, but it can explain why a previously working sender is now rejected.

If the sender verifies everything passes

If a customer can demonstrate that the rejected message had passing and aligned SPF, DKIM, and DMARC:

1. Have that sender submit the full non-delivery report, timestamp, sending IP, From domain, and message headers through Outlook.com Sender Support.
2. The submission should concern delivery to Outlook.com, Hotmail, Live, or MSN addresses and should be made by the sender or its mail provider.^4^
3. From your personal Outlook.com account, also select Help on the menu bar, describe the rejection, and choose Still need help? → Yes to request account support.[^5^](https://support.microsoft.com/outlook/sent-email-in-outlook-com-comes-back-delivery-failed#undeliverable "Sent email in Outlook.com comes back "delivery failed" | Microsoft Support")

The available information does not establish a general Outlook.com receiving-server incident. Escalation as a possible false positive is appropriate only after the sender supplies evidence that authentication was present, valid, and aligned when the rejected message was sent.

References

1. Why am I not receiving emails from certain senders that I haven't blocked? - Microsoft Q&A
2. Fix NDR error "550 5.7.515" in Outlook.com | Microsoft Support
3. Security Operations guide for email authentication in Microsoft 365
4. Sender Support in Outlook.com | Microsoft Support
5. Sent email in Outlook.com comes back "delivery failed" | Microsoft Support