Senders receiving error message: 550 5.7.1 Message lacks: SPF/DKIM/DMARC Auth Records

The affected sender must give the complete bounce report to their email administrator or provider so they can correct the sending domain’s SPF, DKIM, and DMARC authentication; these records cannot be changed from your personal Outlook.com mailbox.^1^

What to send the sender

Forward the screenshot or copy this complete diagnostic text:

550 5.7.1 Message rejected:
Message lacks SPF/DKIM/DMARC Auth Records (AS9031519)
Recipient: [Email]
Recipient server: outlook-com.olc.protection.outlook.com

Ask the sender to escalate it to whoever manages their email service or DNS. The administrator should:

1. Identify the domain in the message’s From and Return-Path addresses.
2. Verify that the actual outbound server is authorized by that domain’s SPF record.
3. Confirm that outgoing messages are DKIM-signed and that the corresponding DNS record exists.
4. Confirm that a valid DMARC record exists and that SPF or DKIM aligns with the visible From domain.
5. Check any hosted gateway or relay—such as the “PPE Hosted Dispatch” service shown in the bounce—to ensure it is not sending from an unauthorized IP or altering messages after DKIM signing.

Microsoft documents that 550 5.7.1 can result from an incomplete SPF record, connector configuration, or destination security policy. It also notes that missing SPF, missing DKIM signatures, and DMARC alignment failures can cause rejection.^2^

What will not resolve this

Adding the address to Safe senders, changing Outlook Web settings, or checking Junk Email will not normally help. The recipient server rejects this message during SMTP delivery, before it reaches your mailbox, so mailbox-level rules never process it.^1^

For urgent communication, ask the person to send from a different provider or properly authenticated domain until their administrator corrects the original service.

If several unrelated senders are affected

If senders from multiple unrelated providers receive the same rejection:

1. Collect the complete, unedited non-delivery report from each sender, including timestamps, sending domains, and Microsoft error codes.
2. Sign in to Outlook.com.
3. Select Help (?) → Still need help? and contact Outlook.com Support.
4. Include the reports and explain that unrelated sending domains are receiving the same AS9031519 rejection.

If only one organization or sending domain is affected, its mail administrator or email provider remains the appropriate point of escalation.

References

1. Incoming emails being blocked due to lack of SPF/DKIM/DMARC records on ...
2. Troubleshoot email authentication in Microsoft 365