Why are my emails to hotmail addresses being rejected suddenly?

The rejection is occurring before the message reaches Hotmail, so correct the authentication for your business domain in Google Workspace and its DNS—particularly DKIM and the recently changed DMARC record.

1. Check the domain used in the From address

Use the part after @ in your business email address. For example, for [Email], make the following changes to contoso.com.

These settings are managed in two places:

• Google Admin console: controls DKIM signing.
• Your DNS provider: usually the company where the domain or nameservers are hosted.

Do not change anything on the recipient’s Hotmail account. The error refers to the sending domain, not Hotmail’s own records.^1^

2. Correct SPF without creating a second SPF record

At your DNS provider, find the TXT record beginning with v=spf1.

If Google Workspace is the only system sending as your domain, the normal record is:

Host:  @
Type:  TXT
Value: v=spf1 include:_spf.google.com ~all

Important:

• There must be only one SPF record for the domain.
• Do not add this as a second record if one already exists.
• If a website, CRM, newsletter platform, invoicing system, or support system also sends from your domain, its required SPF entry must be merged into the existing record.

Multiple SPF records, missing sending services, or excessive DNS lookups can make SPF invalid.^2^

3. Enable DKIM in Google Workspace

1. Sign in to the Google Admin console as an administrator.
2. Go to Apps → Google Workspace → Gmail → Authenticate email.
3. Select your business domain.
4. Generate a DKIM record if one has not already been generated.
5. Google will provide a DNS TXT host—commonly a selector such as google._domainkey—and a long TXT value.
6. Add that exact TXT record at your DNS provider.
7. Return to Authenticate email and select Start authentication.

Publishing a DKIM record alone is not enough: Google must also be set to sign outgoing messages with it.^3^

4. Correct the recently changed DMARC record

At your DNS provider, locate the TXT record whose host is _dmarc. A safe initial record is:

Host:  _dmarc
Type:  TXT
Value: v=DMARC1; p=none

There should be only one DMARC TXT record at _dmarc.yourdomain.

If your current record contains reporting addresses or other settings, do not discard them unnecessarily. Check especially for:

• Typing or formatting errors.
• More than one DMARC record.
• A reporting address at your own domain that does not exist.
• A change to p=reject before every legitimate sending service was authenticated.

DMARC passes only when SPF or DKIM passes and the authenticated domain aligns with the domain visible in the From address.^4^

5. Test the result

After the records are published:

1. Send a new message from Gmail to a non-Microsoft mailbox you can inspect.
2. Examine its authentication results.
3. Look for:
   • spf=pass
   • dkim=pass
   • dmarc=pass
4. Confirm that the DKIM signing domain or SPF envelope domain matches, or is aligned with, your visible From domain.

If SPF and DKIM pass but DMARC fails, this is usually an alignment problem rather than a missing record.^5^

Also test mail generated by any website, CRM, accounts package, or bulk-mail platform separately. Those messages can fail even when messages sent directly from Gmail pass.

If all three pass but Hotmail still rejects the message

There have been other recent reports containing the same AS9031519 rejection, but no official confirmation in the available Microsoft guidance that it represents a platform-wide incident.^6^

Submit the issue through Microsoft’s Outlook.com sender-support process. Include:

• The complete bounce message.
• AS9031519.
• The UTC timestamp and Microsoft server name from the rejection.
• Your sending domain and sending IP, if requested.
• Evidence from a newly sent message showing SPF, DKIM, and DMARC passing.

Microsoft provides the sender issue-submission route for delivery problems affecting @hotmail.com, @outlook.com, @live.com, and @msn.com recipients.^7^

Adding your address to a recipient’s Safe Senders list will not fix this error because Microsoft is rejecting the SMTP transaction before delivery.

References

1. Incoming emails being blocked due to lack of SPF/DKIM/DMARC records on my @outlook.com account - Microsoft Q&A
2. Troubleshoot email authentication in Microsoft 365
3. Activate Gmail with Google Workspace (@your-company)
4. Set up DMARC | Security & data protection | Google Workspace Help
5. Troubleshoot DMARC issues | Security & data protection - Google
6. can no longer send email with Outlook. - Microsoft Q&A
7. Sender Support in Outlook.com | Microsoft Support