550 5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records

Question

550 5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records

jlccleo 5

About 50% of my clients that have emailed me since yesterday are getting the message 550 5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records (AS9031519) [TY2PEPF0000AB8A.apcprd03.prod.outlook.com 2026-11-06T19:53:27.630Z 08DF3B738DE5D0FD].

I see others are also having this issue. Is this a Microsoft issue? I have a difficult time believing that all of my clients using different emails are all having issues with their email so it appears it is an issue with Microsoft.

Frank Lawler 0 Reputation points

2026-11-07T02:27:11.0433333+00:00
Fixed: “550 5.7.1 Message lacks SPF/DKIM/DMARC Auth Records (AS9031519)”, M365 → Hotmail/Outlook.com

Mail from my M365 tenant to Hotmail bounced with “SPF validation error” (5.7.23). That headline is misleading: my SPF and DKIM were both fine. The real problem was the detail line saying the message lacked SPF/DKIM/DMARC auth records. Even though Microsoft’s own outbound headers said dmarc=pass, MXToolbox showed I had no DMARC record. M365 never creates one.

Fix: add a TXT record at your DNS host:

Name: _dmarc

Value: v=DMARC1; p=none; rua=mailto:******@yourdomain.com

If your DNS is hosted by Microsoft, it goes under Admin center → Settings → Domains → [domain] → DNS records. Otherwise, add it wherever your DNS lives, such as GoDaddy, Cloudflare or your web host. Hotmail accepted my mail once the record showed up on MXToolbox.

Check your other domains too with dmarc: and spf: lookups on mxtoolbox.com. On a second domain I found duplicate DMARC records and an SPF syntax error, and either one breaks authentication.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

7 answers

Your answer

Frank Lawler 0 Reputation points

2026-11-07T02:27:11.0433333+00:00

Fixed: “550 5.7.1 Message lacks SPF/DKIM/DMARC Auth Records (AS9031519)”, M365 → Hotmail/Outlook.com

Mail from my M365 tenant to Hotmail bounced with “SPF validation error” (5.7.23). That headline is misleading: my SPF and DKIM were both fine. The real problem was the detail line saying the message lacked SPF/DKIM/DMARC auth records. Even though Microsoft’s own outbound headers said dmarc=pass, MXToolbox showed I had no DMARC record. M365 never creates one.

Fix: add a TXT record at your DNS host:

Name: _dmarc

Value: v=DMARC1; p=none; rua=mailto:******@yourdomain.com

If your DNS is hosted by Microsoft, it goes under Admin center → Settings → Domains → [domain] → DNS records. Otherwise, add it wherever your DNS lives, such as GoDaddy, Cloudflare or your web host. Hotmail accepted my mail once the record showed up on MXToolbox.

Check your other domains too with dmarc: and spf: lookups on mxtoolbox.com. On a second domain I found duplicate DMARC records and an SPF syntax error, and either one breaks authentication.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Answer 1

M S 0

I am not managing to fix this !!

Many different people I have been in touch with over the years are not managing to send me messages.

They all report the same error message and I cant ask each of them and who knows who else is trying to send me emails to change their settings ?

Is there anything I can change on my side that will allow those emails to come through ?

Much appreciated

David R 0 Reputation points

2026-11-08T20:49:51.0066667+00:00
Unfortunately, there's probably nothing you can change in your Hotmail/Outlook settings to fix this, since Microsoft rejects these emails before they reach your mailbox.

I completely understand that you can't realistically contact every sender, especially when you don't even know who's trying to email you.

However, I would still recommend doing the simple dmarc check, just to find out whether this is likely what's causing the problem.

If the record is missing, you have a few options:

Forward the findings to the sender's IT department or email provider. I've included a simple message below that you can copy and send.

Wait and hope Microsoft relaxes these apparently stricter checks, although there's no guarantee they will.

Switch to another email provider, such as Gmail. Just keep in mind that other providers may eventually introduce similar requirements. Hopefully they'll communicate such changes more clearly beforehand.

I know none of these options is ideal, particularly when you've used the same email address for years.

But I still think it's worth spending a minute checking a sender's domain. At least you'll have a much better idea of what's happening rather than blindly changing settings in your own account.

Message you can forward to the sender's IT department:

"My Outlook/Hotmail account is rejecting emails from your domain with error AS9031519. I checked your domain using MXToolbox, and it appears that your public DMARC record is missing.

Could you please verify your email authentication settings, particularly DMARC?

Thank you!"

A missing DMARC record doesn't prove the cause in every case, but it's a useful starting point.

Answer 2

Frank's comment to the original post is actually an answer.

Possible fix for AS9031519 – simple check for anyone missing emails in Hotmail, Live or Outlook

I've experienced this exact issue and managed to resolve it.

Emails from my Microsoft 365 account to a Live address were rejected with:

550 5.7.1 Message lacks SPF/DKIM/DMARC Auth Records (AS9031519)

The interesting part was that Microsoft's own message headers reported SPF, DKIM and DMARC as passing.

However, when I checked the sender domain's public DNS, the DMARC record was actually missing.

After adding v=DMARC1; p=none, I sent another test email to the same recipient, and it was successfully delivered.

You can check this yourself, even if you're just a regular Hotmail, Live or Outlook user. No administrator access or technical knowledge is required.

Find the email address of someone whose emails aren't reaching you.
Look at the domain after the @ sign. For example, ******@company.com means the domain is company.com.
Open https://lookup.mxtoolbox.com/dmarc.aspx
Enter the sender's domain and run the check.
If it says DMARC Record Not Found, you may have identified why their emails are being rejected.

You can also check using Windows PowerShell:

Resolve-DnsName _dmarc.company.com -Type TXT -Server 1.1.1.1

Replace company.com with the sender's domain.

If no DMARC record exists, contact the sender and ask them to have their email provider or IT administrator check the domain's DMARC configuration.

Important: Even if the email headers report dmarc=pass, don't assume a public DMARC record exists. My Microsoft 365 message showed this result despite the record being missing.

This issue has also been investigated by email provider MailRoute, which reports that Microsoft started rejecting some emails from domains without DMARC on November 5, including smaller senders:

https://mailroute.net/blog/outlook-rejecting-email-without-dmarc

MailRoute also reports that the rejection is intermittent. Some emails from the same domain may get through while others bounce, so successful delivery doesn't necessarily mean the domain is correctly configured.

Microsoft appears to have introduced stricter authentication checks, although I haven't seen an official announcement confirming the change.

A missing DMARC record is not proof of the cause in every case, but it's a simple and useful first check that anyone can perform.

Hopefully this helps others identify the problem without spending unnecessary time changing settings in their own Outlook accounts.

Answer 3

EmilyS726 279.1K Independent Advisor

Microsoft does now require senders to have SPF, DKIM and dmarc set up. If it’s not set up their email can be rejected. Only the domain owner can check their records to see if these are set up. So the troubleshooting is done on their end. If they are set up correctly but their emails still can’t be accepted they need to reach out to sender support. https://olcsupport.office.com/

jlccleo 5 Reputation points

2026-11-06T20:48:15.6166667+00:00

When did this start? I just started having issues receiving emails yesterday and looking at Reddit, there are hundreds of others having the same issue also starting yesterday.
EmilyS726 279.1K Reputation points Independent Advisor

2026-11-06T21:03:19.6066667+00:00

The requirement started last year but it started out as a soft requirement, and senders also needed to reach certian volume threshold. Then it would move to hard rejection.

If this is an emerging issue, such as the potential false positive type of rejection, unfortunately, as forum helpers, we wouldn't know because I am independent and don't work for Microsoft, and I can only go by publically available resources/information.

I think it would make sense to sample a few of these senders, have them verify their SPF, DKIM and DMAC. If it is confirmed that they are set up correctly, then we can confirm a false postive rejection and they can start filling out the form I shared above to make Microsoft aware of the issue,. Without such verification, it would be all guess work.
jlccleo 5 Reputation points

2026-11-06T21:04:30.6633333+00:00

Thank you.
EmilyS726 279.1K Reputation points Independent Advisor

2026-11-06T21:07:00.7966667+00:00

You are welcome.
David Goodloe 0 Reputation points

2026-11-07T00:07:15.8966667+00:00

UPDATE:
Yes lack of a DMARC Record in public DNS for the domain was the culprit, the same emails that were rejected before are able to send okay now.

--

Microsoft states it's for domains that send over 5,000 emails a day, but our clients that are reporting this are nowhere near that. We just added their DMARC record, but their DNS Propagation is slow from Earthlink, but I'll report back if it works or not.
EmilyS726 279.1K Reputation points Independent Advisor

2026-11-07T04:39:51.99+00:00

Thanks for the update, David. So Microsoft might be rolling out a hard requirement now, or they rolled it out without announcement.

Either way, it is always best practice anyway these days to have all three configured.
David R 0 Reputation points

2026-11-08T15:00:53.31+00:00
Fixed due to missing DMARC

You can check whether the sender's domain has a DMARC record yourself. You don't need administrator access or any technical knowledge.

Here's how:

Find the email address of someone whose messages are bouncing when they try to email you.

Take the part after the @ sign. For example, if the sender is ******@company.com, the domain is company.com.

Open https://lookup.mxtoolbox.com/dmarc.aspx

Enter company.com (replace it with the actual sender's domain) and run the check.

If it says "DMARC Record Not Found", this may explain why their emails are being rejected.

If the record is missing, contact the sender and ask them to have their email provider or IT administrator configure DMARC.

Why this matters: I experienced exactly the same error (AS9031519) with my own Microsoft 365 domain. Microsoft's email headers reported spf=pass, dkim=pass and even dmarc=pass, but the public DMARC record was missing.

After adding v=DMARC1; p=none, I resent the same test email to the same Live recipient, and it was successfully delivered.

MailRoute has also documented this issue: https://mailroute.net/blog/outlook-rejecting-email-without-dmarc

Answer 4

Collect complete bounce reports from several affected senders and escalate them through Outlook.com Help → Still need help?, because multiple unrelated domains are failing but Microsoft has not listed this exact AS9031519 rejection as a confirmed Outlook.com incident.

What the error means

Your personal @outlook.com mailbox does not need DNS records that you configure. Microsoft controls SPF, DKIM, and DMARC for the outlook.com domain.
The rejection normally refers to the external sender’s domain authentication, even though the Microsoft server shown in the error performed the rejection.
Adding affected clients to Safe senders will not fix it: the message is rejected during the SMTP transaction before it reaches your mailbox.^1^

Microsoft documents that authentication failures can reject legitimate messages. For 550 5.7.1, possible causes include an incomplete SPF record, connector configuration, or destination security policy.^2^

AS9031519 is not defined in the available Microsoft documentation, so it does not by itself establish whether this is an enforcement change or a Microsoft service fault.

What to do now

Ask at least three affected clients using unrelated email providers to send you their complete non-delivery report (NDR), not just the one-line error.
Preserve these fields:
- Full SMTP response
- Sender domain and provider
- UTC timestamp
- Rejecting Microsoft server
- Message or correlation identifiers
- Any Authentication-Results details
Ask each sender to give the NDR to their email administrator or provider and request checks for:
- SPF authorizing the actual sending server
- A valid DKIM signature
- A published DMARC record
- SPF or DKIM alignment with the domain displayed in the message’s From address

If only one sender or domain fails, that sender’s provider needs to correct its authentication. If several unrelated providers fail—as reported here—submit the collected NDRs to Outlook.com Support:

Sign in to Outlook.com.
Select Help on the menu bar.
Enter the complete error text, including AS9031519.
Scroll to Still need help?
Select Yes, then attach or paste redacted NDRs from multiple unrelated senders.^3^

Microsoft’s current Outlook.com known-issues page does not identify this exact rejection signature as a confirmed incident.^3^ Therefore, the widespread pattern is valid evidence for escalation, but it is not yet confirmation of a Microsoft outage.

Conditional sender requirement

If an affected sender sends 5,000 or more messages per day to Microsoft consumer mailboxes using the same From domain, Microsoft’s high-volume sender rules apply. SPF and DKIM must both pass, DMARC must be published, and DMARC must pass through aligned SPF or DKIM.[^4^](https://support.microsoft.com/en-us/outlook/fix-ndr-error-550-5-7-515-in-outlook-com "Fix NDR error "550 5.7.515" in Outlook.com | Microsoft Support")

That threshold should not be assumed for every client; each sender’s administrator must determine whether it applies.

References

Answer 5

Deleted

This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Comments have been turned off. Learn more