can no longer send email with Outlook.

Robert Germano 20 Reputation points
2026-11-07T02:31:23.0166667+00:00

It was working on Wednesday for sure. I get a failure back that says Message lacks SPF/DKIM/DMARC Auth Records.

Outlook | Windows | Classic Outlook for Windows | For home
0 comments
Answer accepted by question author
EmilyS726 278.4K Reputation points Independent Advisor
2026-11-07T03:07:57.6333333+00:00

Hello,

I've been seeing a sudden increase in reports from other users experiencing this same issue. I suspect this may be an emerging issue on Microsoft's side, although I haven't seen any official confirmation yet.

However, please make sure your SPF, DKIM, and DMARC records are correctly configured.

If they are already configured correctly, but your emails are still being rejected when sending to Outlook.com or Hotmail.com users, I recommend submitting a report through Microsoft's sender support form. This will help bring the issue to Microsoft's attention.

https://go.microsoft.com/fwlink/?LinkID=614866

Was this answer helpful?

1 person found this answer helpful.
0 comments
Answer accepted by question author

AI answer

2026-11-07T02:32:13.3866667+00:00

The sending domain’s administrator or email provider must correct its SPF, DKIM, and DMARC configuration; repairing or reinstalling Classic Outlook will not resolve this rejection.

A bounce stating “Message lacks SPF/DKIM/DMARC Auth Records” means Outlook successfully submitted the message, but the receiving mail system rejected it because it could not authenticate the sender’s domain. Missing records, an unauthorized sending service, domain misalignment, or a message modified by an intermediary can produce this result.^1^

If you use a custom email domain

For an address such as [Email], send the complete non-delivery report (NDR) to whoever administers the domain or hosts its email. They should:

  1. Check the exact NDR code and authentication results.
    • Look for results such as spf=none/fail, dkim=none/fail, and dmarc=fail.
    • Verify that the visible From domain matches, or “aligns” with, the domain authenticated by SPF or DKIM.
  2. Correct SPF in the domain’s DNS.
    • There must be one SPF TXT record authorizing every legitimate sending service.
    • Common failures include multiple SPF records, omitted third-party senders, and exceeding the ten-DNS-lookup limit.^1^
  3. Enable DKIM signing.
    • Publish the DKIM records supplied by the mail provider and enable signing.
    • A dkim=none result indicates that the message was not signed; dkim=fail can indicate a missing selector, mismatched key, or message modification after signing.
  4. Publish a valid DMARC TXT record at _dmarc.yourdomain.com.
    • DMARC must use a valid policy such as p=none, p=quarantine, or p=reject.
    • DMARC passes when aligned SPF or aligned DKIM passes; both do not need to provide alignment.^2^
  5. Check every third-party sender. If a website, CRM, newsletter service, scanner, or relay sends using your domain, it must be included in SPF or DKIM-sign with your domain. Forwarders and gateways that alter messages can also break authentication.^1^

Do not replace an existing SPF record with a guessed value. The correct record depends on every service authorized to send for the domain.

If the NDR code is 550 5.7.515

This specific code applies when a domain sends at least 5,000 messages to Microsoft consumer services using the same From domain. Microsoft then requires:

The domain administrator must also verify any external sending platform is authorized in SPF and configured to DKIM-sign using the custom domain.

If this is a personal address

If the From address ends in @outlook.com, @hotmail.com, @live.com, or @msn.com, there are no personal DNS records for you to edit. Try sending the same short, attachment-free message from Outlook on the web:

  • Webmail also returns the same authentication bounce: contact Outlook support using Help (?) → Contact Support and provide the complete NDR, including its numeric code and timestamp.
  • Webmail succeeds but Classic Outlook fails without generating an NDR: that is a separate client-side issue. Classic Outlook troubleshooting—connection status, Safe Mode, profile repair, and Office repair—then becomes relevant.^4^

If only messages to one organization or to Outlook.com/Hotmail recipients fail, the same NDR still needs to be investigated by the sending-domain administrator; the recipient cannot add authentication records for your domain.

References

  1. Troubleshoot email authentication in Microsoft 365
  2. Set up DMARC to validate email in Microsoft 365 - Microsoft Defender ...
  3. Fix NDR error "550 5.7.515" in Outlook.com | Microsoft Support
  4. [Classic Outlook](https://support.microsoft.com/outlook/i-can-t-send-or-receive-messages-in-outlook#make-sure-you're-connected-to-the-internet)
AI-generated content may be incorrect. Read our transparency notes for more information.

Was this answer helpful?

1 person found this answer helpful.

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Robert Germano 20 Reputation points
    2026-11-07T21:49:45.2333333+00:00

    Some background might help anybody else having this issue:

    I have a domain hosted by GoDaddy. The MX and SPF records were created 6 - 8 years ago and this has worked without any issues. We are using Microsoft Family 365 with our email accounts (containing our domain) created in Hotmail/Outlook.live.com.

    On Friday, 11/6/26, we could no longer send emails to anyone in our domain.

    The reason I tried to get the answer from Microsoft is that MS was sending the email from the sender as well as rejecting it from the recipient.

    I tried getting the info to create the SPF, DKIM, and DMARC settings from Microsoft to add to my GoDaddy DNS but I just got a lot of explanation about the settings without the info I needed to actually create them.

    This morning I logged in to GoDaddy and was going to purchase an email package from them. Right before I checked out, I decided to call them. A recording verified my account and told me I had to speak with a Digital Assistant to try and resolve my issue before I could speak to a real person.

    The Digital Assistant asked me 2 questions.

    1. What is the issue? (can't send email)
    2. Are you using Microsoft 365? (Microsoft Family 365 with Hotmail/Outlook Live accounts)

    He said your SPF record is incorrect and you are missing the DKIM and DMARC records (This I knew)

    Then he asked if I wanted him to fix them for me.

    Well, of course!

    It took 90 minutes to propagate and everything is working.

    I want to thank EmilyS726 for responding so quickly. I don't use the Communities much.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.