Email server rejecting emails

Question

Email server rejecting emails

Charlie Leonard 0

My email address is now blocking emails.

Can you assist please.

It seems to be from gmail accounts that are registered domains.

Below is the bounce back message from my other email account:

The response from the remote server was:

550 5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records (AS9031519) [DU2PEPF00028D13.eurprd03.prod.outlook.com 2026-11-08T00:44:13.381Z 08DF3BE734D8C797]

0 comments

2 answers

Your answer

Answer 1

Charlie,

This is server-level block, not mail-box level block, so unfortunately it cannot be fixed on your end.

Starting on Friday, Microsoft seemed to suddenly require SPF, DKIM and DMARC to be set up by all custom domain senders, without any official announcement, because typically Microsoft only rejected the high-volume senders (5000 emails/day). So we were all left in the dark about what happened. But if senders set up these records, it should work within a day.

As of this morning, I chatted with another user who heard back from a support case she opened, and was told Microsoft is now aware of this sudden change and is hoping to fix it within the next few days. That said, if your senders set up those records, it can still work before Microsoft reverses their threshold requirement.

Answer 2

The administrator of each rejected sender domain must correct its SPF, DKIM, and DMARC authentication; there is no SPF/DKIM/DMARC setting to change on a personal Outlook.com mailbox.^1^

What to do

Send the complete bounce message to the affected sender.
- Ask them to forward it to whoever manages their email service or domain DNS.
- Include the full message headers if available, not only the displayed error.
Ask that administrator to check the sending domain’s authentication:
- SPF: The actual sending service or IP address must be authorized. There must be only one SPF record for the domain.
- DKIM: Outgoing messages must be signed, and the corresponding DNS key must exist.
- DMARC: A valid DMARC record must exist, and either SPF or DKIM must pass while aligning with the domain shown in the message’s From address.
- If Gmail or another third-party platform sends on behalf of the custom domain, that service must be included in SPF or configured to DKIM-sign using the custom domain.
Microsoft lists incomplete SPF, connector configuration, and destination security policies among the common reasons for a 550 5.7.1 rejection.^2^
Retest after the sender corrects the records.
- The expected result is that SPF or DKIM passes with DMARC alignment and Outlook.com accepts the message.
- DNS changes may require time to propagate according to the sender’s DNS provider.

Adding the address under Outlook.com → Settings → Mail → Junk email → Safe senders and domains is unlikely to fix this error. The message is being rejected during server processing before it reaches your mailbox.^1^

If several unrelated domains are affected

If independently managed domains are all receiving the same AS9031519 rejection—particularly after their administrators confirm that SPF, DKIM, and DMARC pass—report it to Outlook.com Support:

Sign in to Outlook.com.
Select Help.
Choose Still need help?
Provide:
- The complete non-delivery reports.
- The sending domains and approximate timestamps.
- The Outlook.com recipient address.
- Confirmation from each sender’s administrator that authentication passes.

This escalation is appropriate when the problem is not limited to one sending domain.^1^

Do not publish or modify DNS records for outlook.com; Microsoft owns and manages that domain’s authentication records. If your address instead uses a custom domain that you own, its DNS and mail-routing configuration would need separate review.

References