Email server rejecting emails

The administrator of each rejected sender domain must correct its SPF, DKIM, and DMARC authentication; there is no SPF/DKIM/DMARC setting to change on a personal Outlook.com mailbox.^1^

What to do

1. Send the complete bounce message to the affected sender.
   • Ask them to forward it to whoever manages their email service or domain DNS.
   • Include the full message headers if available, not only the displayed error.
2. Ask that administrator to check the sending domain’s authentication:
   • SPF: The actual sending service or IP address must be authorized. There must be only one SPF record for the domain.
   • DKIM: Outgoing messages must be signed, and the corresponding DNS key must exist.
   • DMARC: A valid DMARC record must exist, and either SPF or DKIM must pass while aligning with the domain shown in the message’s From address.
   • If Gmail or another third-party platform sends on behalf of the custom domain, that service must be included in SPF or configured to DKIM-sign using the custom domain.
   Microsoft lists incomplete SPF, connector configuration, and destination security policies among the common reasons for a 550 5.7.1 rejection.^2^
3. Retest after the sender corrects the records.
   • The expected result is that SPF or DKIM passes with DMARC alignment and Outlook.com accepts the message.
   • DNS changes may require time to propagate according to the sender’s DNS provider.

Adding the address under Outlook.com → Settings → Mail → Junk email → Safe senders and domains is unlikely to fix this error. The message is being rejected during server processing before it reaches your mailbox.^1^

If several unrelated domains are affected

If independently managed domains are all receiving the same AS9031519 rejection—particularly after their administrators confirm that SPF, DKIM, and DMARC pass—report it to Outlook.com Support:

1. Sign in to Outlook.com.
2. Select Help.
3. Choose Still need help?
4. Provide:
   • The complete non-delivery reports.
   • The sending domains and approximate timestamps.
   • The Outlook.com recipient address.
   • Confirmation from each sender’s administrator that authentication passes.

This escalation is appropriate when the problem is not limited to one sending domain.^1^

Do not publish or modify DNS records for outlook.com; Microsoft owns and manages that domain’s authentication records. If your address instead uses a custom domain that you own, its DNS and mail-routing configuration would need separate review.

References

1. Incoming emails being blocked due to lack of SPF/DKIM/DMARC records on my @outlook.com account - Microsoft Q&A
2. Troubleshoot email authentication in Microsoft 365