550 5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records

jlccleo 15

About 50% of my clients that have emailed me since yesterday are getting the message 550 5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records (AS9031519) [TY2PEPF0000AB8A.apcprd03.prod.outlook.com 2026-11-06T19:53:27.630Z 08DF3B738DE5D0FD].

I see others are also having this issue. Is this a Microsoft issue? I have a difficult time believing that all of my clients using different emails are all having issues with their email so it appears it is an issue with Microsoft.

Frank Lawler 0 Reputation points

2026-11-07T02:27:11.0433333+00:00
Fixed: “550 5.7.1 Message lacks SPF/DKIM/DMARC Auth Records (AS9031519)”, M365 → Hotmail/Outlook.com

Mail from my M365 tenant to Hotmail bounced with “SPF validation error” (5.7.23). That headline is misleading: my SPF and DKIM were both fine. The real problem was the detail line saying the message lacked SPF/DKIM/DMARC auth records. Even though Microsoft’s own outbound headers said dmarc=pass, MXToolbox showed I had no DMARC record. M365 never creates one.

Fix: add a TXT record at your DNS host:

Name: _dmarc

Value: v=DMARC1; p=none; rua=mailto:******@yourdomain.com

If your DNS is hosted by Microsoft, it goes under Admin center → Settings → Domains → [domain] → DNS records. Otherwise, add it wherever your DNS lives, such as GoDaddy, Cloudflare or your web host. Hotmail accepted my mail once the record showed up on MXToolbox.

Check your other domains too with dmarc: and spf: lookups on mxtoolbox.com. On a second domain I found duplicate DMARC records and an SPF syntax error, and either one breaks authentication.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

7 answers

Yuki Amano 0 Reputation points

2026-11-09T02:56:29.5533333+00:00

I saw this issue Thurday 5/11/2026 night AEST only sending to Outlook.com/.au and Hotmail.com domains.
All have valid SPF and DKIM records, domains show healthy in M365 Admin centre.

The temp fix i found was adding a _dmarc record to the domain dns records.

do we know what has changed and why this is now an issue?
It would be nice to know some more information so i can go back to my unhappy clients to why things have changed. I have looked and cannot find anything from microsoft saying there is a change coming through that i have seen, but not saying it is not there.
Was this answer helpful?

1 person found this answer helpful.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Deleted

This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Comments have been turned off. Learn more

550 5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records

7 answers

Your answer