550 5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records

Question

550 5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records

jlccleo 15

About 50% of my clients that have emailed me since yesterday are getting the message 550 5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records (AS9031519) [TY2PEPF0000AB8A.apcprd03.prod.outlook.com 2026-11-06T19:53:27.630Z 08DF3B738DE5D0FD].

I see others are also having this issue. Is this a Microsoft issue? I have a difficult time believing that all of my clients using different emails are all having issues with their email so it appears it is an issue with Microsoft.

Frank Lawler 0 Reputation points

2026-11-07T02:27:11.0433333+00:00
Fixed: “550 5.7.1 Message lacks SPF/DKIM/DMARC Auth Records (AS9031519)”, M365 → Hotmail/Outlook.com

Mail from my M365 tenant to Hotmail bounced with “SPF validation error” (5.7.23). That headline is misleading: my SPF and DKIM were both fine. The real problem was the detail line saying the message lacked SPF/DKIM/DMARC auth records. Even though Microsoft’s own outbound headers said dmarc=pass, MXToolbox showed I had no DMARC record. M365 never creates one.

Fix: add a TXT record at your DNS host:

Name: _dmarc

Value: v=DMARC1; p=none; rua=mailto:******@yourdomain.com

If your DNS is hosted by Microsoft, it goes under Admin center → Settings → Domains → [domain] → DNS records. Otherwise, add it wherever your DNS lives, such as GoDaddy, Cloudflare or your web host. Hotmail accepted my mail once the record showed up on MXToolbox.

Check your other domains too with dmarc: and spf: lookups on mxtoolbox.com. On a second domain I found duplicate DMARC records and an SPF syntax error, and either one breaks authentication.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

7 answers

Your answer

Frank Lawler 0 Reputation points

2026-11-07T02:27:11.0433333+00:00

Fixed: “550 5.7.1 Message lacks SPF/DKIM/DMARC Auth Records (AS9031519)”, M365 → Hotmail/Outlook.com

Mail from my M365 tenant to Hotmail bounced with “SPF validation error” (5.7.23). That headline is misleading: my SPF and DKIM were both fine. The real problem was the detail line saying the message lacked SPF/DKIM/DMARC auth records. Even though Microsoft’s own outbound headers said dmarc=pass, MXToolbox showed I had no DMARC record. M365 never creates one.

Fix: add a TXT record at your DNS host:

Name: _dmarc

Value: v=DMARC1; p=none; rua=mailto:******@yourdomain.com

If your DNS is hosted by Microsoft, it goes under Admin center → Settings → Domains → [domain] → DNS records. Otherwise, add it wherever your DNS lives, such as GoDaddy, Cloudflare or your web host. Hotmail accepted my mail once the record showed up on MXToolbox.

Check your other domains too with dmarc: and spf: lookups on mxtoolbox.com. On a second domain I found duplicate DMARC records and an SPF syntax error, and either one breaks authentication.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Answer 1

Yuki Amano 0

I saw this issue Thurday 5/11/2026 night AEST only sending to Outlook.com/.au and Hotmail.com domains.
All have valid SPF and DKIM records, domains show healthy in M365 Admin centre.

The temp fix i found was adding a _dmarc record to the domain dns records.

do we know what has changed and why this is now an issue?
It would be nice to know some more information so i can go back to my unhappy clients to why things have changed. I have looked and cannot find anything from microsoft saying there is a change coming through that i have seen, but not saying it is not there.

0 comments

Answer 2

Ryan Makepeace 0

Same issue. Multiple senders affected. Replicated it myself from a work email that uses Google Workspace.
Might finally be the reason to abandon Microsoft and Outlook permanently.

0 comments

Answer 3

M S 5

I am not managing to fix this !!

Many different people I have been in touch with over the years are not managing to send me messages.

They all report the same error message and I cant ask each of them and who knows who else is trying to send me emails to change their settings ?

Is there anything I can change on my side that will allow those emails to come through ?

Much appreciated

David R 0 Reputation points

2026-11-08T20:49:51.0066667+00:00
Unfortunately, there's probably nothing you can change in your Hotmail/Outlook settings to fix this, since Microsoft rejects these emails before they reach your mailbox.

I completely understand that you can't realistically contact every sender, especially when you don't even know who's trying to email you.

However, I would still recommend doing the simple dmarc check, just to find out whether this is likely what's causing the problem.

If the record is missing, you have a few options:

Forward the findings to the sender's IT department or email provider. I've included a simple message below that you can copy and send.

Wait and hope Microsoft relaxes these apparently stricter checks, although there's no guarantee they will.

Switch to another email provider, such as Gmail. Just keep in mind that other providers may eventually introduce similar requirements. Hopefully they'll communicate such changes more clearly beforehand.

I know none of these options is ideal, particularly when you've used the same email address for years.

But I still think it's worth spending a minute checking a sender's domain. At least you'll have a much better idea of what's happening rather than blindly changing settings in your own account.

Message you can forward to the sender's IT department:

"My Outlook/Hotmail account is rejecting emails from your domain with error AS9031519. I checked your domain using MXToolbox, and it appears that your public DMARC record is missing.

Could you please verify your email authentication settings, particularly DMARC?

Thank you!"

A missing DMARC record doesn't prove the cause in every case, but it's a useful starting point.

Answer 4

Deleted

This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Comments have been turned off. Learn more

Answer 5

Frank's comment to the original post is actually an answer.

Possible fix for AS9031519 – simple check for anyone missing emails in Hotmail, Live or Outlook

I've experienced this exact issue and managed to resolve it.

Emails from my Microsoft 365 account to a Live address were rejected with:

550 5.7.1 Message lacks SPF/DKIM/DMARC Auth Records (AS9031519)

The interesting part was that Microsoft's own message headers reported SPF, DKIM and DMARC as passing.

However, when I checked the sender domain's public DNS, the DMARC record was actually missing.

After adding v=DMARC1; p=none, I sent another test email to the same recipient, and it was successfully delivered.

You can check this yourself, even if you're just a regular Hotmail, Live or Outlook user. No administrator access or technical knowledge is required.

Find the email address of someone whose emails aren't reaching you.
Look at the domain after the @ sign. For example, ******@company.com means the domain is company.com.
Open https://lookup.mxtoolbox.com/dmarc.aspx
Enter the sender's domain and run the check.
If it says DMARC Record Not Found, you may have identified why their emails are being rejected.

You can also check using Windows PowerShell:

Resolve-DnsName _dmarc.company.com -Type TXT -Server 1.1.1.1

Replace company.com with the sender's domain.

If no DMARC record exists, contact the sender and ask them to have their email provider or IT administrator check the domain's DMARC configuration.

Important: Even if the email headers report dmarc=pass, don't assume a public DMARC record exists. My Microsoft 365 message showed this result despite the record being missing.

This issue has also been investigated by email provider MailRoute, which reports that Microsoft started rejecting some emails from domains without DMARC on November 5, including smaller senders:

https://mailroute.net/blog/outlook-rejecting-email-without-dmarc

MailRoute also reports that the rejection is intermittent. Some emails from the same domain may get through while others bounce, so successful delivery doesn't necessarily mean the domain is correctly configured.

Microsoft appears to have introduced stricter authentication checks, although I haven't seen an official announcement confirming the change.

A missing DMARC record is not proof of the cause in every case, but it's a simple and useful first check that anyone can perform.

Hopefully this helps others identify the problem without spending unnecessary time changing settings in their own Outlook accounts.

Tolle Colart 0 Reputation points

2026-11-09T09:13:19.7766667+00:00

Hi, adding v=DMARC1; p=none to a domain is just telling the receiving mailserver to ignore SPF and DKIM records. That will allow the mail to go through. That will also allow people to misuse your domain to send spam. So this is not a solution, but a temporary (dangerous) workaround.
You should set it to: "v=DMARC1; p=reject" to avoid misuse of the domain.
EmilyS_726 34,280 Reputation points Volunteer Moderator

2026-11-09T14:32:36.75+00:00

@Tolle Colart

That is not quite correct.

Setting v=DMARC1; p=none does not tell receiving mail servers to ignore SPF or DKIM. Both are still checked as usual.

The p=none policy simply means the domain owner is not requesting that receiving servers reject or quarantine emails specifically because they fail DMARC. Receiving servers can still reject emails based on their own security policies.

It is also not necessarily a dangerous workaround. Microsoft and other email providers support p=none as a legitimate DMARC monitoring policy.

While p=reject provides stronger protection against domain spoofing, it should only be implemented after verifying that all legitimate email sources have correctly configured and aligned SPF or DKIM. Otherwise, legitimate emails could be rejected.

So, perhaps p=quarantine can be the happy medium.