how can i fix this

Question

how can i fix this

Ron Zold 0

When sending emails to anyone with hot mail the email bounces back as undeliverable. I have tried 21 different email addresses.

0 comments

2 answers

Your answer

Answer 1

Hello,

I've been seeing a sudden increase in reports from other users experiencing this same issue. I suspect this may be an emerging issue on Microsoft's side, although I haven't seen any official confirmation yet.

However, please make sure your SPF, DKIM, and DMARC records are correctly configured.

If they are already configured correctly, but your emails are still being rejected when sending to Outlook.com or Hotmail.com users, I recommend submitting a report through Microsoft's sender support form. This will help bring the issue to Microsoft's attention.

https://go.microsoft.com/fwlink/?LinkID=614866

Answer 2

Correct the SPF TXT record for your custom domain at its DNS provider so it authorizes Microsoft 365 through include:spf.protection.outlook.com.

Correct the SPF record

Sign in to the service that hosts your domain’s DNS records—typically the domain registrar or DNS hosting provider. SPF cannot be changed in the Microsoft 365 admin portals.^1^
Locate the TXT records for the root domain, usually shown as @.
Ensure the domain has only one TXT record beginning with v=spf1. Multiple SPF records cause validation problems.
If Microsoft 365 is the only system sending mail for the domain, set the record to:
```
   v=spf1 include:spf.protection.outlook.com -all
```
If an SPF record already authorizes other legitimate senders—such as a website, CRM, newsletter service, or on-premises mail server—edit and merge it rather than creating another record. For example:
```
   v=spf1 ip4:[IP Address] include:spf.protection.outlook.com include:mail-provider.example -all
```
Keep only sources that actually send mail using your domain. Microsoft documents adding the Microsoft 365 value to the existing record rather than publishing a second SPF record.^2^
Check the syntax carefully. These common variants are invalid:
- include:spf.protection.outlook.com. — unwanted trailing period
- include=spf.protection.outlook.com — must use a colon
- include: spf.protection.outlook.com — unwanted space after the colon

Verify the published record

After saving the DNS change, run this from Windows Command Prompt, replacing the example domain:

nslookup -q=TXT example.com

The result should show one SPF record containing:

include:spf.protection.outlook.com

DNS caching means the old record can remain visible until its configured TTL expires. Test sending to Outlook.com or Hotmail again only after the corrected value appears in the DNS query.

If mail uses other outbound systems

If some messages are sent through an on-premises server or another service, that sender must also be represented in the same SPF record by its documented include: value or public ip4:/ip6: address. Do not replace Microsoft 365’s include with fixed Microsoft IP addresses; Microsoft advises against flattening include:spf.protection.outlook.com because its sending infrastructure uses changing addresses.^1^

If the published record is correct but delivery still fails, have a Microsoft 365 administrator open Exchange admin center → Mail flow → Message trace, trace a new failed message, and inspect its delivery details. If the trace still reports SPF failure after DNS has updated, open a support request through Microsoft 365 admin center → Support → Help & support and provide the redacted bounce diagnostics and trace result.^3^

References