Emails to Outlook.com or Hotmail bouncing with a 550 error
Since about 5 November 2026, many small businesses have reported email to Outlook.com, Hotmail, Live and MSN addresses coming back with a 550 error, often with the words "Message lacks SPF/DKIM/DMARC Auth Records". Mail to other providers is usually fine. This page explains what the errors say, what is actually known, and what to check on your own domain.
Last updated
The short answer
The bounce 550 5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records reads as Outlook.com's consumer mail service refusing the message because it did not find the authentication records it expected for the sending domain. Microsoft has not documented that wording, so this is a literal reading. The most reported fix is to publish a DMARC record (at least v=DMARC1; p=none) and make sure SPF and DKIM both pass. Microsoft has not published a cause for this wave, failures are reported as intermittent, and a few senders with all three records still saw it. If the bounce headline says "SPF validation error", read the inner 5.7.1 line before touching your SPF record.
What you are probably seeing
Your sent mail returns a bounce (a non-delivery report) from a Microsoft server. Only some recipients are affected: addresses ending in outlook.com, hotmail.com, live.com or msn.com. Mail to Gmail, business Microsoft 365 mailboxes and other providers is delivered. Resending the same message sometimes works, which is why people think it has fixed itself and then it fails again.
The error codes you may see
550 5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records
The wording most small businesses are reporting from November 2026. Read literally, the receiver did not find the authentication records it wanted. Microsoft has not documented this exact wording.
550 5.7.23 (SPF violation wrapper)
Microsoft documents 5.7.23 as "The message was rejected because of Sender Policy Framework violation". In the current wave this has appeared as an outer headline with the real 5.7.1 reason inside the same bounce.
550 5.7.515 Access denied
Microsoft documents this for senders of 5,000 or more messages to its consumer services. The text is "Access denied, sending domain does not meet the required authentication level". Most small businesses do not send that much, so if you see it, read the section below.
AS9031519 at the end
Some bounces end with a suffix such as AS9031519. We have not found Microsoft documentation for it. It is not something you can fix, but quote it if you contact Microsoft's sender support.
Who this is for
- Microsoft 365, Google Workspace or cPanel email users whose messages to Outlook.com or Hotmail contacts bounce.
- Businesses whose own domain has SPF and DKIM but no DMARC record.
- Anyone who has been told to "fix your SPF" by a bounce message and has already done it.
What to check, in order
- Read the whole bounce. Find the line that begins 550 and the line inside it. Note whether it says 5.7.1, 5.7.23 or 5.7.515. Use the inner reason, not the headline.
- Look up your DMARC record. Run
nslookup -type=TXT _dmarc.yourdomain.com.au. No answer means there is no DMARC record. Add one: see What is a DMARC record?. Start with p=none. - Check there is only one SPF record. Run
nslookup -type=TXT yourdomain.com.au. You should see one line starting v=spf1 that lists every sender. See What is an SPF record?. - Check DKIM is signing as your domain. On Microsoft 365 the selector1 and selector2 CNAME records must exist and signing must be switched on in the Defender portal. See What is a DKIM record?.
- Read the headers of a message that got through. Send to an Outlook.com address you control, open the message headers and read Authentication-Results for
spf=,dkim=,dmarc=andcompauth=. If it showsdmarc=bestguesspass, Microsoft is telling you there is no DMARC record. - Then resend and watch. Because failures are reported as intermittent, send several test messages over a day or two. If a full set of passing records still bounces, send the complete bounce text to Microsoft through the Outlook.com sender support form.
How WaTo can help
- We read the full bounce, check SPF, DKIM and DMARC and the headers of a delivered test, then fix what is wrong at your DNS host. See email deliverability and business email problems.
- We tell you plainly when your records are right and the remaining problem is on Microsoft's side, so you do not pay to keep editing DNS.
- We can look after the records long term, including every service that sends as your domain.
What is confirmed, and what is only reported
Confirmed by Microsoft's own documentation.
- 5.7.23 means the message was rejected because of an SPF violation (Exchange Online non-delivery report list).
- 5.7.515 is the error for senders of 5,000 or more messages to Microsoft consumer services whose domain does not meet the authentication requirements: SPF and DKIM published, a DMARC record published, and messages passing DMARC. The Microsoft page we read does not give a start date or a per-day figure.
- In Microsoft 365 headers,
dmarc=bestguesspassmeans no DMARC record exists for the domain and the message would pass if one did.compauthis Microsoft's combined authentication result, and a failure does not always block a message. - For a custom domain in Microsoft 365, DKIM needs the selector1 and selector2 records and signing switched on in Defender, and you publish DMARC yourself at your DNS host.
Reported, not confirmed by Microsoft.
- The start of this wave around 5 November 2026, and that it affects small senders, not only bulk senders.
- That the 5.7.1 "lacks SPF/DKIM/DMARC Auth Records" rejection is tied to a missing DMARC record. Many reports say a p=none record fixed it, including for our own domain, but Microsoft has not published a cause.
- That it is intermittent: some messages from the same domain deliver and others bounce.
- That some senders with SPF, DKIM and DMARC all in place still saw it. For them, the records are not the whole answer and only Microsoft can explain it.
- That Outlook.com bulk-sender enforcement began on 5 May 2025. Secondary sources give that date. The Microsoft support page we read does not state one.
A worked example (anonymised)
A Microsoft 365 business came to us with mail to Hotmail and Outlook.com addresses bouncing. The bounce headline read "SPF validation error" and suggested adding spf.protection.outlook.com to the SPF record.
The SPF record was already correct: a single record, v=spf1 include:spf.protection.outlook.com -all. DMARC existed at p=none. Adding the include again, or rewriting SPF, would have changed nothing.
The bounce contained the 5.7.1 text about missing authentication records underneath the SPF headline. The SPF wording is a wrapper, so the useful checks are DKIM (custom-domain signing is a separate switch in Defender, and without it Microsoft signs with its default domain) and the message headers from a delivered test, not more edits to SPF.
Each case differs, and we cannot say that one change fixes all of them. Reading the inner line first saves hours of re-adding a record that was fine.
Fixing it by platform
Microsoft 365. Add a DMARC TXT record at your DNS host (Microsoft does not create it for custom domains). In the Defender portal, add the selector1 and selector2 CNAME records and enable DKIM signing. Keep one SPF record containing include:spf.protection.outlook.com.
Google Workspace. Generate the DKIM key in the Admin console, add the TXT record and click Start authentication. Keep one SPF record containing include:_spf.google.com. Add a DMARC record at your DNS host.
cPanel hosting. Open Email Deliverability, repair SPF and DKIM for the domain, then add a _dmarc TXT record in the DNS zone. Remember that invoicing and website form senders need their own entries.
Common mistakes with this error
- Re-adding SPF every time. The headline says SPF, the cause may not be.
- Two SPF records. Created while "fixing" the first one. Keep one.
- More than 10 SPF lookups. A crowded record can fail even though each part looks right.
- ~all versus -all. Changing the ending will not cure a missing-records rejection.
- DKIM not aligned. Signed by a provider's domain, not yours.
- Forwarding. A forwarded message can fail SPF. If your customer forwards to an Outlook.com address, the bounce can come from the forwarder's route and not from your domain.
- Testing once. A single delivered test does not prove a fault that comes and goes.
Outlook.com and Hotmail 550 questions
Why is my email to Hotmail or Outlook.com bouncing?
Most reports point to a sending domain with no DMARC record, or with SPF or DKIM not passing. Since about 5 November 2026 many small businesses have reported this. Microsoft has not published a cause.
What does 550 5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records mean?
The receiving service did not find the authentication records it expected for your domain. Check all three, with DMARC first if you have none.
The bounce says SPF validation error. Should I change my SPF?
Not before reading the inner 5.7.1 line. If you have one correct SPF record, re-adding the include does nothing. See the worked example above.
What is 550 5.7.515?
Microsoft's rejection for senders of 5,000 or more messages to its consumer services who do not meet its authentication requirements. It is separate from the 5.7.1 wording above.
We already have SPF, DKIM and DMARC and it still bounces. Why?
Some senders have reported this. Failures are described as intermittent, and Microsoft has not said why. Confirm the records pass in a delivered message header, then send the full bounce to Microsoft's sender support.
Is it just Outlook.com?
The reports are about Outlook.com, Hotmail, Live and MSN. Other providers, including Gmail, also expect all three records, so fixing them helps everywhere.
What does dmarc=bestguesspass mean?
Microsoft is saying your domain has no DMARC record, and the message would have passed if it did.
How WaTo can help with this
- Email deliverability & domain authentication
- Business email problems
- Google Workspace help and support
- Microsoft 365 health check
Guides on this topic
- What is a DMARC record?
- What is an SPF record?
- What is a DKIM record?
- SPF, DKIM and DMARC in plain English
- Google Workspace emails going to spam? How to fix it
Sources & references
- Microsoft Support: Fix NDR error 550 5.7.515 in Outlook.com
- Microsoft Learn: Email nondelivery reports and SMTP errors in Exchange Online
- Microsoft Learn: Anti-spam message headers
- Microsoft Learn: Use DKIM for email in your custom domain
- Microsoft Learn: Use DMARC to validate email
- Google Workspace Admin Help: Email sender guidelines
- RFC 7489: Domain-based Message Authentication, Reporting, and Conformance (DMARC)
WaTo Consulting. Last reviewed 2026-11-09. Review when Microsoft publishes an explanation or changes Outlook.com sender requirements.
Book a call
Still bouncing? Book a call and send us the full bounce message and your domain name.
Mon to Fri, 8:30am to 5pm
