Microsoft Mail Filters Are Rejecting Legitimate Business Email Since Nov. 5

Microsoft's consumer mail servers have bounced legitimate business email since November 5, rejecting messages from senders without DMARC records and issuing no advance notice. Microsoft has published no postmaster notice, no service-health entry, and no blog post on the change. A Microsoft external staff moderator called it a "service degradation" under active investigation.

The refusals hit Outlook, Hotmail, Live, and MSN addresses. Senders receive Non-Delivery Reports (NDRs) citing 550 5.7.1 or 550 5.7.23 errors, but the failures are inconsistent: some messages from the same sender get through while others bounce.

What changed on November 5?

Microsoft has required DMARC (Domain-based Message Authentication, Reporting and Conformance) since May 2025, but only from domains sending more than 5,000 messages a day to consumer mailboxes. As of November 5, mail from small, ordinary senders started bouncing for missing DMARC, SPF (Sender Policy Framework), or DKIM (DomainKeys Identified Mail).

One user reported on Microsoft's community forum: "Your message to @hotmail.com couldn't be delivered. hotmail.com couldn't confirm that your message was sent from a trusted location." Another wrote: "Some emails work fine and others return errors with SPF failed."

The errors point at the wrong problem. Some bounced domains reportedly carried working SPF, DKIM, and DMARC records. Frank Dickson of Dickson Research said both a policy change and a bug may be in play.

"Requiring every sending domain to prove it is who it says it is makes email safer," Dickson said. "Doing it without notice, with an error message that points at the wrong problem, makes a mess."

How can enterprises check and fix their domains?

Email security company MailRoute published a terminal check: run dig +short TXT _dmarc.example.com with the enterprise's domain. A response starting with v=DMARC1 means a DMARC record exists; no reply means none does.

The immediate fix is a single TXT record: v=DMARC1; p=none. This declares the domain uses DMARC and asks receivers to send reports while taking no action on failures. Dickson advised Microsoft 365 customers who never enabled DKIM on their own domains to do it now.

"Do not rewrite SPF just because the bounce blames it," he said. If records are clean and mail still bounces, send the full bounce to Microsoft so it enters the investigation.

Why does quiet failure threaten business operations?

DMARC builds on SPF, which verifies the sending server's IP address may send for a domain, and DKIM, which adds a cryptographic signature proving the message was not altered. DMARC ties those checks to the visible From address and tells receivers what to do with forgeries.

"Without it, impersonating your domain is easy," Dickson said. "That is where a lot of phishing and business email compromise starts."

The failure mode is quiet, which MailRoute called the core danger. The sender sees a bounce "full of acronyms, assumes a glitch, and moves on." The customer never knows a message was sent. When invoices, password resets, appointment confirmations, and offer letters go missing, customers think they are being ignored.

Dickson said the failures are findable. Every rejection generated a logged bounce. Enterprises should search mail logs, bounce reports, and help desk tickets for "Message lacks SPF/DKIM/DMARC" entries since November 5, then resend time-sensitive transactional mail first.

Who is most exposed?

Small and midsize businesses, nonprofits, schools, and professional practices — law firms, accountants, doctors' offices — run domains that "someone set up years ago, and nobody has touched since," Dickson noted. Larger organizations miss DMARC on secondary domains, regional domains, and subdomains used by marketing and billing platforms.

Dickson advised inventorying every service that sends email as the enterprise: the CRM, billing system, HR platform, and marketing tools. "Most organizations cannot produce that list," he said. "You cannot protect a domain when you do not know who is speaking for it."

A p=none record is "first base, not home plate," he said. The target is p=reject, which tells receivers to refuse anyone forging the domain.

Is mandatory DMARC the destination?

Dickson said the enforcement direction is certain. Google and Yahoo required DMARC of bulk senders in February 2024; Microsoft followed in May 2025. "Requirements start with the big senders and then become the floor for everyone," he said. "The rollout was botched, but the destination is not in doubt." His closing judgment: "Nobody should learn about a new rule from a bounce message."