Outlook is quietly bouncing your email. The fix is one DNS line
Since 5 November 2026, some of the email your company sends to Outlook, Hotmail, Live and MSN addresses has been bouncing, and nobody told you. Microsoft's consumer mail service has started refusing part of the mail from domains that don't publish a DMARC record, according to MailRoute, an email security company that spotted the bounces in its own logs.
The fix takes five minutes. Not knowing about it can cost you a quote, an invoice or a client who thinks you ignored them.
The short version
- Outlook.com now rejects part of the mail from domains without a DMARC record, including small senders, not just bulk marketers.
- Only some messages bounce, so "my email works" is not proof that your domain is fine.
- One DNS line, `v=DMARC1; p=none`, is the starting fix, as long as SPF or DKIM already works for your domain.
The bounce nobody reads
The bounce looks like this: 550 5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records. To a salesperson, that is a wall of acronyms. They assume a glitch, maybe resend, and move on.
The dangerous part is that Microsoft refuses only some of the mail. One message to a Hotmail address goes through, the next one bounces, a resend may work. MailRoute says the domains it saw rejected mostly had working SPF, and many had DKIM too. What they lacked was the DMARC record that ties those checks to the address in the "From" line.
As of 6 November, MailRoute says Microsoft had published nothing about the change: no notice, no blog post. The rule Microsoft did announce, in May 2025, only covers domains sending more than 5,000 messages a day. This one reaches the small office sending a one-line reply.
What it costs a small business
Here is an illustrative month. Your sales team sends 300 quotes and follow-ups. Say a fifth of your customers use Outlook or Hotmail addresses: that is 60 emails. If a quarter of those bounce, 15 quotes never arrive.
Nobody on your side notices, because the bounces are buried in a mailbox nobody reads. On the client's side, it looks like you never answered. Some of them simply call your competitor.
The same applies to invoices, appointment confirmations and password emails. Anything you send to personal addresses is exposed.
Check your domain in one minute
From any terminal, replace example.com with your domain:
`dig +short TXT _dmarc.example.com`
If a line starting with `v=DMARC1` comes back, you have a record. If nothing comes back, you are in the group this rejection targets. Online DMARC checkers give the same answer if you don't use a terminal.
The fix, and the catch
At your DNS provider, add a TXT record named `_dmarc` with the value `v=DMARC1; p=none`. "p=none" tells receivers your domain uses DMARC and asks them for reports, without asking them to block anything. Nothing changes for how Gmail or others treat your mail.
The catch: DMARC only passes when SPF or DKIM passes for the same domain as your From address. If you send through Microsoft 365, it signs with its own onmicrosoft.com domain until you switch on DKIM for your own domain, and that signature doesn't count. Check all three records, not just the new one.
Once reports come in and everything aligns, you can tighten the policy step by step. Spoofed email is how a lot of phishing starts, so this protects your clients too.
Email that arrives is only half the job
Fixing DMARC gets your messages delivered. Making sure every quote gets a follow-up is the other half. Holol-CRM keeps your sales pipeline in one place and automates customer follow-ups, so a lead that went quiet shows up as a task instead of disappearing in a mailbox.
The floor just moved
Mailbox providers start with bulk senders, then quietly make the same rules everyone's baseline. DMARC is no longer a best practice for big companies. It is the minimum for anyone who sends an invoice.