> Seems they realized their mistake and stopped rejecting yesterday at > roughly 10:30 UTC. Would be nice if Microsoft would actually make a > statement about the whole thing though...
They did, in Microsoft 365 Service Health rather than anywhere public: incident EX1545193, closed this morning at 05:36 UTC. Microsoft says a recent update to its spam enforcement rules wrongly marked and blocked mail to Outlook.com, Hotmail.com and Live.com addresses, and that the update has been fully rolled back. The notice gives the impact window as 2026-11-06 18:00 UTC to 2026-11-09 11:02 UTC, so your 10:30 is close. NDRs listed: 550 5.7.1 or 550 5.7.23, put down to an SPF violation, with SPF spelled out as "Service Provider Foundation". Service Health is only visible to tenant admins, but UPenn mirrors the notices publicly: https://mailservices.isc.upenn.edu/computing/email/penno365/alerts/ms-incidents.html It matches what we saw on our own test domains: a subdomain with SPF pass and aligned DKIM but no DMARC record at the subdomain or the org domain was refused at all 16 Outlook.com/Hotmail seeds on Nov 7, and the same send was accepted by all 16 at 15:09 UTC on Nov 9. While it lasted, a record at the org domain alone, even p=none, was enough. Details: https://dmarkoff.com/blog/outlook-rejects-mail-without-dmarc (disclosure: I run DMARKOFF). -- Aliaksandr Markau On Tue, Nov 10, 2026 at 11:04 AM Dan Malm via mailop <[email protected]> wrote: > > On 11/9/26 14:37, Otto J. Makela wrote: > > > > On 07/11/2026 01.10, Jarland Donnell wrote: > >> Just today we've seen an error that I've never seen before from Microsoft: > >> > >>> 550 5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records > >>> (AS9031519) > >> > >> In each case, the sender domain has correct SPF and DKIM. From what we're > >> seeing, > >> this just seems to trigger when the sender domain doesn't have a DMARC > >> record. > >> So I guess DMARC is now a requirement to send mail to Microsoft, they're > >> pulling a Google and applying it at random, or they've targeted us and our > >> customers for it. > > This now also seems to have been noted by media: > > > > https://www.theregister.com/applications/2026/11/09/outlookcom-bounces-legit-emails-as-microsofts-authentication-crackdown-goes-sideways/5308428 > > > > Seems they realized their mistake and stopped rejecting yesterday at > roughly 10:30 UTC. Would be nice if Microsoft would actually make a > statement about the whole thing though... > > -- > BR/Mvh. Dan Malm, Systems Engineer, one.com > _______________________________________________ > mailop mailing list -- [email protected] > To unsubscribe send an email to [email protected] _______________________________________________ mailop mailing list -- [email protected] To unsubscribe send an email to [email protected]
