EasyDMARC has a post: https://easydmarc.com/blog/microsoft-rejecting-emails-without-dmarc/
laura > On 10 Nov 2026, at 07:44, Aliaksandr Markau <[email protected]> wrote: > >> Seems they realized their mistake and stopped rejecting yesterday at >> roughly 10:30 UTC. Would be nice if Microsoft would actually make a >> statement about the whole thing though... > > They did, in Microsoft 365 Service Health rather than anywhere public: > incident EX1545193, closed this morning at 05:36 UTC. Microsoft says a > recent update to its spam enforcement rules wrongly marked and blocked > mail to Outlook.com, Hotmail.com and Live.com addresses, and that the > update has been fully rolled back. The notice gives the impact window as > 2026-11-06 18:00 UTC to 2026-11-09 11:02 UTC, so your 10:30 is close. > NDRs listed: 550 5.7.1 or 550 5.7.23, put down to an SPF violation, > with SPF spelled out as "Service Provider Foundation". > > Service Health is only visible to tenant admins, but UPenn mirrors the > notices publicly: > https://mailservices.isc.upenn.edu/computing/email/penno365/alerts/ms-incidents.html > > It matches what we saw on our own test domains: a subdomain with SPF > pass and aligned DKIM but no DMARC record at the subdomain or the org > domain was refused at all 16 Outlook.com/Hotmail seeds on Nov 7, and > the same send was accepted by all 16 at 15:09 UTC on Nov 9. While it > lasted, a record at the org domain alone, even p=none, was enough. > Details: https://dmarkoff.com/blog/outlook-rejects-mail-without-dmarc > (disclosure: I run DMARKOFF). > > -- > Aliaksandr Markau > > On Tue, Nov 10, 2026 at 11:04 AM Dan Malm via mailop <[email protected]> > wrote: >> >> On 11/9/26 14:37, Otto J. Makela wrote: >>> >>> On 07/11/2026 01.10, Jarland Donnell wrote: >>>> Just today we've seen an error that I've never seen before from Microsoft: >>>> >>>>> 550 5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records >>>>> (AS9031519) >>>> >>>> In each case, the sender domain has correct SPF and DKIM. From what we're >>>> seeing, >>>> this just seems to trigger when the sender domain doesn't have a DMARC >>>> record. >>>> So I guess DMARC is now a requirement to send mail to Microsoft, they're >>>> pulling a Google and applying it at random, or they've targeted us and our >>>> customers for it. >>> This now also seems to have been noted by media: >>> >>> https://www.theregister.com/applications/2026/11/09/outlookcom-bounces-legit-emails-as-microsofts-authentication-crackdown-goes-sideways/5308428 >>> >> >> Seems they realized their mistake and stopped rejecting yesterday at >> roughly 10:30 UTC. Would be nice if Microsoft would actually make a >> statement about the whole thing though... >> >> -- >> BR/Mvh. Dan Malm, Systems Engineer, one.com >> _______________________________________________ >> mailop mailing list -- [email protected] >> To unsubscribe send an email to [email protected] > _______________________________________________ > mailop mailing list -- [email protected] > To unsubscribe send an email to [email protected] — Demystifying “It Depends...” since 2001 Laura Atkins Word to the Wise [email protected] Delivery hints and commentary: http://www.wordtothewise.com/blog
_______________________________________________ mailop mailing list -- [email protected] To unsubscribe send an email to [email protected]
