Since late last week, Outlook.com has been rejecting legitimate emails due to an error in SPF and DMARC validation. Microsoft has confirmed the outage and identified a recent change to its spam enforcement rules as the cause. The problem appears to affect small senders as well and does not occur with every send attempt.
The problem began late last week. Users on Reddit and the Outlook forum, among other places, report that their messages are being bounced with error codes indicating a failed SPF (Sender Policy Framework) validation. Others are receiving error messages stating that DMARC (Domain-based Message Authentication, Reporting, and Conformance) information is supposedly missing. The outage affects Microsoft’s consumer services. If Outlook.com determines that a domain lacks a working SPF or a DMARC record, the service treats the sender as suspicious and rejects the email.
Cause lies in spam enforcement
Microsoft confirms that this is an outage. According to the company, a recent change to its spam enforcement rules caused messages to be wrongly flagged and blocked. Microsoft says it will review its update procedures. The company has not told customers exactly which rules were changed. The incident is logged under number EX1545193.
A moderator on Microsoft’s support forum has acknowledged the problem and classified it as a service degradation. According to the moderator, the engineering teams are investigating the cause using telemetry data from the service and data supplied by customers.
Small senders also affected
The authentication rules are intended to combat spam and bulk mailing. In 2025, Microsoft announced requirements for domains sending more than 5,000 emails per day. In addition to SPF and DMARC, DKIM (DomainKeys Identified Mail) is also mandatory for these senders. The current problems appear to affect senders with much smaller volumes as well. Users on the Outlook forum report that even a one-line message can be rejected.
Some of the affected customers say their DMARC, SPF and DKIM settings are configured correctly. Many others report that their email was delivered again after they aligned their settings with Microsoft’s requirements. SPF must pass for the sending domain, meaning the DNS record must correctly list the permitted IP addresses or hosts. DKIM must pass so that the integrity and authenticity of the message can be validated. DMARC must be set to at least p=none and align with SPF or DKIM, preferably both.
Error does not occur consistently
The problem does not arise with every send attempt. A message that was initially rejected may still be delivered on a subsequent attempt. In addition, the error message for a rejected message often gives little clarity about the cause. This makes it difficult to determine whether a rejection stems from an error in one’s own configuration or from the outage on Microsoft’s side.
For IT service providers, it therefore makes sense to check SPF, DKIM and DMARC on client domains, even if those domains remain well below the threshold of 5,000 messages per day. If clients with a correct configuration still receive bounce messages from Outlook.com, you can refer to the incident number when contacting Microsoft.
This article was originally published in Dutch on MSP Business. Read the original →
