Since late last week, mail to Outlook.com, Hotmail and Live addresses has bounced with 550 5.7.23 and 550 5.7.1 errors citing SPF or missing DMARC, including from small senders. Microsoft calls it a service degradation under investigation. What to check on your domain and what to do while Microsoft works on it.
If your company emails customers or partners with Outlook.com, Hotmail or Live addresses, check your domain’s email authentication today. Since the end of last week, Outlook.com has rejected legitimate messages with errors that blame SPF or a missing DMARC record, and Microsoft says it is investigating.
What Microsoft has confirmed
A Microsoft moderator on its Q&A support forum wrote that some senders cannot deliver to Outlook.com, Hotmail.com and Live.com addresses. Affected senders get non-delivery reports citing 550 5.7.1 or 550 5.7.23 errors tied to SPF validation failures. Microsoft classifies the advisory as a service degradation and says its engineers are analyzing telemetry and customer data to find the cause.
Bounce messages posted in the thread read “The message was rejected because of Sender Policy Framework violation” and “Message lacks SPF/DKIM/DMARC Auth Records.”
The Register reported that small senders are hit too, with some single one-line messages rejected. The rejections look intermittent, and a resend sometimes goes through. Microsoft had not published a customer advisory explaining any rule change, and had not answered The Register’s questions by publication.
Why small senders are getting caught
In 2025, Microsoft announced rules for senders of more than 5,000 messages a day to Outlook.com consumer addresses: SPF must pass, DKIM must pass, and DMARC must exist with at least p=none and align with SPF or DKIM. The current bounces look like those checks applied to smaller domains, or applied badly. Microsoft has not said which.
Our read: you cannot fix Microsoft’s bug, but you can remove every reason a working filter has to reject you. Many senders on the forum said mail started flowing once their records matched Microsoft’s requirements. Others said their records were already correct, which is why Microsoft calls it a degradation.
What to check on your domain
- SPF. Your domain needs exactly one TXT record starting
v=spf1. It must list every service that sends as your domain: Google Workspace or Microsoft 365, your newsletter tool, your CRM, your billing system. Two SPF records, or more than 10 DNS lookups inside one, makes SPF fail. - DKIM. Turn on DKIM signing in each sending service and publish the keys it gives you. In Google Workspace it sits under Apps, Gmail, Authenticate email.
- DMARC. Publish a TXT record at
_dmarc.yourdomain.com. If you have none, start withv=DMARC1; p=none; rua=mailto:you@yourdomain.comso you get reports without blocking your own mail. - Test it. Send a message to a Gmail address, open “Show original” and confirm SPF, DKIM and DMARC all say PASS.
If a message still bounces
Save the full non-delivery report, including the 550 code. Resend once, since some messages get through on a second try. For anything time-sensitive, such as an invoice or a contract, reach the person another way and tell them the message may be held. If your records pass and the bounces continue, add your details to Microsoft’s forum thread so its engineers see your domain.