Outlook.com 550 5.7.515 and 550 5.7.1: add a DMARC record to stop Hotmail bounces

Mail sent to Outlook.com, Hotmail, Live and MSN addresses can bounce with an error that says the sender is missing authentication records. Microsoft has a published rule for high-volume senders (SPF, DKIM and a DMARC record), and on 6 November an email-security vendor reported that a vaguer 550 5.7.1 bounce has started hitting some domains with no DMARC record at all, including low-volume senders. Microsoft's rule is documented; the new, wider bounce is so far reported by one vendor only. This guide separates the two and shows how to check and fix your domain.

Key points

• Microsoft's documented rule applies to a domain that sends 5,000 or more messages to its consumer email services (Outlook.com, Hotmail, Live.com, MSN); such mail must pass SPF and DKIM and have a DMARC record of at least p=none that aligns with SPF or DKIM.
• The documented bounce is "550 5.7.515 Access denied, sending domain [domain] does not meet the required authentication level."
• On 6 November 2026 the email-relay vendor MailRoute wrote that since 5 November it has seen "550 5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records" for some domains with no DMARC record, and that Microsoft had published no notice about it at that time.
• The fix for both is the same: publish SPF and DKIM for the domain you send from, and add a DMARC TXT record at _dmarc.yourdomain.
• We could not confirm the 550 5.7.1 behaviour from Microsoft or a second independent source, so treat it as an unconfirmed report.

What to do

1. Read the bounce. If the non-delivery report says 5.7.515, you are under Microsoft's documented rule. If it says "550 5.7.1 ... lacks SPF/DKIM/DMARC Auth Records", it matches the text MailRoute reported. Either way, the domain in the visible From address (Microsoft calls it the 5322.From domain) is the one being judged.
2. Check what you publish. Look up the DMARC record with dig +short TXT _dmarc.example.com (replace example.com with your domain). No output means no record.
3. Add a DMARC record. Microsoft's support article gives v=DMARC1; p=none as the example value for a TXT record at the _dmarc host. p=none only asks receivers to report; it does not tell them to block your mail. Add a reporting address (rua=mailto:...) if you want to see who sends mail as your domain.
4. Make sure SPF or DKIM aligns. DMARC passes only if SPF or DKIM passes and its domain matches the From domain. A DMARC record alone will not help if neither lines up, which is common when a newsletter tool or CRM sends on your behalf under its own domain.
5. Check third-party senders. Microsoft's checklist: the sending service must use your domain in the From address, sign with DKIM for your domain, and be included in your SPF record.
6. Send a test to an Outlook.com address and read the message headers for SPF, DKIM and DMARC results.

If you only use a personal address at a provider such as Yahoo or Gmail, you cannot edit the domain's DNS yourself, so the provider has to fix it. A Microsoft Q&A thread from August 2025 shows that situation, but its answers come from a community member, not from Microsoft, so we cannot present them as policy.

What happened

Microsoft announced new requirements for high-volume senders to its consumer mail services in a Tech Community post. The post set the threshold at more than 5,000 emails a day. It says SPF must pass for the sending domain, DKIM must pass, and DMARC must be "at least p=none" and align with SPF or DKIM, preferably both. It said the change was "taking effect on May 5th as originally stated", that non-compliant mail would go to the Junk folder first, and that rejection would follow on a date "to be announced". It also said the Safe Senders list would not bypass enforcement.

The support article that explains the 5.7.515 bounce states the requirement without an enforcement date. Its threshold wording is slightly different: 5,000 or more messages to Microsoft consumer services, all using the same From domain.

Separately, MailRoute's founder published a blog post on 6 November 2026. It says that since 5 November Outlook.com, Hotmail, Live and MSN have refused some mail from domains without a DMARC record with the 550 5.7.1 text above; that on the first day the same message appeared without an "(AS9031519)" code; that only some messages bounce and a resend may succeed; and that the affected domains included low-volume senders. It also notes the error does not say which of SPF, DKIM or DMARC failed, unlike the 5.7.515 bounce. The post describes what MailRoute saw in its own logs and what other administrators reported on the same day, and links no Microsoft statement on the November change.

Background

Email authentication has three parts. SPF lists the servers allowed to send for a domain. DKIM adds a cryptographic signature to the message. DMARC ties the two to the visible From address and tells receivers what to do when a check fails: none (just report), quarantine or reject.

Microsoft's Exchange team has said for some time that Outlook.com honours the sender's DMARC policy: mail that fails DMARC where the sender published p=reject or p=quarantine is rejected. The high-volume rule added something different: a requirement that large senders publish DMARC at all, and that their mail pass it. Microsoft's Exchange team blog also warns that using Microsoft 365 for bulk mail is "not a supported use of the service", and suggests a dedicated subdomain with SPF, DKIM and DMARC configured for it when you must send in volume.

How the checks fit together

For a message to pass DMARC, one of two things must be true. Either the SPF check passes and the domain in the envelope sender (the return path) matches the From domain, or the message carries a valid DKIM signature from a domain that matches the From domain. Microsoft's article asks you to confirm the return-path domain aligns with the From domain, and that the DKIM signing domain does.

Many small senders fail on alignment rather than on a missing record. A hosted newsletter service often sends from its own return-path domain and signs with its own key, so SPF and DKIM both "pass" while neither aligns with your From domain. The fix is to set up the service's custom domain authentication, which usually means a few CNAME or TXT records at your DNS host.

What it means

For site owners and admins who send only a little mail, the practical risk is silent: a contact form, invoice system or password-reset email from a domain with no DMARC record could start bouncing for Outlook.com users, and the bounce text is easy to miss if it goes to an unmonitored address. Adding p=none costs little and is the first step both Microsoft's documentation and MailRoute recommend. Moving to quarantine or reject later is a separate decision that should wait until your reports show all legitimate mail passing.

For people on a free mailbox who cannot change DNS, nothing changes for them directly; the sender's provider has to be compliant.

What we don't know yet

• Whether Microsoft has started rejecting mail from low-volume senders without DMARC. We found only the one vendor's report and no Microsoft statement. MailRoute's own post said Microsoft had published nothing as of 6 November; we have not seen one since.
• Whether the 550 5.7.1 text is a new rule, a spam-filter side effect or a test. The partial, resend-may-succeed pattern MailRoute describes would fit a gradual rollout, but that is our reading, not a finding.
• Whether the 5,000-message threshold still applies. Microsoft's pages we read give no date for enforcement of rejection and do not mention any lower threshold.

What to watch next

Watch for a Microsoft Tech Community or Message Center notice about the 5.7.1 bounce, and for further reports from administrators. If you manage a domain, check your DMARC record now rather than waiting for confirmation: the fix is harmless and already required for large senders.

Sources

• Microsoft Support: Fix NDR error 550 5.7.515 in Outlook.com (primary source for the documented rule and fix steps)
• Microsoft Tech Community: Strengthening Email Ecosystem: Outlook's New Requirements for High-Volume Senders
• Microsoft Exchange team: Authenticate outbound email to improve deliverability
• MailRoute: Outlook.com is quietly rejecting email from domains without DMARC (the unconfirmed 5 November report)
• Microsoft Q&A: How to fix a 550 5.7.515 Access denied error (community answers, not Microsoft policy)