Microsoft Now Requires DMARC Records to Deliver Email to Outlook.com

Microsoft has made a major change to Outlook.com, rejecting some email from sending domains that don’t have a DMARC record.

Domain-based Message Authentication, Reporting and Conformance (DMARC) is another layer that helps authenticate email messages. DMARC tells a server how to handle an incoming email if Sender Policy Framework (SPF) and DomainKeys Identified Mail (DKIM) authentication fails.

Starting Nov. 5, and with no previous notice, Microsoft started enforcing a DMARC requirement, rejecting some email to Outlook.com, Hotmail, Live and MSN addresses from domains without a DMARC record.

MXRoute, the popular email service, sent the following notice to its customers:

Hello,

Within the last 24 hours, Microsoft began enforcing a new rule that rejects some email sent to Outlook.com, Hotmail, Live, and MSN addresses when the sending domain does not have a DMARC record.

We received no advance warning. The rejections simply started happening, and we are seeing them at MXroute today.

This affects ordinary email, including domains that send very few messages. It can happen even when your SPF and DKIM records are already configured correctly.

Affected messages are returned with an error containing:

550 5.7.1 Message rejected:

Message lacks SPF/DKIM/DMARC Auth Records

Despite mentioning all three authentication methods, the missing piece in these cases is generally DMARC.

Microsoft hasn’t announced the change, but it is likely enforcing the DMARC record rule in an effort to combat spam and phishing attempts. Nonetheless, the sudden move is sure to catch some system admins off guard and leave them scrambling.