A heads-up on Microsoft, DMARC and your emails
Affects all business emails across Microsoft 365, Google Workspace and other platforms with the destination to personal Microsoft accounts.
We started our week by discovering that Microsoft has changed how it handles emails from domains that don’t have a DMARC policy. There was no announcement, no blog post and no warning. Emails simply started bouncing.
If you’re sending to anyone with a Hotmail, Outlook.com, Live or MSN address, this could be affecting you right now. I wanted to explain what’s going on in plain terms, how to check whether you’re affected, and what to do about it.
What’s actually happening?
Since the 5th November 2026, Microsoft’s personal email services (Outlook.com, Hotmail, Live and MSN) have been rejecting some messages from domains that have no DMARC record. This happens even when your other email security records, SPF and DKIM, are set up correctly.
The sender gets a bounce-back that reads something like “Message rejected: Message lacks SPF/DKIM/DMARC Auth Records”. It’s also a bit hit and miss: some emails get through and others don’t, which makes it easy to miss.
The impact is that emails simply don’t arrive. For a business, that could be an invoice or a quote. For a school, it might be a letter home or a trip consent form sent to a parent’s address. Microsoft won’t try to deliver a rejected email again, so anything that bounced needs to be resent.
It’s worth saying that this only affects emails to Microsoft’s personal mailboxes. Emails to your colleagues, or to other organisations on Microsoft 365, don’t seem to be affected at the moment.
Why has Microsoft done this?
Microsoft hasn’t explained it yet, but the direction of travel isn’t a surprise. Last year Microsoft started requiring DMARC from organisations sending more than 5,000 emails a day to its personal mailboxes, and Google and Yahoo did the same before that. It now looks like Microsoft has removed that threshold altogether.
The reason behind all of this is the same: phishing. DMARC is an essential protection to prevent a criminal to send an email that looks like it came from your domain. Every big provider is now asking senders to prove they are who they say they are.
Are you affected?
The quickest way to find out is to check whether your domain has a DMARC record. Pop your domain name into the box below (the part after the @ in your email address) and it’ll tell you in a couple of seconds.
Check your domain
Enter the part of your email address after the @ to see if it has a DMARC policy.
If it comes back with a green tick, you’re fine for now and there’s nothing urgent to do. If it comes back with a red cross, you’re at risk of your emails being rejected and it’s worth acting this week.
The other tell-tale sign is a bounce-back since early November that mentions SPF, DKIM or DMARC. If anyone has mentioned recently that they didn’t receive something from you, this might be why.
The immediate fix
The good news is that the fix is simple. You need to publish a DMARC policy for your domain, which is a single line added to your domain’s DNS settings.
The minimum requirement is just to have a policy. You don’t have to switch on enforcement straight away. A policy set to p=none tells receiving servers that you’re monitoring your email rather than blocking anything. It won’t stop any of your own emails from being delivered, and it’ll start sending you reports on who is sending email using your domain. Those reports become really useful later on.
A basic record looks something like this:
v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.co.ukIf you’re comfortable in your DNS settings, it’s a five-minute job. If you’re not, or you’d just rather someone else did it, we’re happy to help. Just drop us a line and we’ll get it sorted for you, usually the same day.
What next?
Publishing a monitoring policy gets your emails flowing again, but it’s only the first step. The real value of DMARC comes when you enforce it. That means telling receiving servers to quarantine or reject any email that claims to be from you but isn’t, which stops criminals using your domain to send phishing emails to your customers.
This is where it pays to take your time. Most organisations have more systems sending email on their behalf than they realise. There’s your website contact form, your finance or invoicing software, newsletter tools, a school’s MIS or parent app, your CRM, and sometimes a printer or scanner too. If you switch on enforcement before every one of those is set up properly, you can end up blocking your own legitimate emails, which is exactly the disruption we’re trying to avoid.
Done properly, it’s a planned process. We review the DMARC reports, identify every service using your domain, make sure each one is authenticated correctly, and then tighten the policy in stages. Depending on how many systems you have, it can take several weeks or months. We would be glad to support you through it.
Any questions?
I know changes like this can feel like one more thing on an already long list, especially when they arrive without warning. If you’re not sure where you stand, run the check above or just give us a call. We’re always happy to take a look.
Get in touch with our experts
Let’s discuss how we can best assist your organisation with its IT & digital challenges. No matter how big or small, our team of experts will work with you to determine the best actions forward for your IT.