Microsoft are rejecting your mail

On November 6, Mythic Beasts discovered that Microsoft-operated mail services, including Hotmail and Outlook, were rejecting substantial amounts of incoming email. Microsoft’s error said messages lacked SPF, DKIM, or DMARC authentication records. Yet the affected messages had valid SPF and DKIM; they were rejected only because the sending domains had no DMARC record. The provider had seen the rejection more than 500 times on Thursday, with no earlier instances, and other email operators reported similar problems. Adding a DMARC record with a “none” policy restored delivery.

DMARC lets domain owners tell recipients how to handle messages that fail authentication: reject them, quarantine them, or take no action. A “none” policy offers no enforcement, so requiring one even when SPF and DKIM already pass does not meaningfully improve protection. Mythic Beasts calls Microsoft’s apparent new requirement an unexplained, disruptive change, contrasting it with a previously announced rule for domains sending over 5,000 messages daily. An update said the change was apparently unintended, though Microsoft had not yet worked out how to reverse it. To protect customers’ delivery, Mythic Beasts added “none” DMARC records to many domains despite generally avoiding unsolicited DNS changes, and urged affected users to complain and consider providers that actively investigate delivery failures.