Microsoft is now rejecting email from domains without DMARC

Emailing Hotmail or Outlook addresses? Here’s what has changed

Since 5 November, Microsoft has started turning away email sent to Outlook.com, Hotmail, Live and MSN addresses from any domain that doesn’t have a DMARC record. And it isn’t just the big senders. Businesses sending only a handful of emails a day are seeing their messages bounce.

How we got here

This has been coming for a while. In February 2024, Google and Yahoo started insisting that businesses sending large amounts of email prove it really came from them. In May 2025, Microsoft followed suit for anyone sending more than 5,000 emails a day to its personal email services. The proof they all ask for is called DMARC.

Microsoft has now gone further and is applying it to small senders too. It hasn’t made a formal announcement, but the bounced emails tell the story. Senders are getting this message back:

550 5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records

The worrying part is that most businesses won’t notice. The invoice, quote or booking confirmation you sent to a customer’s Hotmail address simply never arrives, and nobody tells you.

Does this affect you?

• If you email members of the public at personal addresses such as Hotmail, Outlook.com or Gmail, now is the time to get your email verified. That covers estate agents, solicitors with private clients, hotels and venues taking bookings, and anyone else whose customers use a personal inbox.
• If you mainly email other businesses at their own company addresses, you should find you’re not as affected, for now. But every big email provider is heading the same way, and it won’t stop at personal inboxes.

Why a DMARC record on its own isn’t enough

Adding a basic DMARC record set to “watch only” will stop the bounces. But it does nothing to stop criminals sending email that looks like it came from you, such as fake invoices or “our bank details have changed” messages. Real protection comes from moving step by step to “block”, and then keeping it right every time your business starts using a new system that sends email.

That is where most businesses get stuck. They set up the record, the daily reports pile up unread, and they never move past watch only.

How Flo Verified Mail sorts it for you

Flo Verified Mail is our fully managed service. We set up everything your domain needs, read the daily reports, approve every genuine system that sends email as you, and take you all the way to full protection in about 45 days. You can see your domain’s status at any time in your Partner Portal.

Since launch, we’ve completed over 800 Flo Verified Mail orders, all set up free of charge. From 1 January 2027, we’ll be introducing a setup charge, because of the time it takes to organise each domain’s records and take it to full protection. If you’ve been meaning to get this sorted, now is the time.

Check your domain in 20 seconds

Not sure where you stand? Run our free domain scan. It takes about 20 seconds, needs no sign-up, and shows whether your email is protected and proven to be yours. Then get in touch and we’ll take it from there.

Further reading

What is DMARC and why does your business need it?: the basics, in plain English.

How to set up DMARC for Microsoft 365: a step-by-step guide.

Why your emails go to spam instead of the inbox: the most common causes and how to fix them.