Since Thursday 5 November, Microsoft’s consumer email service, the one behind outlook.com, hotmail.com, live.com and msn.com addresses, has been turning away some email from domains that don’t publish a DMARC record. There’s been no announcement and no warning, and it isn’t limited to bulk senders. A small charity sending a donation receipt or a volunteer rota is in scope.
When we measured 73,687 UK charity domains in August, 41,061 of them (55.7%) had no DMARC record at all. That’s exactly the group these rejections are hitting.
In brief
- Since 5 November 2026, Outlook.com, Hotmail, Live and MSN have been rejecting some email from domains with no DMARC record, even when SPF and DKIM pass.
- It’s intermittent, unannounced and hits low-volume senders, not just the 5,000-a-day bulk senders covered by Microsoft’s 2025 rules.
- 55.7% of UK charity domains had no DMARC record when we last measured. Another 31.5% sit at
p=none. - The fix that’s cleared the bounces in reported cases is one DNS record at
p=none. It takes minutes, but it’s a starting point, not protection. - Plan to move to
p=quarantinewithin about six weeks. Until you do, anyone can still send email pretending to be your charity. - That record gets you off the bottom rung. It doesn’t stop anyone sending email pretending to be your charity, so don’t stop there.
55.7%
of UK charity domains publish no DMARC record
20,225
charity domains run their email on Microsoft 365, which doesn’t add DMARC for you
87.2%
have no enforcing policy, so their domain can still be spoofed
What’s happening
Mail administrators started seeing the rejections on 5 November. By the next day the bounce had picked up a reference code, and it now reads:
550 5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records (AS9031519)Deliverability expert Al Iverson reproduced it on 7 November by deleting the DMARC record from several of his low-volume domains. Mail to outlook.com bounced. The same mail to a business domain hosted on Microsoft 365 went through. MailRoute, Engagor and EasyDMARC have all reported the same pattern, and there’s a growing thread on Microsoft’s own Q&A forum.
Here’s what’s worth knowing:
- It’s personal mailboxes, not work ones. The rejections come from Microsoft’s consumer platform: outlook.com, hotmail.com, hotmail.co.uk, live.com, live.co.uk, msn.com and the other country versions. Work mailboxes on Microsoft 365 don’t appear to be affected so far.
- Volume doesn’t matter. Microsoft’s published 2025 rules only apply to senders of more than 5,000 messages a day. These rejections are landing on ordinary, low-volume senders.
- It’s intermittent. Some messages from the same domain get through and others don’t, so “my test email arrived” doesn’t prove you’re fine.
- It’s a hard bounce. A 550 is a permanent rejection, so Outlook.com won’t retry. The email doesn’t land in junk. It doesn’t land at all.
- Microsoft hasn’t said a word. At the time of writing there’s no postmaster notice, blog post or documentation that mentions the AS9031519 code.
Why it matters more for charities than most
The quickest way to size this for your charity is to look at your own list. Filter your CRM or mailing platform for supporters at hotmail.co.uk, hotmail.com, outlook.com, live.co.uk, live.com and msn.com. If your domain has no DMARC record, that’s the group for whom some of your email may currently be bouncing.
And the email at risk isn’t just the newsletter. It’s the one-to-one and transactional stuff that supporters actually wait for:
- donation receipts and Gift Aid confirmations
- event tickets and booking confirmations
- volunteer rotas and shift reminders
- replies from staff to supporter enquiries
- password resets and account emails from your website or shop
Those come from different places: your Microsoft 365 or Google mailboxes, your CRM, your email marketing platform and your website. Each one handles bounces differently, and some of them hand the bounce to nobody at all.
Websites are the worst offender. By default, WordPress sends email through the web server it’s hosted on, and bounces often end up in a server mailbox nobody reads. So a supporter on Hotmail fills in your contact form or donates through your site, the confirmation never arrives, and nobody at the charity ever sees an error.
Where UK charities sit on the DMARC ladder
In our research we treat DMARC as a ladder rather than a yes or no, because publishing a policy isn’t the same as enforcing one. Until last week, the bottom rung was a security gap. Microsoft has now made it a delivery problem too.
| Rung | Charity domains | Share | Stops spoofing? | Outlook.com rejections (Nov 2026) |
|---|---|---|---|---|
| No DMARC record | 41,061 | 55.7% | No | Some mail rejected |
p=none | 23,215 | 31.5% | No, monitoring only | Not affected so far |
p=quarantine | 5,627 | 7.6% | Forged mail treated as suspicious | Not affected so far |
p=reject | 3,784 | 5.1% | Forged mail refused | Not affected so far |
“More than half of UK charity domains have no DMARC record. As of this month, that’s not just a security risk. It’s a reason supporters aren’t getting your emails.”
Nebula Design, UK charity email security research 2026
“But we’re on Microsoft 365”
Microsoft 365 is the most common mail provider in our data, used by 27.4% of charity domains (20,225). Being on Microsoft 365 doesn’t mean you’ve got DMARC. For your own domain, the record has to be created wherever your DNS is hosted. Microsoft’s own guidance confirms there’s no setting in the admin centre that does it for you.
Which leads to the slightly absurd situation where Microsoft 365 customers on the Q&A forum are reporting their mail being bounced by Outlook.com. Same company, different front door. Google Workspace is no different: DMARC is your job, not Google’s.
How this fits with the 2024 and 2025 rules
This isn’t coming out of nowhere. The big mailbox providers have been tightening up for a couple of years, but until now the rules only bit if you sent in bulk.
| When | Who | Applies to | What’s required | If you don’t comply |
|---|---|---|---|---|
| February 2024 | Gmail and Yahoo | Bulk senders (5,000+ a day) | SPF, DKIM and an aligned DMARC record, p=none or stronger | Phased enforcement, starting with temporary errors |
| May 2025 | Outlook.com | Senders of 5,000+ a day | SPF and DKIM pass, plus DMARC at p=none or stronger, aligned | Rejected with 550 5.7.515 |
| November 2026 (observed, not announced) | Outlook.com | Any sender, any volume | A DMARC record exists | Some mail rejected with 550 5.7.1 (AS9031519) |
Sources: Microsoft Defender for Office 365 blog, EasyDMARC.
We covered the 2025 rules in our earlier guide to Microsoft’s DMARC requirements. Most charities rightly assumed they didn’t apply. This latest change removes that assumption, and Iverson’s view is that DMARC is heading towards being a requirement for every sender, not just the big ones.
What we don’t know yet
- Whether it’s deliberate. It could be a staged rollout, a test or a bug. Iverson says it’s unclear, and EasyDMARC notes that several explanations are still on the table.
- Whether DMARC is the whole story. Some senders with valid records have reported bounces too, including
550 5.7.23SPF errors. If you’ve got a valid record and you’re still seeing rejections, keep the full bounce message and report it through Outlook.com support, which is what a Microsoft moderator has advised affected users to do. - Whether Microsoft will roll it back. Even if it does, a DMARC record is something every charity domain should have anyway. Nothing you do this week is wasted.
What we do know: Engagor reports that publishing a DMARC record has stopped the rejections in every confirmed case it’s seen.
What to do this week
- Check whether you’ve got a record. Put your domain into a free checker like MXToolbox’s DMARC lookup, or from a terminal run
dig +short TXT _dmarc.yourcharity.org.uk. No result means no record. - Find out who runs your DNS. It’s often not your email provider. It could be your domain registrar, your web agency, or a volunteer who registered the domain ten years ago. Looking up your domain’s nameservers (NS records) will tell you where to make the change.
- Add one TXT record as a starting point. The host is
_dmarcand the value is below. Point theruaaddress at a DMARC reporting service rather than a person’s inbox: the reports arrive as zipped XML that nobody can usefully read by eye. Plenty of services have free tiers, which matters now the NCSC’s free Mail Check service has been retired. Whatever address you use, make sure it exists, or the reports will bounce too.
v=DMARC1; p=none; rua=mailto:[address from your DMARC reporting service]- Publish exactly one. Two DMARC records on the same domain is as bad as none, because receivers ignore both. It’s an easy mistake to make: our research found 578 charity domains with more than one SPF record, which breaks SPF in exactly the same way.
- Resend anything that bounced. Outlook.com won’t retry a permanent rejection. Check your shared inboxes for bounce messages, plus the bounce reports in your CRM and email marketing platform.
- List everything that sends as your domain. Mailboxes, CRM, email marketing, the website, donation and ticketing platforms, HR and payroll systems. Each one needs to pass SPF or DKIM in line with your domain before you can safely tighten your policy.
Sort your website’s email while you’re there
Website email is usually the thing that keeps charities stuck on the second rung. Mail sent straight from a web server often isn’t covered by your SPF record and isn’t DKIM-signed for your domain. At p=none that mostly still gets delivered. Move to p=quarantine and your contact form notifications, donation receipts and shop orders start vanishing into junk folders.
The fix is to send your website’s email through an authenticated service, such as your Microsoft 365 or Google account or a transactional email provider, using an SMTP plugin, with SPF and DKIM set up for it. It’s usually a short job for whoever looks after your site, and it’s the step that makes the rest of the ladder climbable.
Then keep climbing
p=none stops the bounces. It’s step one of three, not the fix. It tells receiving servers to take no action when an email fails the checks, so anyone can still send email that looks like it came from your charity. After the Beacon CRM breach, that matters: we went through why in how easy is it to send email as your charity?, along with setup steps for Microsoft 365 and Google Workspace.
The route up is well worn:
- Review your DMARC reports for a few weeks. EasyDMARC suggests two to eight weeks before enforcing, and six is a sensible default for most charities.
- Fix any legitimate sender that’s failing (often the website, as above).
- If the reports show everything legitimate passing, don’t wait out the full six weeks. Move on sooner.
- Move to
p=quarantine, thenp=reject. The NCSC says a reject policy on all your domains is the best way to stop spoofing. - Lock down domains that don’t send email at all. We found 6,906 charity domains with no MX record, so they don’t receive mail. If they don’t send any either, they can go straight to
p=reject. There’s government guidance on exactly this.
Quick answers
Will adding a DMARC record affect our email elsewhere?
Not at p=none. It asks receiving servers to take no action on failures, so Gmail, Yahoo and everyone else carry on as before. You just start getting reports.
We only send a handful of emails a day. Does this apply to us?
Yes. The reported rejections are hitting low-volume senders. The 5,000-a-day threshold belongs to Microsoft’s 2025 rules, not this.
We use Microsoft 365. Isn’t this Microsoft’s job?
Not for your own domain. The DMARC record lives in your DNS, so it has to be added wherever your DNS is hosted. The same goes for Google Workspace.
Has Microsoft confirmed the change?
Not at the time of writing (9 November 2026). The behaviour has been reported by several mail operators and reproduced independently. We’ll update this post if Microsoft comments.
Our emails seem to be getting through. Are we fine?
Not necessarily. The rejections are intermittent, and bounces from websites and some platforms never reach a human. If you’ve got no DMARC record, add one anyway.
We’ve got DMARC and we’re still getting bounces. What now?
Check the code in the bounce. 5.7.515 means the 2025 bulk sender rules, so look at SPF and DKIM alignment. AS9031519 with a valid record in place may be a Microsoft-side problem: keep the full bounce and report it through Outlook.com support.
About the data
Charity figures come from our paper Can you trust email from the UK’s charities?, which measured the DNS records of 73,687 UK charity domains on 22 August 2026. Religious charities are excluded. DKIM wasn’t measured, because finding DKIM keys means guessing selector names. The aggregate data is published under CC BY 4.0, so you’re welcome to reuse it with credit. More papers are on our research page.
Need a hand?
If you’re not sure where your DNS lives, what’s sending email as your domain, or why your website’s emails keep landing in junk, we can help. We do this for charities all the time, and it’s usually a quicker job than people expect.
Sources
- Nebula Design (2026), Can you trust email from the UK’s charities? Email security across 73,687 charity domains
- EasyDMARC, Microsoft rejecting emails without DMARC (9 November 2026)
- Spam Resource (Al Iverson), Microsoft newly rejecting mail lacking DMARC? (7 November 2026)
- MailRoute, Outlook.com is quietly rejecting email from domains without DMARC
- Engagor, Microsoft AS9031519: Outlook rejects mail without DMARC (8 November 2026)
- Suped, Senders report Outlook.com email authentication bounces
- Microsoft Q&A, Incoming emails being blocked due to lack of SPF/DKIM/DMARC records
- Microsoft Defender for Office 365 blog, Outlook’s new requirements for high-volume senders (April 2025)
- Microsoft Learn, Set up DMARC to validate the From address domain for senders in Microsoft 365
- NCSC, Email security and anti-spoofing
- GOV.UK, Protect domains that do not send email
