Want a second look at your security?
From 5 November 2026, some emails sent to Hotmail and Outlook.com addresses were turned away with the error “Message lacks SPF/DKIM/DMARC Auth Records (AS9031519)”. It mostly hit businesses whose domain had no DMARC record, including small senders who only send a few emails a day.
It wasn’t a new rule. Microsoft has since confirmed it was a fault. An update to its spam rules wrongly blocked genuine email. Microsoft has rolled the update back, and its records show the problem ended by midday on Monday 9 November.
So there are two jobs. Check whether anything important bounced between 5 and 9 November and send it again. Then set up DMARC anyway, because the big email providers already expect it from larger senders, and the November bounces showed how quickly that can reach everyone else.
The short answer
It was a Microsoft fault, and it’s fixed. A faulty update to its spam rules made Hotmail, Outlook.com, Live and MSN addresses turn away some genuine email from 5 to 9 November 2026. If a customer says they never got your quote or invoice, search your bounces for AS9031519 and send again anything that matters. If a new AS9031519 bounce turns up after 9 November, keep the whole message and ask whoever looks after your email to check it. Domains with no DMARC record were hit hardest. A domain without one is still easier to impersonate and more likely to have trouble with the big providers in future, so it’s worth setting up anyway.
Key takeaways
- Some emails to Microsoft’s personal email addresses bounced from 5 November 2026, mostly from domains with no DMARC record.
- Microsoft has confirmed it was a fault in an update to its spam rules, not a new rule. It was fixed on 9 November.
- Microsoft, Google and Yahoo already require DMARC from businesses that send thousands of emails a day.
- A basic DMARC record is a short line in your domain settings. It’s the start of protecting your domain, not the end.
What happened to emails sent to Hotmail and Outlook.com?
From Thursday 5 November 2026, senders started reporting bounce messages when they emailed people at Hotmail, Outlook.com, Live and MSN addresses. These are Microsoft’s personal email services, not the Microsoft 365 accounts most businesses use for their own email.
Most reports came from domains with working SPF and DKIM but no DMARC record. Adding a DMARC record got many of them through, but some senders with all three records in place were caught too, which pointed to a fault at Microsoft’s end. It didn’t happen every time. One email would get through and the next would come back, so plenty of businesses won’t have noticed.
Microsoft’s incident record covers 6 to 9 November, though the first reports came a day earlier. It says Microsoft rolled the faulty update back and the problem ended at 11:02 UK time on Monday 9 November. Later that day, people on Microsoft’s own support forum said the bounces had stopped, and email deliverability experts found their test emails were going through again.
What does the bounce message look like?
The most common bounce read:
550 5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records (AS9031519)
Some senders saw bounces that mentioned SPF instead, which sent people looking in the wrong place. If a bounce mentions AS9031519 and was sent between 5 and 9 November, it’s almost certainly this issue.
Bounces often land in a shared inbox, a junk folder, or the inbox of whoever set up a system years ago. Check those as well as your own.
Was it a new Microsoft rule?
No. On 9 November a moderator on Microsoft’s support forum described an Exchange service issue affecting messages to Outlook.com, Hotmail and Live addresses, classed as a service degradation. A day later, Microsoft’s incident report gave the cause. A recent update to its spam rules had wrongly marked genuine email as suspect and blocked it. Microsoft says it’s reviewing how it makes these updates, and it hasn’t announced a rule change for small senders.
Some posts and articles have said Microsoft now rejects all email without DMARC. That isn’t what Microsoft has said. Here’s what is in place:
| Provider | What they require | Since |
|---|---|---|
| Microsoft (Outlook.com, Hotmail, Live) | SPF and DKIM must pass, and DMARC must be set to at least p=none, for domains sending more than 5,000 emails a day | 5 May 2025 |
| Google (Gmail) | SPF, DKIM and DMARC for bulk senders. SPF or DKIM for everyone else | February 2024 |
| Yahoo | Similar rules for bulk senders | February 2024 |
So the rules haven’t officially changed for small businesses. But for a few days, Microsoft’s service behaved as if they had.
Who was affected?
Anyone whose email goes to the public at personal addresses. That covers a lot of small businesses:
- care homes writing to families
- estate agents, letting agents and solicitors with private clients
- dentists, vets and clinics sending appointment reminders
- trades sending quotes and invoices
- hotels, venues and restaurants confirming bookings
If you mainly email other businesses at their own company addresses, you’re less likely to have been caught by it.
What should you do now?
- Look for bounces from 5 to 9 November. Search your inbox and any shared mailboxes for “AS9031519” or “Message rejected”. Pay most attention to anything a customer was waiting for, such as a quote or an invoice.
- Send again anything that matters. A quick note to the customer helps too, in case they’ve been waiting.
- Keep any new bounce in full. If an email to one of these addresses bounces after 9 November, save the whole bounce message, not just a screenshot, and pass it to whoever looks after your email. Microsoft’s fault is fixed, so a new bounce needs looking at on its own, and the full message has the details they’ll need.
- Check your domain has a DMARC record. If it doesn’t, add one. The next two sections explain how.
- List everything that sends email in your name. Microsoft 365 is usually only part of it. Website contact forms, accounts packages, booking systems, CRMs and newsletter tools may all send from your domain.
SPF, DKIM and DMARC in plain English
All three are short records in your domain’s settings (its DNS). They help the receiving email system decide whether a message that says it’s from you really is.
- SPF (Sender Policy Framework) lists the servers allowed to send email for your domain.
- DKIM (DomainKeys Identified Mail) adds a digital signature to each email, so the receiver can check it came from your domain and wasn’t changed on the way.
- DMARC (Domain-based Message Authentication, Reporting and Conformance) tells the receiver what to do when an email fails those checks, and where to send reports about it.
For DMARC to pass, at least one of SPF or DKIM has to pass and match the domain in the “From” address people see.
How to check if your domain has a DMARC record
A DMARC record is a TXT record that sits at _dmarc in front of your domain, for example _dmarc.yourbusiness.co.uk.
The easiest way to check is to ask whoever looks after your domain. That might be your IT provider, your web agency or the company you bought the domain from. Free online DMARC lookup tools will also show you what’s published.
While they’re looking, ask them to check two things that often go wrong:
- One SPF record only. Two SPF records on the same domain can make both fail.
- Every sending system included. If your accounts package or booking system sends email as you, it needs to be covered by SPF or set up to sign with DKIM.
What a basic DMARC record looks like
A starting record usually looks like this:
v=DMARC1; p=none; rua=mailto:dmarc-reports@yourbusiness.co.uk
p=nonetells receivers to deliver as normal and just report what they see. This is the setting Microsoft asks bulk senders for, and it’s the one many senders added to get past the November bounces.rua=is the address that receives daily reports. These reports show which systems are sending email using your domain. Leave it out and nobody sends you any.
Your domain should only have one DMARC record. If there’s already one there, it needs editing, not a second one adding.
Why p=none is a start, not the finish
A DMARC record set to p=none got many senders past the November bounces, but it doesn’t stop anyone else sending email that looks like it came from you. A fake invoice or a “we’ve changed our bank details” email using your domain could still arrive.
Real protection comes from moving in stages:
- None: collect reports and see who’s sending email using your domain.
- Quarantine: ask receivers to treat failing email with caution, usually by sending it to junk.
- Reject: ask receivers to block failing email altogether.
The reports make this safe. They show which genuine systems need fixing before you tighten the policy. Move too quickly, and your own invoices or password resets could be blocked. Most businesses get stuck at the first stage because the reports are hard to read.
How Chrome helps
Our Managed DMARC service starts with a review of your domains and your SPF, DKIM and DMARC records. We’ll explain what’s missing or misaligned and help you find every system that sends email in your name, from Microsoft 365 to website forms and finance tools.
From there, we’ll read the reports for you and help you move from monitoring towards stronger protection in planned steps, so genuine email keeps arriving. DMARC protects your domain. It works best alongside email security for your inboxes and awareness training for your team.
A sensible place to start
Search your email for “AS9031519” today. Then ask whoever looks after your domain one question: do we have a DMARC record, and what’s it set to?
If you’re not sure who to ask, or you’d like us to check for you, speak to our team or call us on 03333 212 707.
Not sure where your gaps are?
Common questions
Is Microsoft now rejecting all email without DMARC?
No. Microsoft has confirmed the bounces were caused by a faulty update to its spam rules, and it rolled that update back on 9 November. Microsoft’s published rule only applies to domains sending more than 5,000 emails a day to its personal email services.
We only send a few emails a day. Do we still need DMARC?
It’s worth having. Small senders were caught by the November bounces, and DMARC is also what stops other people sending convincing emails in your name. A basic record takes a few minutes to add.
Will adding a DMARC record stop our emails being delivered?
Not at p=none. That setting asks receivers to deliver email as normal and send you reports. The risk comes later, if you move to quarantine or reject before every genuine sending system has been checked.
Does DMARC stop phishing?
It stops one kind: emails that pretend to come from your exact domain. It won’t stop look-alike domains or phishing emails sent to your team from elsewhere. That’s what email security and staff training are for.
Do we need DMARC if we use Microsoft 365?
Yes. Microsoft 365 can sign your email with DKIM, but it doesn’t publish a DMARC record for your own domain for you. And Microsoft 365 is often only one of several systems sending email as your business.
