Outlook.com Bounced Authenticated Mail for Days Before Microsoft Rolled Back a Spam Rule

Outlook.com and Hotmail rejected legitimate email for roughly a week in early November 2026, and Microsoft's own incident record, EX1545193, says a recent update to its spam enforcement rules is to blame. A Microsoft spokesperson told The Register on November 11 at 09:48 UTC that the bug was fixed.

The first reports in a Microsoft Learn thread date to about November 4, with widespread reports from November 5 and 6. Richard Speed's account in The Register puts the start at the end of the previous week.

What senders saw

Non-delivery reports carried text such as 550 5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records, in some cases followed by an AS9031519 code. Others got 550 5.7.23 and the line "hotmail.com couldn't confirm that your message was sent from a trusted location".

By November 7, posters in the thread reported that their message headers showed spf=pass, dmarc=pass and dkim=pass and the mail was refused anyway. Failures were intermittent, so a resend sometimes went through.

What Microsoft said, and what it did not

A moderator identified as Daniel-Vo, listed as Microsoft External Staff, first pointed to an Exchange service issue. On November 10 the moderator wrote that a spam-enforcement rule update had wrongly flagged legitimate mail, that it was rolled back, and that the incident was marked Service Restored under EX1545193. The Register says the incident text promised a review of update procedures.

The thread's own caveat applies: those are community-moderator posts, and the incident could not be checked against Service Health. One poster wrote on November 9 that Service Health showed no incident. The Register reports Microsoft sent no advisory to customers explaining the rule changes.

A separate fault hit the same day. Users in Europe, the Middle East and Africa saw dropped connections to Outlook on the web and the Purview and Defender portals after a service change, which Microsoft reverted in Exchange Online front-end infrastructure. The Register says Microsoft has not said whether the two are linked.

The rules Microsoft published in 2025

Microsoft's Tech Community post set requirements for domains sending more than 5,000 emails a day to outlook.com, hotmail.com and live.com. The post is dated April 2, 2025 and was updated April 30.

Check	Requirement
SPF	Must pass, record lists authorized senders
DKIM	Must pass
DMARC	At least p=none, aligned with SPF or DKIM

Enforcement began May 5, 2025 by routing non-compliant mail to Junk. The post says rejection with 550; 5.7.515 Access denied comes on a date not yet announced, and its wording on that point is inconsistent. Most senders in November's thread said they send far below 5,000 a day, which is outside the published scope.

The fix people reported

Volunteer posters in the thread, including one called Hornblower409, argued the SPF wording in the error is misleading and that a missing DMARC record is the most common trigger. The same poster wrote that some correctly configured domains were rejected too, so DMARC does not explain every case.

The most commonly reported workaround was a TXT record at _dmarc.yourdomain.com with the value v=DMARC1; p=none;. It satisfies the published minimum and can be tightened later.

Microsoft's moderator advised resending anything that failed during the incident window. Mike W reported on November 10 that bounces were continuing and that Microsoft Support was blaming senders. For comparison, the Terminal has covered a GitBook SSO post-mortem and a Zeabur token report, both vendor incidents of a different kind. Microsoft has not published a root-cause write-up for EX1545193 as of November 12.