Published: 10 November 2026 | By AOLC
A client tells you they never got your quote. You check, and there it is in your inbox: a bounce. It reads something like 550 5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records. The client's address ends in @outlook.com or @hotmail.com, and yesterday's email to them went through without trouble.
That bounce means Microsoft's consumer mail service looked for a DMARC record on your domain, did not find one, and refused the message. Your mail server did nothing wrong, and your SPF and DKIM may be set up perfectly. What is missing is one line in your domain's DNS. The rest of this post explains what changed, how to check your own domain in two minutes, and how to fix it today at no cost.
From 5 November 2026, mail providers and email-deliverability companies began reporting that Outlook.com, Hotmail, Live and MSN mailboxes were rejecting some messages from domains that do not publish a DMARC record. The reports came first from mail administrators, then from deliverability vendors who reproduced the bounce in their own tests.
Three things make this different from what came before:
The bounce goes to your clients and suppliers who use personal Outlook and Hotmail addresses — often sole traders, parents, and small businesses. Mail to companies on their own Microsoft 365 domains does not appear to be affected so far.
Because Microsoft has not said what triggers each rejection, nobody can tell you exactly which of your messages will bounce. What the reports agree on is the fix: once a domain publishes a DMARC record, these bounces stop.
You are affected if your domain has no DMARC record. Checking takes two minutes. DMARC lives in a TXT record at a fixed name: _dmarc in front of your domain. For yourcompany.co.za, that is _dmarc.yourcompany.co.za.
On a Windows computer, open Command Prompt and type:
nslookup -type=TXT _dmarc.yourcompany.co.za
If the answer contains a line starting with v=DMARC1, you have a record. If it says the name does not exist, or returns nothing, you do not. You can also use any online DNS lookup tool: look up the TXT record for _dmarc.yourcompany.co.za.
Then check your sent mail and your inbox for bounces from the last week. Look for 550 5.7.1 and the words "lacks SPF/DKIM/DMARC Auth Records". Some reports show a code in brackets at the end of the line, such as AS9031519.
Tip
Check every domain you send email from, not only your main one. A second company name, an old domain that still forwards mail, or a domain used only for invoices each needs its own record.
Add one TXT record to your domain's DNS:
_dmarc (some control panels want the full name, _dmarc.yourcompany.co.za)v=DMARC1; p=noneWhere you add it depends on who hosts your DNS. That is usually your domain registrar or your web host, and the record goes in their control panel. If your DNS is hosted in Microsoft 365, it goes in the Microsoft 365 admin centre under your domain's DNS records. If you are not sure who hosts your DNS, whoever built your website or set up your email will know.
Why p=none is safe: the p stands for policy, and none tells receiving mail servers to do nothing differently with mail that fails the DMARC check. Your mail is delivered exactly as it is today. What changes is that your domain now has a published DMARC policy, which is what Outlook.com and Hotmail are looking for.
Tip
A domain must have only one DMARC record. If the lookup already shows one, edit it rather than adding a second. And do not start with p=reject: until you know every service that sends mail as your domain is set up correctly, a strict policy can block your own invoices and newsletters.
The record above stops the bounces. It does not yet protect you, and protection is what DMARC was built for.
Anyone can send an email that claims to come from your domain. Criminals use this to send fake invoices to your clients, with your name and your logo and new bank details. DMARC is how a domain owner tells the world's mail servers what to do with mail that claims to be from them but cannot prove it. With p=none, you are saying "do nothing", so a forged email is still delivered.
Getting to real protection takes a few steps:
p=quarantine, so forged mail lands in spam.p=reject, so forged mail is refused outright.The reports are machine-readable XML files, and reading them is the hard part. That is the work our cloud and email security team does for clients: we receive the reports, fix the services that fail, and move the domain to full protection one step at a time.
Section 19 of POPIA requires every responsible party to secure the personal information it holds with appropriate, reasonable technical and organisational measures. Email is where much of that information travels, and a domain that anyone can impersonate makes it easier for criminals to trick your clients and staff into handing over personal and financial details.
POPIA does not name DMARC. But email authentication is a free, well-documented baseline control, and if a client is defrauded by an email that looked like it came from you, "we never set it up" is a hard position to defend. Our post on phishing attacks in South Africa shows how these scams usually unfold.
_dmarc for every domain you send email from.v=DMARC1; p=none as a TXT record at _dmarc, one per domain.If you would rather not touch DNS yourself, or you want your domain protected properly, our managed IT team can check your domains and set it up for you.
Tell us your domain and we will check its DMARC, SPF and DKIM records and tell you exactly what to add. No cost, no obligation.
Book a Free DMARC Check