Outlook.com rejecting your email? Check SPF, DKIM and DMARC

If emails from your company bounce when sent to Hotmail, Live or Outlook.com addresses, check your domain's SPF, DKIM and DMARC records first. Microsoft requires all three for domains that send more than 5,000 emails a day, and refuses failing mail with the code "550 5.7.515". Smaller senders can see bounces too when these records are missing or wrong. A few DNS fixes usually solve it.

What are SPF, DKIM and DMARC?

They are three short records in your domain's DNS that prove an email really came from you.

• SPF lists the servers allowed to send mail for your domain.
• DKIM adds a digital signature to each email, so the receiver can tell it was not changed on the way.
• DMARC tells the receiver what to do when SPF or DKIM fails, and where to send reports.

Microsoft says these standards work together, and that using fewer than all of them gives weaker protection against fake mail sent in your name.

What did Microsoft change?

Since May 2025, Outlook.com checks mail from high volume senders. For those domains, SPF and DKIM must pass, and DMARC must exist with at least "p=none" and match SPF or DKIM. Microsoft said failing mail would first go to Junk and would then be rejected with "550 5.7.515 Access denied, sending domain does not meet the required authentication level". Microsoft also says adding a sender to the Safe Senders list does not get around these checks.

Microsoft's own FAQ says senders under 5,000 a day benefit from the same setup. In practice, bounces such as "message lacks SPF/DKIM/DMARC auth records" can reach small offices too.

How do I check my domain?

1. Open the bounce message and note the exact error code and text.
2. Go to Google Admin Toolbox Check MX (toolbox.googleapps.com/apps/checkmx) and enter your domain. It shows whether SPF and DMARC records are present.
3. Check that you have only one SPF record. Two SPF records, or one that needs more than 10 DNS lookups, will fail.
4. If you send through a newsletter tool, an online shop or an accounting system, make sure each one is listed in SPF or signs with DKIM for your domain.

What to do

• Missing DMARC: add a record that starts with "v=DMARC1; p=none" and a report address, then move to quarantine and later reject once all your real senders pass, as Microsoft suggests.
• Missing DKIM: turn it on at your email provider and publish the key they give you.
• Still bouncing after the fix: send the full bounce message to whoever runs your email. DNS changes can take a few hours to reach everyone.

Our earlier guide on why emails go to spam covers other causes, such as blocklists and content.

How SyncTech can help

If your company email is hosted with SyncTech, email us the bounce and we will check your records for you. Our email troubleshooting guide explains common error messages. For mail that is filtered and set up with these records from the start, see our antispam email hosting.

Source and credit

We are sharing guidance from Microsoft and Google. This summary is written by Synctech in our own words.

• Strengthening Email Ecosystem: Outlook's New Requirements for High-Volume Senders, Microsoft Defender for Office 365 Blog, 2 April 2025 (updated 30 April 2025): https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/strengthening-email-ecosystem-outlook%E2%80%99s-new-requirements-for-high%E2%80%90volume-senders/4399730
• How email authentication works in Microsoft 365, Microsoft Learn: https://learn.microsoft.com/en-us/defender-office-365/email-authentication-about
• Check MX, Google Admin Toolbox: https://toolbox.googleapps.com/apps/checkmx/

Retrieved 7 November 2026. Microsoft, Outlook and Hotmail are trademarks of Microsoft Corporation. Google is a trademark of Google LLC. Synctech is not connected with them. This is general information, not legal, tax or financial advice. If anything here is wrong, email support@synctech.com.my and we will correct it.