Microsoft has rolled back a faulty spam enforcement update that blocked legitimate email sent to Outlook.com, Hotmail and Live.com addresses, closing the incident on Tuesday 10 November 2026. The company confirmed the problem in its Microsoft 365 Service Health notice, incident EX1545193, and said mail flow had been restored.

The trouble began on 5 November, when Outlook.com started rejecting some mail from domains that publish no DMARC record. The rejections hit senders of every size, not only bulk mailers, and passing SPF and DKIM checks did not save the messages. Senders saw the bounce: 550 5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records (AS9031519).

First reports surfaced on the mailop mailing list on 6 November, and administrators quickly found that even a single one-line email could be refused. A moderator in Microsoft's support forum acknowledged the problem and described it as a service degradation under investigation.

A faulty rule, not a new DMARC requirement

Microsoft's update on 10 November made the position clear. A recent update to its spam enforcement rules had incorrectly marked and blocked mail to its consumer addresses. The company rolled the update back and said mail flow was restored. The impact window ran from 18:00 UTC on 6 November to 11:02 UTC on 9 November, and the incident was closed at 05:36 UTC on 10 November.

That matters because the rejections looked like a policy change. They were not. Microsoft has published no new DMARC requirement for small senders, and the November rejections were a false positive caused by the faulty rule.

The confusion was understandable. In April 2025 Microsoft announced stricter authentication requirements for domains sending more than 5,000 messages a day to its consumer services. Those senders must pass SPF and DKIM and publish a DMARC record of at least p=none, aligned with SPF or DKIM. Enforcement began on 5 May 2025. For 18 months, senders below that volume assumed the rules did not apply to them.

What senders should do now

Microsoft says mail flow is restored, so senders who were blocked should find their messages going through again. Anyone still seeing rejections should check the bounce code: the AS9031519 code was tied to this incident, while the older 550 5.7.515 code relates to the May 2025 bulk sender rules.

Even so, the episode is a reminder to publish a DMARC record. A record at p=none is the minimum the 2025 rules describe, and it gives receivers a published policy to check. Domain owners can add one through their DNS provider, and Microsoft's own sender guidance sets out the requirements for high-volume senders.

The incident also shows how quickly a filtering change can bite. A rule aimed at spam briefly treated ordinary mail as unauthenticated, and small businesses and individuals had no warning and no workaround while it was live. Microsoft has not said how the faulty update passed its checks.

For now, the message to senders is simple: the block is gone, the rule is rolled back, and mail to Outlook.com, Hotmail and Live.com addresses should flow normally again. Anyone whose mail is still bouncing should raise it with Microsoft support and quote incident EX1545193.

Sources: EasyDMARC and Security Boulevard.