Australian businesses are reporting emails rejected by Outlook.com and Hotmail addresses. Here is what the bounce message means, who is affected, and how to fix your domain's SPF, DKIM and DMARC.
A client rings to say they never got your invoice. A customer with a Hotmail address hasn’t heard back about their booking. Then you notice a bounce in your inbox with a line of code you’ve never seen before.
Since early November 2026, businesses around Australia, including a number here in Melbourne, have been reporting exactly this. Emails sent to personal Microsoft mailboxes are being knocked back, while emails to everyone else keep arriving normally.
If that sounds familiar, here is what is going on and what to do about it.
What the Bounce Message Looks Like
The rejection notice typically includes something like this:
550 5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records (AS9031519)In everyday terms, Microsoft is saying: “We can’t confirm this email really came from who it says it came from, so we’re not accepting it.”
The bounces are mostly coming from the consumer side of Microsoft, which means addresses ending in:
@outlook.com@hotmail.com(including@hotmail.com.au)@live.com(including@live.com.au)@msn.com
Emails to businesses that use Microsoft 365 with their own domain are generally not affected by this particular issue.
Has Microsoft Changed the Rules?
Partly. Since May 2025, Microsoft has required bulk senders, meaning domains sending more than 5,000 emails a day to its consumer mailboxes, to have SPF, DKIM and DMARC in place. Mail that fails those checks gets rejected.
What’s new is that smaller senders, including businesses sending only a handful of emails a day, now appear to be hitting the same wall. Microsoft hasn’t made a formal announcement, and the reports so far are patchy. Some businesses are seeing every message to Hotmail bounce, while others are seeing it only occasionally.
Our view is simple. Whether or not Microsoft confirms a policy change, the direction is clear. Google, Yahoo and Microsoft are all tightening up on unauthenticated email, and a domain without proper authentication is going to have more and more trouble getting mail delivered.
SPF, DKIM and DMARC in Plain English
These three records live in your domain’s DNS settings, the behind-the-scenes address book for your website and email. Together they prove your emails are genuine.
| Record | What it does | A simple way to think of it |
|---|---|---|
| SPF | Lists the services allowed to send email as your domain | The guest list at the door |
| DKIM | Adds a digital signature to every email you send | A wax seal on the envelope |
| DMARC | Tells receivers what to do if SPF or DKIM fail, and sends you reports | The instructions for the bouncer |
Many Australian businesses set up SPF years ago, sometimes have DKIM switched on, and have never added DMARC at all. Based on the bounce message, a missing DMARC record is the most likely cause of this round of rejections.
For a deeper look at how these records work together, read our guide to why business emails go to spam.
Who Is Most Likely to Be Affected
You are more at risk if:
- Your domain has no DMARC record. This is the big one.
- You send email from more than one place. Many businesses send from Microsoft 365 or Google Workspace, plus a CRM, Xero or MYOB invoices, a website contact form, a booking system, or Mailchimp-style newsletters. Each one needs to be authorised for your domain.
- Your SPF record is out of date. It might still list an old email host, or be missing a tool you’ve added since.
- DKIM was never switched on in Microsoft 365 or your other sending platforms.
- Your customers are everyday people such as tradies’ clients, patients, parents or retail customers, who are far more likely to use Hotmail or Outlook.com addresses than corporate ones.
Step 1: Check Your Domain
Before changing anything, find out where you stand. Our free Cyber Scan reads your domain’s SPF, DKIM and DMARC records, flags anything missing or misconfigured, and checks a few other things criminals look for, such as whether your domain could be used to send fake emails in your name.
Every report is reviewed by a person here at CX IT Services, graded A to E, and comes with a plain English fix for each issue.
Step 2: Add a Starter DMARC Record
If your domain has no DMARC record, the safest first step is a “monitoring only” record. It tells receiving mail servers that you’ve got DMARC in place, without asking them to block anything yet.
It is added as a TXT record named _dmarc on your domain, for example _dmarc.yourcompany.com.au, with a value like this:
v=DMARC1; p=none; rua=mailto:dmarc-reports@yourcompany.com.auWhat each part means:
v=DMARC1says this is a DMARC recordp=nonemeans “monitor only, don’t block anything yet”rua=mailto:...is where daily summary reports get sent, so you can see who is sending email as your domain
Once DNS updates, which is usually within an hour, new emails to Outlook and Hotmail addresses should start getting through.
Step 3: Make Sure Everything That Sends as You Is Authorised
This is where most businesses come unstuck. Adding DMARC is quick, but before you tighten it you need to be sure every legitimate sender passes SPF or DKIM. Otherwise you risk blocking your own invoices, quotes or appointment reminders.
Make a list of every system that sends email using your domain, then confirm each one is:
- Included in your SPF record. Keep in mind SPF has a limit of 10 lookups, and it’s easy to blow past that.
- Signing with DKIM using your domain, not the provider’s.
The DMARC reports from Step 2 are useful here. After a week or two, they show exactly which services are sending as you and whether they’re passing.
Step 4: Tighten Your Policy Over Time
Once everything legitimate is passing, you can move from p=none to p=quarantine, which sends failing mail to junk, and eventually to p=reject, which blocks it outright.
This is what actually stops criminals from impersonating your business in fake invoice and payment redirection scams, a major source of losses for Australian businesses. We cover that side in our guide to email spoofing and business email compromise.
Don’t rush this step. Moving to reject before your senders are sorted is one of the most common ways businesses accidentally break their own email.
Step 5: Resend Anything That Bounced
Rejected emails are not retried automatically. Once your records are fixed, go back through your bounce notices and resend anything important, especially invoices, quotes and booking confirmations. It’s also worth a quick note to key customers with Hotmail or Outlook addresses in case they’ve been wondering why they hadn’t heard from you.
Want Us to Sort It for You?
DNS changes are small but unforgiving. One wrong character can stop all your email. If you’d rather not touch it yourself, our team handles email authentication and deliverability for businesses across Melbourne and Australia. That includes auditing every sender, setting up SPF, DKIM and DMARC properly, and reading the reports so you don’t have to.
Start with a free scan to see exactly where your domain stands, or call us on 1300 477 814 or email sales@cxitservices.com.au and we’ll take a look.
Microsoft Partner