Since the end of last week, some businesses have found that perfectly normal emails to Outlook.com, Hotmail and Live.com addresses are bouncing back undelivered. Microsoft has now confirmed the cause: a fault in a recent update to its spam rules.
Here at Q6IT we've had a few questions about this from customers, so here's a plain-English look at what happened, why it matters even though the fault has been fixed, and what you should check on your own domain.
What happened?
Microsoft has been tightening the checks its consumer email services carry out before they accept a message. From late last week, senders started seeing their emails rejected, with bounce messages mentioning SPF validation failures or missing DMARC information.
It wasn't just bulk senders. Small businesses reported that a single, one-line email could be turned away. To make things more confusing, the problem came and went, so resending the same email sometimes worked. The bounce messages weren't always clear about what had gone wrong, and Microsoft issued no advance warning that anything was changing.
On 10 November Microsoft confirmed the fault in its incident report (EX1545193), saying that "a recent update to the spam enforcement rules caused email messages to be incorrectly marked and blocked". It has said it will review how it rolls out updates.
Why it still matters
The fault has been fixed, but the direction of travel hasn't changed. Microsoft, Google and other providers are all getting stricter about email authentication, and the businesses whose emails started flowing again fastest were the ones who made sure their settings met Microsoft's requirements.
In 2025 Microsoft brought in rules for domains sending more than 5,000 emails a day. This incident suggests those checks are increasingly being applied to everyone. If your domain isn't set up properly, there's a growing chance your emails will land in junk folders, or not arrive at all.
SPF, DKIM and DMARC explained
These three settings sit in your domain's DNS records and help receiving mail servers decide whether an email really came from you:
- SPF (Sender Policy Framework): a list of the servers and services allowed to send email for your domain. If you use Microsoft 365 plus a newsletter tool, a website contact form or a CRM, they all need to be included.
- DKIM (DomainKeys Identified Mail): a digital signature added to each email, proving it hasn't been tampered with on the way. You can read more in our post What Is DKIM?
- DMARC (Domain-based Message Authentication, Reporting and Conformance): tells receiving servers what to do with emails that fail the checks, and sends you reports on who is sending email using your domain.
To meet Microsoft's requirements:
- SPF must pass, with your DNS record accurately listing every service that sends email for you.
- DKIM must pass, so each email can be checked for integrity and authenticity.
- DMARC must be in place with at least a
p=nonepolicy, and must line up with SPF or DKIM (ideally both).
What should your business do?
It's worth taking a few minutes to check your domain now, rather than waiting for the next change to catch you out. In our experience, the most common problems are:
- no DMARC record at all
- an SPF record that's missing a service, such as a newsletter platform or website form
- more than one SPF record on the same domain, which causes SPF to fail
- DKIM never being switched on in Microsoft 365
- old services still listed in SPF long after they stopped being used
If customers or suppliers have recently told you your emails went to junk, or you've had unexpected bounce messages, this is a good place to start.
Need a hand?
Q6IT can check your domain's SPF, DKIM and DMARC settings, put right anything that's missing, and make sure your emails reach the people they're meant for. It's a quick job, and it's one of the simplest ways to protect your business's reputation and stop criminals sending emails pretending to be you.
Get in touch with Q6IT and we'll be happy to take a look.
Source: Richard Speed, Outlook.com bounces legit emails as Microsoft's authentication crackdown goes sideways, The Register, 9 November 2026.