# Fix Outlook and Hotmail Rejecting Your Email: Add a DMARC Record

> Emails to Outlook, Hotmail or Live addresses bounce with 550 5.7.1 or go missing? Add one DMARC TXT record at your DNS host and test that it passes.

When emails from your site or mailbox to **Outlook.com, Hotmail, Live or MSN** addresses bounce or never arrive, the usual cause is a missing DMARC record on your sending domain. The fix is one TXT record at your DNS host: name `_dmarc`, value `v=DMARC1; p=none;`. This guide shows how to check for the record, add it, and confirm that Outlook accepts your mail.

## Symptoms

You may see one or more of these:

- A bounce message with `550 5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records`.
- A bounce with `550 5.7.515 Access denied, sending domain [domain] doesn't meet the required authentication level`.
- Messages to Outlook or Hotmail addresses land in Junk or disappear, while Gmail and other inboxes get them.
- It happens even though xCloud shows your SPF and DKIM records as verified.

## Why it happens

Outlook checks three records on the domain in your **From** address:

| Record | What it proves |
|---|---|
| SPF | The server that sent the message is allowed to send for your domain. |
| DKIM | The message was signed by your domain and was not changed on the way. |
| DMARC | Tells the receiving server what to do when SPF or DKIM fail, and requires that at least one of them passes for the same domain as your From address. |

Microsoft [announced in April 2025](https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/strengthening-email-ecosystem-outlook%E2%80%99s-new-requirements-for-high%E2%80%90volume-senders/4399730) that domains sending more than 5,000 emails a day to outlook.com, hotmail.com and live.com addresses must pass SPF and DKIM and publish a DMARC record of at least `p=none`. Some smaller senders also report the `550 5.7.1 ... lacks SPF/DKIM/DMARC Auth Records` rejection (see this [Microsoft Q&A thread](https://learn.microsoft.com/en-us/answers/questions/6063865/550-5-7-1-message-rejected-message-lacks-spf-dkim)); Microsoft has not announced a change. Gmail's [sender guidelines](https://support.google.com/a/answer/81126) also ask bulk senders for a DMARC record. A DMARC record is now the safe default for any domain that sends email.

## Step 1: Check whether your domain has a DMARC record

Run one of these commands from your computer's terminal. Replace `yourdomain.com` with the domain in your From address.

```bash
dig TXT _dmarc.yourdomain.com +short
```

On Windows:

```bash
nslookup -type=TXT _dmarc.yourdomain.com
```

**Expected result:** a line that starts with `v=DMARC1` means you already have a record. Skip to [Step 4](#step-4-make-sure-spf-and-dkim-pass-for-your-from-domain). No answer means the record is missing; continue with Step 2.

If you see two lines that start with `v=DMARC1`, delete one of them at your DNS host. Two DMARC records count as none.

## Step 2: Add the DMARC record at your DNS host

Add **one** TXT record wherever your domain's DNS is managed:

| Field | Value |
|---|---|
| Type | `TXT` |
| Name / Host | `_dmarc` |
| Value / Content | `v=DMARC1; p=none;` |
| TTL | Auto, or the default |

Most DNS hosts add your domain to the name for you, so enter only `_dmarc`. If yours asks for the full name, enter `_dmarc.yourdomain.com`.

Where to add it at common DNS hosts:

- **Cloudflare:** select your domain, go to **DNS → Records**, click **Add record**, choose **TXT**, enter the name and content, then **Save**.
- **GoDaddy:** open your domain's **DNS** page, click **Add New Record**, choose **TXT**, enter `_dmarc` as the host and the value, then save.
- **Namecheap:** open **Domain List → Manage → Advanced DNS**, click **Add New Record**, choose **TXT Record**, enter `_dmarc` as the host and the value, then save.
- **Any other DNS host:** find the DNS or zone editor for your domain, add a TXT record with the values in the table, and save.

Keep these rules in mind:

- **Start with `p=none`.** p=none asks receiving servers not to block or junk your mail because of DMARC, so adding it cannot stop mail that is delivered today. Mail can still be refused if SPF and DKIM both fail, so finish Step 4. Never start at `p=reject`: any service that sends for your domain without proper SPF or DKIM would have its mail refused.
- **One record only.** If a DMARC record already exists, edit it.
- **Optional reports:** to receive daily summaries of who sends mail as your domain, add a `rua` address, for example `v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com`.

**Expected result:** after a few minutes (sometimes up to a few hours), the command from Step 1 returns `v=DMARC1; p=none;`.

## Step 3: If you use xCloud Mail Delivery, check the DMARC row

The xCloud Mail Delivery addon lists a DMARC record with the DNS records it needs for your own sending domain. Use it to confirm the record.

In the xCloud dashboard, open your site and go to **Email Config → Mail Delivery**.

![Open Email Config → Mail Delivery in the site menu, with Use Your Own Domain selected](/_landing/docs/fix-outlook-rejecting-email-add-dmarc-record-image-1.png)

With **Use Your Own Domain** selected, scroll to **DNS Setup**. The DMARC row shows a **TXT** record named `_dmarc.yourdomain.com` with the value `v=DMARC1;p=none;`. Click **Verify Records**.

![The Record(DMARC) row in DNS Setup: TXT, _dmarc.example.com, v=DMARC1;p=none;](/_landing/docs/fix-outlook-rejecting-email-add-dmarc-record-image-2.png)

**Expected result:** a green tick next to the name, with the tooltip **Your DMARC record is added properly.** A red cross means xCloud cannot find the record yet. Check the name and value at your DNS host, wait for DNS to update, and click **Verify Records** again.

If your Cloudflare account is connected to xCloud, you can turn on **Auto Manage DNS Records on Cloudflare** instead of adding the records by hand.

![The Auto Manage DNS Records on Cloudflare toggle on the Mail Delivery page](/_landing/docs/fix-outlook-rejecting-email-add-dmarc-record-image-3.png)

xCloud then adds the DMARC record with `v=DMARC1;p=none;`. **If your domain already has a DMARC record, xCloud replaces its value with `v=DMARC1;p=none;`**, so a stricter policy (`p=quarantine` or `p=reject`) or a `rua` reporting address is removed. If you had one, open Cloudflare's **DNS → Records** afterwards and put your own values back.

For the full Mail Delivery setup, see [how to set up the xCloud Mail Delivery addon](/docs/how-to-set-up-xcloud-mail-delivery-addon/).

### If you use xCloud MailBox

The MailBox addon's **DNS Settings** list does not include a DMARC record. If you send from a MailBox address, add the `_dmarc` record yourself at your DNS host, as in Step 2. See [how to set up the xCloud MailBox addon](/docs/how-to-set-up-xcloud-mailbox-addon/) for the records MailBox needs.

## Step 4: Make sure SPF and DKIM pass for your From domain

DMARC passes only when SPF or DKIM passes **for the same domain as your From address**. Check these:

- **One SPF record per domain.** It must include every service that sends for the domain, for example `include:xcloud.email` for Mail Delivery next to the include of your mailbox provider. Two SPF records make SPF fail.
- **DKIM verified for the From domain.** In Mail Delivery, the DKIM row must show a green tick for the domain you send from.
- **The From address uses that domain.** If your site sends as `wordpress@yourdomain.com` but you verified `otherdomain.com`, the domains do not match. Set **From Email** on the Mail Delivery page to an address on the verified domain.

## Step 5: Send a test and read the headers

1. Send a new message from your site or mailbox to an Outlook.com or Hotmail address you can read.
2. In Outlook.com, open the message and view its source (**More actions → View → View message source**).
3. Find the `Authentication-Results` line.

**Expected result:** you see `dmarc=pass`, together with `spf=pass` or `dkim=pass`. If you see `dmarc=fail` or `dmarc=none`, recheck Steps 1 to 4. Messages that bounced earlier are not resent; send them again after the test passes.

## Frequently asked questions

### My SPF and DKIM already pass. Why does Outlook still reject my email?

Outlook also looks for a DMARC record on your domain. SPF and DKIM prove who sent the message, and DMARC tells the receiving server what to do when those checks fail. Without a TXT record at _dmarc.yourdomain.com, Outlook treats your domain as unauthenticated and can reject the mail, even when SPF and DKIM pass. Add v=DMARC1; p=none; and send a new test message.

### Is p=none safe? Will it block my own email?

Yes, p=none is safe to add. It asks receiving servers not to block or junk your mail because of DMARC, so adding it cannot stop mail that is delivered today. Mail can still be refused if SPF and DKIM both fail, so make sure they pass (Step 4). It is the minimum that Outlook.com and Gmail ask bulk senders for. Move to p=quarantine or p=reject only after you have checked that every service that sends for your domain passes SPF or DKIM.

### Can I have two DMARC records?

No. A domain can have only one DMARC record. With two TXT records at _dmarc.yourdomain.com, receiving servers treat your domain as having no DMARC record, so Outlook can still reject your mail. If you already have one, edit it instead of adding a second.

If you run into any issues with email delivery, feel free to reach out to our [support team](/docs/access-built-in-support-portal-in-xcloud/).