# Outlook and Hotmail Are Rejecting Emails Without DMARC: How to Fix It

> Outlook rejecting emails from your domain? Read the bounce, add one DMARC record at your DNS host, keep SPF and DKIM passing, and set it up on xCloud.

**Outlook rejecting emails** from your domain usually means your mail failed an authentication check, and a missing **DMARC** record is the quickest gap to close. Read the bounce, add one TXT record at `_dmarc.yourdomain.com` with `v=DMARC1; p=none;`, and make sure SPF or DKIM passes for your From domain.

It tends to show up as a quiet problem. A WooCommerce store sends order confirmations all day, and then a customer with a Hotmail address writes in to ask where their receipt went. Password resets and contact form replies go missing the same way. If you are not sure why a site needs its own sending domain in the first place, start with [**why your business needs a domain email address**](/why-does-your-business-need-a-domain-email-address/).

This guide covers what changed at Microsoft, what DMARC does next to SPF and DKIM, how to tell whether you are affected, how to add the record at the common DNS hosts, and how to do it on xCloud.

## TL;DR

Short on time? Here is the whole guide in a few lines:

- **Microsoft's rule (2025):** domains that send more than 5,000 emails a day to Outlook.com, Hotmail and Live need SPF, DKIM and a DMARC record of at least `p=none`. Non-compliant mail is refused with **550 5.7.515**.
- **What senders report (November 2026):** smaller domains also bouncing with **550 5.7.1 … lacks SPF/DKIM/DMARC Auth Records**. Microsoft has not announced this change.
- **The fix:** one TXT record at `_dmarc` with `v=DMARC1; p=none;`, plus SPF or DKIM passing for the same domain as your From address.
- **One record only:** two DMARC records cancel each other out.
- **On xCloud:** Mail Delivery shows and verifies all four email records, and can add them on Cloudflare in one click. MailBox users add `_dmarc` by hand.
- **Limits:** DMARC gets you past the door. It does not promise the inbox.

## The Finding: xCloud's One-Click DMARC Replaces the Record You Already Have

Most guides stop at "add a DMARC record". Here is the part that matters if you already have one: when you use **Auto Manage DNS Records on Cloudflare** in xCloud's Mail Delivery setup, xCloud **replaces the value of any existing DMARC record** with `v=DMARC1;p=none;`.

It does this on purpose. The DMARC standard says that when a receiver finds more than one DMARC record, it stops and applies no DMARC policy at all, so a second record would silently break your setup. Replacing is the safe default.

The catch worth knowing: if your domain already had `p=quarantine`, `p=reject` or a `rua=` report address, open your DNS zone after auto-manage and put your stricter policy and report address back. If you have no DMARC record yet, the one-click result is exactly the safe starting point this guide recommends.

## What Changed at Microsoft

### The 2025 rules for high-volume senders

On 2 April 2025, Microsoft published [**Outlook's new requirements for high-volume senders**](https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/strengthening-email-ecosystem-outlook%E2%80%99s-new-requirements-for-high%E2%80%90volume-senders/4399730). The rules apply to Outlook.com, Microsoft's consumer service, which covers **hotmail.com, live.com and outlook.com** addresses.

For domains sending more than **5,000 emails a day**, SPF must pass, DKIM must pass, and DMARC must be at least `p=none` and aligned with SPF or DKIM. Enforcement started on 5 May 2025, and Microsoft updated the post to say non-compliant mail is rejected with:

`550; 5.7.515 Access denied, sending domain [SendingDomain] does not meet the required authentication level.`

### The November 2026 reports from smaller senders

In early November 2026, senders started reporting a different bounce on [**Microsoft's Q&A forum**](https://learn.microsoft.com/en-us/answers/questions/6063865/550-5-7-1-message-rejected-message-lacks-spf-dkim):

`550 5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records`

Senders in the thread say their domains send far fewer than 5,000 emails a day, and some say adding a `_dmarc` record stopped the bounces. **Microsoft has made no announcement** about this, and not every sender is hit, so treat it as what senders see rather than a published rule.

Gmail is on the same path. Google's [**email sender guidelines**](https://support.google.com/a/answer/81126) have required DMARC from senders of more than 5,000 messages a day since 1 February 2024, with a policy that "can be set to none".

## What Is DMARC, With SPF and DKIM?

**DMARC is a DNS record that tells receiving mail servers what to do when an email claiming to be from your domain fails its checks, and where to send reports about it.** It sits on top of two older checks.

Think of it like a building's front desk. SPF is the list of couriers allowed to deliver for you. DKIM is the tamper-proof seal on each parcel. DMARC is your note to the desk: "if a parcel has neither a listed courier nor my seal, here is what to do with it, and please tell me."

| Record | Where it lives | What it proves | Example value |
|---|---|---|---|
| **SPF** | TXT at `yourdomain.com` | The sending server is allowed to send for your domain | `v=spf1 a mx include:xcloud.email ~all` |
| **DKIM** | TXT at `selector._domainkey.yourdomain.com` | The message was signed by your domain and not changed | `v=DKIM1; k=rsa; p=MIIB…` |
| **DMARC** | TXT at `_dmarc.yourdomain.com` | What to do when SPF and DKIM both fail to match your From domain | `v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com` |

A few things worth knowing:

- **Alignment is the key word.** DMARC passes only when SPF or DKIM passes **for the same domain** as the visible From address, or a subdomain of it.
- **`p=none` blocks nothing.** It asks receivers to deliver as usual and report. That is what Microsoft's rule asks for at minimum.
- **One SPF record and one DMARC record per domain.** Extra copies break the check instead of strengthening it.

![How a receiving server checks SPF, DKIM and DMARC before it accepts or rejects an email](/_landing/blog/outlook-rejecting-emails-without-dmarc-image-1.png)

## Are You Affected? Read the Bounce, Then Check _dmarc

### Step 1: Read the bounce message

The bounce (often called an NDR) tells you most of the story. Ask the customer to forward it, or find it in your email provider's logs.

| Bounce text | What it means | First fix |
|---|---|---|
| `550 5.7.515 … does not meet the required authentication level` | Microsoft's high-volume rule: SPF, DKIM or DMARC is missing or not aligned | Check all three records |
| `550 5.7.1 … lacks SPF/DKIM/DMARC Auth Records` | Reported by senders since November 2026, including low-volume domains | Add DMARC, then confirm SPF and DKIM |
| Mail accepted but lands in Junk | Authentication passed or partly passed; reputation or content is the issue | Check DKIM, sending volume and content |

### Step 2: Check whether a DMARC record exists

Run this from any terminal:

```bash
dig +short TXT _dmarc.yourdomain.com
```

No output means no DMARC record. If you prefer a browser, xCloud's free [**DNS checker**](/tools/dns-checker/) looks up NS, A, MX, SPF, DKIM and DMARC for any domain and grades each one.

### Step 3: Check SPF and DKIM for the domain you send from

DMARC needs one of them to pass and align. The usual WordPress gap: the site sends with PHP mail straight from the web server, and that server is not in the domain's SPF record and does not sign with DKIM. Both checks fail, so DMARC fails even after you add the record.

## Add the DMARC Record at Your DNS Host

Add the record where your domain's DNS is managed, which is not always where you bought the domain. If your nameservers point to Cloudflare, add it in Cloudflare.

| DNS host | Where to add it | Name / Host field | Value |
|---|---|---|---|
| **Cloudflare** | Your domain → **DNS** → **Records** → **Add record**, type **TXT** | `_dmarc` | `v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com` |
| **Any other host** (GoDaddy, Namecheap and others) | Open your domain's DNS settings and add a new TXT record | `_dmarc` (some hosts want `_dmarc.yourdomain.com`) | Same value |

Two details trip people up:

- **Leave out the domain if the host adds it.** Most panels append your domain to the name automatically, so `_dmarc.yourdomain.com` typed in full becomes `_dmarc.yourdomain.com.yourdomain.com`.
- **Use a report address you read.** `rua=` is optional, but without it you never see who fails. A mailbox on the same domain is the simplest choice.

Wait for the record to publish, run the `dig` command again, then send a test email to an Outlook or Hotmail address.

## From p=none to p=reject: A Safe Rollout

`p=none` fixes the bounce. It does not stop anyone from sending email that pretends to be you. That needs `quarantine` or `reject`, and moving there too fast is how real order emails end up blocked by your own policy.

![DMARC rollout from p=none to quarantine to reject](/_landing/blog/outlook-rejecting-emails-without-dmarc-image-2.png)

| Stage | Record | What receivers do | Move on when |
|---|---|---|---|
| **1. Monitor** | `v=DMARC1; p=none; rua=mailto:…` | Deliver as usual, send you reports | Reports show every real sender passing |
| **2. Quarantine** | `v=DMARC1; p=quarantine; rua=mailto:…` | Treat failing mail as suspicious (usually Junk) | No real mail has been caught for a while |
| **3. Reject** | `v=DMARC1; p=reject; rua=mailto:…` | Refuse failing mail | Stay here, keep reading reports |

Before you tighten the policy, list every service that sends as your domain: the WordPress sites, your mailbox provider, newsletters, the helpdesk, invoicing. Each one needs SPF or DKIM aligned with your domain. Treat the timing as a starting point rather than a strict rule; a domain with one sender can move faster than an agency domain with ten.

## Doing It on xCloud

### Mail Delivery: four records, verified in the dashboard

xCloud's [**Mail Delivery**](/mail-delivery/) sends your WordPress site's emails (orders, password resets, forms) through an authenticated email service instead of the server's PHP mail. When you use your own domain, the site's **Email Config → Mail Delivery** page shows the four records to add: SPF, the tracking CNAME, DKIM and DMARC (`v=DMARC1;p=none;`). **Verify Records** checks each one.

The DKIM value is unique to each sending domain, so copy it from your own Mail Delivery page. 👉 The full steps are in [**how to set up the xCloud Mail Delivery addon**](/docs/how-to-set-up-xcloud-mail-delivery-addon/).

### Cloudflare connected: Auto Manage DNS Records

If the domain's DNS is on Cloudflare and Cloudflare is [**integrated with xCloud**](/docs/using-xcloud-with-cloudflare-for-dns-management/), turn on **Auto Manage DNS Records on Cloudflare**. xCloud adds and verifies the records for you. Before it runs, xCloud asks you to confirm and tells you existing DMARC records will be updated. It merges `include:xcloud.email` into an SPF record you already have instead of adding a second one.

For DMARC, remember the finding above: an existing DMARC value is replaced with `v=DMARC1;p=none;`. Check the record afterwards if you had a stricter policy.

### MailBox: add _dmarc yourself

The [**MailBox addon**](/mailbox/) gives you inboxes on your domain. Its **DNS Settings** list the records MailBox needs, and a DMARC record is not one of them. If the domain sends mail only through MailBox, add the `_dmarc` record at your DNS host using the table above. 👉 See [**how to set up the xCloud MailBox addon**](/docs/how-to-set-up-xcloud-mailbox-addon/).

### Using another email service

If your sites send through Mailgun, SES or another service, the same rules apply: verify the domain with that service so it signs with DKIM, then add DMARC. 👉 [**Setting up site emails with any SMTP provider**](/docs/setting-up-site-emails-for-wordpress-on-xcloud/) covers the xCloud side. For choosing a service, see [**the best transactional email services**](/top-best-transactional-email-services/) and [**SMTP and email API providers for SaaS**](/best-smtp-and-email-api-providers-for-saas/).

## What DMARC Does Not Do (and How to Undo It)

Here is the honest part:

- **DMARC does not guarantee the inbox.** It gets your mail past the authentication check. Content, complaint rates and your domain's reputation still decide Junk or inbox.
- **It does not fix a failing sender.** If WordPress sends from a server outside your SPF record with no DKIM, DMARC fails until you change how the site sends.
- **xCloud does not read DMARC reports for you.** Reports arrive at your `rua` address as XML attachments; use a report reader or a reporting service to make sense of them.
- **MailBox does not add a DMARC record.** You add it at your DNS host.
- **Undoing it is one edit.** If a stricter policy blocks real mail, change the record back to `p=none` (or delete it) at your DNS host. Receivers pick up the change once their cached copy expires.

## Get Your Order Emails Back Into Outlook Inboxes This Week

Start with the bounce. If it names SPF, DKIM or DMARC, add one `_dmarc` record with `p=none`, confirm SPF or DKIM passes for your From domain, and send a test to a Hotmail address. That is usually the whole fix.

Then make it last. Read the reports for a few weeks, list every service that sends as your domain, and tighten the policy only when all of them pass. If your WordPress sites still send with PHP mail, moving them to an authenticated service such as Mail Delivery fixes the root cause, not just the bounce.

If you have found this blog helpful, feel free to [**subscribe to our blogs**](https://xcloud.host/blog/) for valuable tutorials, guides, knowledge, and tips on web hosting and server management. You can also join our [**Facebook community**](https://www.facebook.com/groups/xcloud.community) to share insights and engage in discussions.

## Frequently Asked Questions

### Why is Outlook rejecting emails from my domain all of a sudden?

The most common reason is missing email authentication. Microsoft requires SPF, DKIM and DMARC from domains that send more than 5,000 emails a day to Outlook.com, Hotmail and Live addresses. In early November 2026, smaller senders also reported bounces that name missing SPF, DKIM or DMARC records, so check all three.

### Is p=none enough to stop the bounces?

For Microsoft's published rule, yes: it asks for a DMARC record of at least p=none, aligned with SPF or DKIM. p=none only asks receivers to report, not to block, so it is the safe first step. Move to quarantine and reject once your reports show every real sender passing.

### Can I have two DMARC records?

No. A domain needs exactly one TXT record at _dmarc. With two or more, receivers ignore DMARC for that domain, which is the same as having none. Merge them into one record.

### I added a DMARC record but Hotmail still bounces my WordPress emails. What should I check?

Check that SPF or DKIM passes for the same domain as your From address. WordPress sending with PHP mail from a server that is not in your SPF record fails both, so DMARC fails too. Send through an authenticated email service such as Mail Delivery, then test again.

### Does xCloud add the DMARC record for me?

With Mail Delivery and Cloudflare connected, Auto Manage DNS Records on Cloudflare adds a DMARC record of v=DMARC1;p=none; and verifies it. If a DMARC record already exists, xCloud replaces its value with that one, so check it afterwards if you had a stricter policy or a report address. MailBox does not show a DMARC record, so add it at your DNS host.