Microsoft’s email security filters, designed to block malicious messages, are now rejecting legitimate emails sent to consumer addresses like Outlook, Hotmail, Live, and MSN. The issue began on November 5 and continues as of November 10, 2026, with no official announcement from Microsoft. The problem appears to stem from a sudden enforcement of DMARC (domain-based message authentication, reporting, and conformance) records, which verify the authenticity of email senders.
Previously, Microsoft only required DMARC for domains sending more than 5,000 messages daily. However, since November 5, even small senders without DMARC, SPF (Sender Policy Framework), or DKIM (DomainKeys Identified Mail) have seen their emails bounced. Users report inconsistent errors, with some messages delivered while others are rejected, adding to the confusion.
Frank Dickson of Dickson Research noted that while requiring DMARC improves email security, implementing it without notice and with unclear error messages creates chaos. The inconsistency of the failures is particularly problematic, as recipients may never realize they missed important emails, such as invoices or appointment confirmations.
To address the issue, enterprises can check if their domain has a DMARC record using a terminal command. A simple fix involves adding a basic DMARC record (v=DMARC1; p=none) to stop bounces without altering how other receivers treat the mail. Dickson advises organizations to inventory all services sending emails on their behalf and ensure DMARC compliance across all domains.