"Microsoft is actively investigating the underlying cause of this email delivery issue, and engineering teams are actively analyzing service telemetry and customer-provided data to identify the source of the issue," a moderator in Microsoft's support forum said.
How a validation error started rejecting legitimate mail
At the end of last week a validation error began preventing Outlook.com from accepting legitimate messages. Affected users report non-delivery reports citing SPF validation failures or errors pointing to missing DMARC information. The problem has been widespread across Microsoft's consumer email services and, in some cases, a single-line message is being rejected outright, according to complainants in the Outlook forum.
What Microsoft's tightened authentication rules require
Microsoft tightened the rules for accepting email in 2025 with new requirements aimed at domains that send more than 5,000 messages per day. The 2025 rules require DMARC and SPF compliance and also require DKIM. The technical elements cited by complainants match those requirements: SPF must pass for the sending domain — the domain's DNS record should accurately list authorized IP addresses/hosts; DKIM must pass to validate email integrity and authenticity; and DMARC must include at least p=none and align with either SPF or DKIM (preferably both).
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleIntermittent behavior, vague bounces, and partial fixes
The failure behavior has been intermittent. Some senders who received a bounce report say a simple resend attempt later succeeded. Others describe bounce messages that are vague about the root cause. Many users who insisted their DMARC, SPF, and DKIM settings were already compliant report that changing records to Microsoft's stated preferences restored delivery — suggesting the enforcement is sensitive to particular configuration details or values that Microsoft prefers.
Microsoft's acknowledgement and a related EMEA service change
A Microsoft support forum moderator acknowledged the problem and classified it as a "service degradation." The Register asked Microsoft for more information, but "we have yet to receive a response." Earlier the same day several users in Europe, the Middle East, and Africa were affected by a separate Microsoft change: a "recent service change" that caused some connections to be abruptly terminated. That incident affected Outlook on the web and the Purview and Defender portals. Microsoft reverted the change in the Exchange Online front-end infrastructure and service appeared to return to normal, but the company has not said what, if anything, else might have changed in its email services to cause legitimate messages to bounce.
What this means for technologists, small senders, and end users
- Technologists and security teams: Expect to review and, where necessary, tighten SPF, DKIM and DMARC records to match Microsoft's preferences if you rely on Outlook.com recipients. The issue's intermittency and vague bounce messages mean monitoring and telemetry will be needed to correlate rejections with specific configuration changes or sending patterns.
- Small senders and operators of lower-volume domains: Even single-line messages and low-volume senders may be affected if records are missing or not aligned with Microsoft's rules. Reports indicate that adjusting records to the preferences Microsoft enforces can restore delivery, so administrators should audit DNS records for accurate authorized IPs/hosts and ensure DMARC alignment.
- End users and recipients: Some messages to Outlook.com addresses may be delayed or bounce temporarily; a resend can sometimes succeed. Because the rejection messages may not clearly explain the cause, recipients relying on critical incoming mail should follow up with senders if a message is unexpectedly missing.
The immediate technical facts are straightforward: an authentication-validation rollout or enforcement change is rejecting mail, the company has acknowledged a service degradation, and a partial remediation path exists for administrators who change DNS authentication records to suit Microsoft's preferences. What remains unanswered is which specific enforcement change or telemetry threshold triggered the behaviour and why Microsoft has not yet published a customer advisory explaining the exact configuration settings it expects. For organizations that exchange mail with Outlook.com addresses, the practical next step is a careful audit of SPF, DKIM and DMARC records — and patience while Microsoft completes its investigation.
