Microsoft Outlook Rejects Legitimate Emails Due to SPF Validation Errors

Outlook and Microsoft 365 users are reporting email delivery failures caused by apparent SPF, DKIM, and DMARC authentication errors, even when their DNS records are correctly configured.

According to reports on Microsoft’s support forums and Reddit, emails are being rejected with 550 5.7.1 and 550 5.7.23 errors.

The issue appears to affect multiple organizations and email providers, including messages sent from Google and Zoho to Outlook.com and Hotmail accounts.

Outlook rejects emails despite valid authentication records

Administrators report receiving two main errors. The first, 550 5.7.1, states, “Message rejected: Message lacks SPF/DKIM/DMARC Auth Records.” The second, 550 5.7.23, indicates an SPF validation failure.

Several administrators say they have checked their SPF, DKIM, and DMARC records and confirmed that their domains have the correct configurations. However, Outlook continues to reject some messages.

The failures also appear to occur intermittently. Some emails reach their recipients without problems, while others fail authentication checks despite coming from the same sending domain.

Administrators report possible workarounds

Some administrators restored email delivery after adding a missing DMARC record to their domain’s DNS settings. However, this does not explain why messages from domains with valid authentication records also fail.

One Zoho user reported that an email initially rejected by Outlook was delivered successfully after they resent it several minutes later.

The second attempt reportedly passed SPF, DKIM, and Microsoft’s Composite Authentication checks without any configuration changes.

These workarounds come from individual user reports, and Microsoft has not confirmed them as fixes.

Microsoft has not announced an official fix

Microsoft has not publicly acknowledged the reported authentication failures as a widespread service issue or announced an official fix.

For now, affected administrators should verify their DNS authentication records and collect non-delivery reports containing error codes, timestamps, sending IP addresses, and authentication results.

They can submit these details to Microsoft support to help investigate the failures.

In other Outlook news

Microsoft is bringing a unified inbox to the new Outlook while also preparing to remove Copilot Prioritize. Meanwhile, recent time zone changes in Canada have caused Microsoft 365 login problems, although a temporary workaround is available.

Via Neowin