Microsoft is bouncing emails that fail SPF, DKIM and DMARC — what UK businesses need to know

If you've recently had an email come back with a message like 550 5.7.515 Access denied, sending domain yourdomain.co.uk does not meet the required authentication level, you're not alone. It's now the most common cause of bounced and junked email we see at UK small businesses — and in almost every case it's a fixable setup issue, not a sign your account has been hacked or blacklisted.

Emails bouncing right now? See our email bouncing fix page or call us on 020 8064 0999 for a free email health check.

What changed at Microsoft

From 5 May 2025, Microsoft began enforcing authentication requirements for email sent to Outlook.com, Hotmail.com and Live.com addresses. This brought Microsoft into line with the rules Google and Yahoo introduced in 2024.

The hard rules officially target domains sending more than 5,000 messages a day. But that doesn't mean smaller senders are unaffected. The same checks feed into Microsoft's spam filtering at every volume, so poorly authenticated mail from a small business is far more likely to land in junk or be rejected. On top of that, Microsoft 365 business mailboxes honour the sender's own DMARC policy — so if your domain says "reject anything that fails", that's exactly what will happen.

We're not saying every small business is being blocked. We are saying that when a client tells us their invoices or quotes aren't arriving, missing or broken email authentication is the cause far more often than anything else.

SPF, DKIM and DMARC in plain English

• SPF is a list, published in your DNS, of the services allowed to send email for your domain.
• DKIM adds a digital signature to each message so the receiving server can prove it really came from you and wasn't altered.
• DMARC tells receiving servers what to do if a message fails those checks (nothing, junk it, or reject it) and sends you reports about who is sending as your domain.

Crucially, the checks need to align — the domain in your "From" address has to match the domain that passed SPF or DKIM. That's where many setups quietly fall down.

The bounce messages you might see

• 550 5.7.515 — Outlook.com, Hotmail or Live is rejecting your domain because SPF, DKIM or DMARC isn't passing and aligned.
• 550 5.7.509 — your own DMARC policy is set to reject, and a message from your domain failed the check. This is often a website form, CRM, Xero or another app sending "as" you.
• 550 5.7.26 — Gmail's equivalent rejection for unauthenticated senders.
• Emails landing in junk instead of bouncing — same root cause, just an earlier stage.

One thing that won't help: asking the recipient to add you to their Safe Senders list. Authentication checks happen before that, so it doesn't get around the problem.

The most common causes we find

• No DMARC record at all.
• An SPF record that's missing one of your senders, or that goes over the 10 DNS lookup limit.
• DKIM never switched on in Microsoft 365 — it isn't always enabled by default for your own domain.
• A third-party service sending as your domain without its own DKIM set up: Mailchimp, Xero, QuickBooks, website contact forms, a CRM, a ticketing system, or even the office copier's scan-to-email.
• DMARC set straight to p=reject without checking the reports first, so legitimate mail gets blocked.
• Email forwarding breaking SPF along the way.

Quick self-check

If you're comfortable poking around, here's what to look at:

1. Check your DMARC record. Use any DNS lookup tool to look up the TXT record at _dmarc.yourdomain.co.uk (replace with your own domain). If nothing comes back, you don't have DMARC. If it says p=reject, make sure everything that sends as you is passing first.
2. Check DKIM is enabled in Microsoft 365. In the Microsoft Defender portal, go to Email & collaboration → Policies & rules → Threat policies → Email authentication settings → DKIM. Your domain should show as enabled and valid.
3. List every app that sends email as you. Think beyond Outlook: accounting software, newsletters, your website, booking systems, CRM, helpdesk and printers. Each one needs to be covered by SPF and, ideally, signing with DKIM for your domain.
4. Read the bounce. The code in the bounce message (5.7.515, 5.7.509, 5.7.26) tells you which check failed and who rejected it.

How we fix it

When clients come to us with bouncing email, we work through the same four steps:

1. A free health check of your domain's SPF, DKIM and DMARC, plus the bounce you received.
2. Identify every service that sends email as you.
3. Correct the DNS — tidy up SPF, switch on DKIM for Microsoft 365 and each third-party sender, and set up DMARC with reporting.
4. Monitor the DMARC reports and move safely towards quarantine and then reject, so spoofers can't use your domain either.

Most fixes are done remotely and usually the same day once we have access to your DNS. As a bonus, a properly enforced DMARC policy makes it much harder for criminals to send fake invoices that look like they came from you.

Need a hand?

We're a family-run Microsoft Partner based in Hampton Wick, looking after businesses across South West London, Surrey and Middlesex. If your emails are bouncing to Outlook or Hotmail addresses, book a free email health check or call 020 8064 0999 and we'll tell you exactly what's wrong — in plain English.