Microsoft Partner·Family-run since day one

CCLD Computers

Email authentication fix

Emails bouncing back from Outlook or Hotmail? We'll fix it.

Microsoft now rejects email from domains that don't pass SPF, DKIM and DMARC checks. If your invoices, quotes or newsletters are coming back undelivered, it's almost always a fixable DNS setup issue.

Get a free email health check Call 020 8064 0999
Undeliverable: Mail delivery failed
550 5.7.515 Access denied, sending domain yourdomain.co.uk does not meet the required authentication level.

Bounce codes

Seeing one of these?

550 5.7.515

Outlook.com/Hotmail/Live rejecting your domain because SPF, DKIM or DMARC isn't passing and aligned.

550 5.7.509

Your own DMARC policy is set to reject, and a message from your domain failed the check (often a website form, CRM, Xero or other app sending "as" you).

550 5.7.26

Gmail's equivalent unauthenticated-sender rejection.

Landing in junk

Emails landing in junk instead of bouncing — same root cause, earlier stage.

What changed

Microsoft now enforces email authentication

From 5 May 2025, Microsoft began enforcing authentication requirements for mail sent to Outlook.com, Hotmail.com and Live.com addresses — matching the rules Google and Yahoo introduced in 2024.

The hard rules target domains sending over 5,000 messages a day, but the same checks feed Microsoft's spam filtering at every volume, and Microsoft 365 business tenants also honour senders' DMARC policies. Adding the recipient to Safe Senders doesn't get around it.

Not every small business is being blocked — but it's the most common cause of bounces and junked email we see.

Diagnosis

Common causes we find

  • No DMARC record.
  • SPF missing a sender, or over the 10-lookup limit.
  • DKIM never switched on in Microsoft 365.
  • A third-party sender (Mailchimp, Xero, QuickBooks, website contact forms, CRM, ticketing system, copier scan-to-email) sending as your domain without its own DKIM.
  • DMARC jumped to p=reject without checking reports first.
  • Forwarding breaking SPF.

Our process

How we fix it

Most fixes are done remotely and usually same day once we have DNS access.

  1. 1

    Free health check

    We check your domain's SPF, DKIM and DMARC records and the bounce message you received.

  2. 2

    Find every sender

    We identify every service that sends email as you — Microsoft 365, newsletters, accounts software, website forms, CRM, copiers.

  3. 3

    Correct your DNS

    SPF tidy-up, DKIM switched on for Microsoft 365 and each third-party sender, and DMARC set up with reporting.

  4. 4

    Monitor and enforce

    We monitor DMARC reports and move safely towards quarantine/reject so spoofers can't use your domain.

Why CLD

Why businesses call us

Microsoft Partner

We work with Microsoft 365 every day and know where its email settings hide.

Microsoft 365 specialists

DKIM, SPF and DMARC set up properly for Microsoft 365 and every app that sends as you.

Local team

Family-run and based in Hampton Wick, supporting businesses across South West London, Surrey & Middlesex.

Stops domain spoofing

Enforced DMARC stops criminals sending fake emails in your name.

Part of our wider cybersecurity service. Want the background? Read what UK businesses need to know about Microsoft's email rules.

FAQ

Frequently Asked Questions

Why are my emails bouncing to Hotmail and Outlook addresses?+
From 5 May 2025 Microsoft began enforcing authentication requirements for mail sent to Outlook.com, Hotmail.com and Live.com addresses. If your domain's SPF, DKIM or DMARC records are missing, wrong or not aligned, Microsoft may reject or junk your messages. It's the most common cause of bounces we see.
What does 550 5.7.515 mean?+
It means Outlook.com, Hotmail or Live rejected your message because your sending domain doesn't meet Microsoft's required authentication level — SPF, DKIM or DMARC isn't passing and aligned with your From address.
We only send a few emails a day — does this affect us?+
Microsoft's hard rules target domains sending over 5,000 messages a day, but the same checks feed its spam filtering at every volume, and Microsoft 365 business tenants also honour senders' DMARC policies. Small senders with broken authentication are still far more likely to be junked or rejected.
Can I fix it myself?+
Yes, if you're comfortable editing DNS. Look up the TXT record at _dmarc.yourdomain to check DMARC exists; check your SPF record includes every service that sends as you and stays under 10 lookups; and confirm DKIM is enabled for your domain in the Microsoft Defender portal. Then make sure each third-party sender has its own DKIM set up. If any of that sounds daunting, we're happy to do it for you.
How long does it take?+
Most fixes are done remotely and usually same day once we have access to your DNS. Moving DMARC safely to full enforcement takes a little longer, as we watch the reports first.
Will it stop people spoofing our domain?+
Yes. Once DMARC is enforced at quarantine or reject, receiving servers will block messages pretending to be from your domain — making fake invoices and phishing in your name much harder.

Emails bouncing right now? Call 020 8064 0999 or book a free check

Book a free check Call 020 8064 0999