Some of your email to Hotmail and Outlook.com customers may have bounced

Some email from your business to Hotmail and Outlook.com addresses may have bounced last week, and you may not know it.

Microsoft says it has fixed the problem. But a bounced quote doesn't resend itself. And the problem showed something worth checking: whether your company's email settings are actually set up properly.

What happened

Starting around November 5, people began reporting that Microsoft's free personal mailboxes (Outlook.com, Hotmail, Live and MSN) were rejecting some incoming mail. The bounce message read: "550 5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records (AS9031519)."

EasyDMARC, a company that sells email security tools, reproduced the problem on November 8. It used a domain that had two of the three settings in place but was missing the third, called DMARC. Expert Insights reported the same pattern. Windows Latest found that some senders with all three settings done correctly were also bounced at times, and that retrying a few minutes later sometimes worked.

Microsoft then put out an incident notice (EX1545193). It blamed a recent update to its spam rules that wrongly blocked mail. Microsoft said it rolled the update back and that mail is flowing again. It said the problem ran from November 6 at 18:00 UTC to November 9 at 11:02 UTC, and that senders don't need to change anything.

According to EasyDMARC, business mailboxes on Microsoft 365 with their own company domain didn't seem to be affected as recipients.

What this means in plain English

Anyone can send an email that claims to be from your company. Three settings on your domain name help the world tell real mail from fakes:

• SPF is a list of the mail services allowed to send email as you. Think of the approved courier list at a front desk.

• DKIM is a tamper-evident seal on each email. If someone changes the message on the way, the seal breaks.

• DMARC is your instruction sheet. It tells other mail systems what to do when a message fails those checks, such as "let it through," "put it in junk" or "throw it out." It also sends you reports on who's sending mail using your name.

Microsoft says this bounce was a mistake. Still, big mailbox providers keep tightening up, and a domain with no DMARC record is the kind of thing that gets caught when they do.

Why a small business should care

A bounce is a permanent failure. The sending system won't try again on its own. So a quote, invoice or order confirmation sent during those days may simply never have arrived. You'd only find out when the customer calls asking where it is.

And if your domain has no DMARC record, it's easier for a scammer to send fake invoices that look like they came from you.

Who's affected

• Senders whose mail went to Outlook.com, Hotmail, Live or MSN addresses, mostly between November 5 and 9

• Domains with no DMARC record were hit most, but some properly set up senders were bounced too

• Senders on any email service, not just Microsoft's

What to do: everyone

1. Search your inbox for bounce messages from November 5 to 9 that mention "SPF/DKIM/DMARC" or "550 5.7.1".

2. Resend anything important that bounced.

3. If a customer or supplier with a Hotmail or Outlook.com address was waiting on something from you last week, give them a quick call or email to confirm they got it.

What to do: if you run the business

• Find out whether your domain has SPF, DKIM and DMARC records. If nobody knows, that's your answer.

• If there's no DMARC record, have one added. It can start in "watch only" mode, which doesn't block anything but starts sending you reports. Watch-only on its own doesn't stop spoofing, so plan to tighten it once the reports look clean.

• Make sure every service that sends mail as you (your website, accounting software, newsletter tool) is covered by those settings.

Questions to ask your IT provider

• Do we have SPF, DKIM and DMARC set up on our domain, and who manages them?

• Is our DMARC record in watch-only mode, and when can we tighten it?

• Who reads our DMARC reports?

• Are all the outside services that send email for us properly authorized?

Sources

• EasyDMARC: Microsoft Briefly Rejected Mail From Domains Without DMARC. Here's What We Know.

• Expert Insights: Microsoft Is Blocking Emails Sent With No DMARC Record – Here's How To Fix It

• Windows Latest: Your Outlook.com inbox may be silently missing emails since Nov 5, and even senders with valid settings are getting blocked

Contact Nautalex to see how we can help you with your email authentication settings.