Outlook SPF validation error: Microsoft bounces legit email

If you run your own mail server, or your small business sends invoices from a domain you set up yourself years ago, check your bounces. Since the end of last week, Hotmail and Outlook.com have been rejecting perfectly legitimate email with an Outlook SPF validation error, and Microsoft hasn’t bothered to tell anyone what changed.

Here’s the picture. Last year Microsoft announced that domains sending more than 5,000 emails a day to its consumer services would need the full trinity: SPF passing, DKIM passing, and a DMARC record of at least p=none aligned with one of them. Fair enough, Google and Yahoo did the same thing in 2024 and the spam situation didn’t get worse for it.

Except that the rule was for bulk senders. What people are seeing now, as The Register reports, is that “a single email with just one line” from a tiny domain gets bounced with an SPF error, or a note about missing DMARC. Nobody sending twelve emails a day to a client on Hotmail signed up for bulk-sender rules.

Outlook SPF validation error: what’s going on

Officially, not much is known. A moderator on Microsoft’s support forum acknowledged the problem and said it was “classified as a service degradation”, with engineering teams “actively analyzing service telemetry and customer-provided data”. That’s corporate for “we flipped a switch and now we’re reading the logs”. No advisory to customers, no changelog, no reply to the press at the time of writing.

The behaviour is also intermittent, which makes it maddening to debug. People report that a message bounces, then the exact same message gets through on a resend. Some admins swear their SPF, DKIM and DMARC are already textbook and still get rejected. Others changed a record, waited, and watched mail start flowing again, without being able to say which change did it. That’s not a policy, that’s a coin flip.

And it dropped the same day Microsoft had to revert a separate “recent service change” that was abruptly killing connections to Outlook on the web and the Purview and Defender portals across Europe, the Middle East and Africa. Two self-inflicted email outages on a Monday. Busy weekend in Redmond.

How to fix SPF, DKIM and DMARC

I’m not going to pretend the rules themselves are wrong. If you send mail from your own domain in 2026, you should have all three anyway, and the Outlook mess is as good an excuse as any to clean house. What I’d check, in order:

First, SPF. Your TXT record must list every host or IP that actually sends for your domain, including that newsletter tool and the web server that sends password resets. Stay under the 10 DNS lookup limit, end with ~all or -all, and don’t publish two SPF records (it happens more than you’d think, and it fails validation outright).

Second, DKIM. Sign outgoing mail with a 2048-bit key and make sure the selector in your DNS matches the one your server uses. Send yourself a message at a Gmail address and read the headers: you want dkim=pass.

Third, DMARC. A single TXT record at _dmarc.yourdomain with v=DMARC1; p=none; rua=mailto:you@yourdomain is enough to satisfy Microsoft and costs you nothing. Just make sure the From domain matches the one in your SPF or DKIM signature, that’s the “alignment” part everyone forgets.

And if everything already checks out and Outlook still bounces you? Queue and retry. Given how random the rejections are right now, your mail server’s normal retry schedule will probably get it through, which tells you everything about how well tested this rollout was.

The cynical take: Microsoft just outsourced its spam-filter QA to every small sysadmin on the planet, for free. The practical take: fix your DNS this week anyway, because the next provider to tighten the screws won’t warn you either.

Email is forty-five years old and still breaks because someone changed a setting on a Friday.