Emails to Outlook or Hotmail are being rejected: adding a DMARC record

Kieran 09 Nov, 2026 cPanel, Email, Plesk

If emails you send to Outlook, Hotmail, Live or MSN addresses are bouncing back, the most likely cause is that your domain has no DMARC record. Adding a basic one fixes this in most cases.

If your domain uses our nameservers, we can add the record for you. Just contact our support team at www.freethought.uk/contact/ and let us know which domain is affected.

What the bounce looks like

You will usually receive a bounce message (also called a non-delivery report) that includes a line like this:

550 5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records

The bounce normally comes from an address ending in outlook.com or protection.outlook.com.

Not every message bounces. Some get through and some don’t, so it can look random. If you see this error even once, your domain needs a DMARC record.

Why this is happening

Since early November 2026, Microsoft’s consumer email services (Outlook.com, Hotmail, Live and MSN) have started rejecting some emails from domains that have no DMARC record. This applies to small senders too, not just businesses sending large volumes.

Your email account and our servers are working normally. Microsoft is refusing the message because it cannot find a DMARC record for your domain.

DMARC works alongside two other records on your domain:

SPF lists which servers are allowed to send email for your domain
DKIM adds a digital signature to your emails so they can be checked
DMARC tells receiving servers what to do if a message fails those checks

Most domains hosted with us already have SPF and DKIM set up. DMARC is the one that is often missing.

What a basic DMARC record looks like

A basic DMARC record is a single TXT record:

Name / Host: _dmarc
Type: TXT
Value: v=DMARC1; p=none;

The p=none part means “monitor only”. It does not change how any of your emails are handled, so it cannot cause mail to be blocked. It simply shows receiving servers that your domain has a DMARC policy in place, which is what Microsoft checks for.

A domain should only ever have one DMARC record. If you already have one, don’t add a second. Two DMARC records count as an error and can make delivery worse.

Adding the record yourself

The steps depend on where your domain’s DNS is managed.

If your domain uses our nameservers and you have cPanel

Log in to cPanel
Go to Domains and click Zone Editor
Click Manage next to your domain
Check the list for an existing record named _dmarc. If there is one, stop here, as you already have DMARC
Click Add Record and set the type to TXT
In the Name field, enter _dmarc (cPanel will add your domain name automatically)
In the Record field, enter v=DMARC1; p=none;
Click Save Record

If your domain uses our nameservers and you have Plesk

Log in to Plesk
Go to Websites & Domains and select your domain
Open DNS Settings
Check the list for an existing record for _dmarc. If there is one, you already have DMARC
Click Add Record and choose TXT as the record type
In the Domain name field, enter _dmarc
In the TXT record field, enter v=DMARC1; p=none;
Click OK, then Update if Plesk asks you to apply the changes

If you use ULTRA Cloud Panel

Contact our support team at www.freethought.uk/contact/ and we will add the record for you.

If your DNS is managed somewhere else

If your domain’s nameservers point to another provider, such as Cloudflare, GoDaddy or your domain registrar, the record needs to be added there. Adding it in your control panel with us will have no effect.

How long it takes

DNS changes usually take effect within a few hours, but can take up to 24 hours. Emails that bounced before the record was added will not be retried, so you will need to send them again.

If emails still bounce

DMARC relies on SPF and DKIM. If either of those is missing or wrong, adding DMARC alone may not be enough.

If you send email through our servers, check your records using our guide on checking your email deliverability in cPanel
If you send email through another service, such as Microsoft 365, Google Workspace, Mailchimp or a website form plugin that uses an external mail service, that service needs to be included in your SPF record or set up with DKIM for your domain. The service’s own help pages will give you the records to add

If you are still having problems after 24 hours, contact our support team at www.freethought.uk/contact/ and include a copy of the bounce message.

Stricter DMARC policies

You may see advice to use a stricter policy, such as p=quarantine or p=reject. These tell receiving servers to send failing emails to spam or reject them completely.

We don’t recommend starting with a stricter policy. If any service that sends email as your domain is not fully set up with SPF or DKIM, a stricter policy will cause those genuine emails to be blocked. p=none is the safe starting point, and you can tighten it later once you are confident everything that sends as your domain passes SPF or DKIM.

Have a Question?