Thinking Thinking
A small server corner with one rack, two network switches, dense patch cables and a monitor showing soft blue.
Illustration by Thinking

News

Outlook.com bounced legitimate business mail for two weeks

Microsoft confirmed on 10 November 2026 that a spam rule update wrongly blocked legitimate email to Outlook.com, Hotmail and Live addresses, and said it was fixed a day later.

By Thinking Desk 2 min read

Key takeaways

  • The Register reported mail to Outlook.com, Hotmail and Live addresses bouncing from late October 2026, affecting small senders as well as bulk ones.
  • Microsoft acknowledged on 10 November that a spam enforcement rule update wrongly marked and blocked messages, and reported a fix on 11 November.
  • The underlying policy is unchanged: senders above 5,000 messages a day must pass SPF, DKIM and DMARC with at least p=none.
  • Non-compliant mail has been rejected with error 550 5.7.515 since 5 May 2025 instead of being filed as junk.
On this page
  1. Why is Outlook.com bouncing legitimate business email?
  2. What are Microsoft's sender requirements for Outlook.com?
  3. How do you tell a policy rejection from the November fault?
  4. What it means for a small or mid-sized European operator

Why is Outlook.com bouncing legitimate business email?

Microsoft broke its own spam enforcement and sent legitimate business mail back to senders. The Register reported on 9 November 2026 that messages to Outlook.com, Hotmail and Live addresses had been rejected since late October, including single-line mails from very small senders, with vague error text and intermittent behaviour, so a resend sometimes went through where the first attempt failed. Microsoft acknowledged the fault on 10 November, saying that "a recent update to the spam enforcement rules caused email messages to be incorrectly marked and blocked", and reported it resolved the following day.

The important detail for anyone invoicing or confirming appointments by mail is that this was a bug sitting on top of a real policy. The policy did not go away when the bug was fixed.

What are Microsoft's sender requirements for Outlook.com?

Microsoft requires domains sending more than 5,000 messages a day to Outlook.com consumer addresses to pass SPF, DKIM and DMARC. Its own guidance for high volume senders sets the bar as an SPF record that correctly lists the authorised sending hosts, a passing DKIM signature, and a DMARC record with a policy of at least p=none that is aligned with SPF or DKIM, preferably both. Since 5 May 2025, non-compliant mail is rejected outright with error code 550 5.7.515 rather than filed in the junk folder as it was during the earlier grace period, and a recipient's safe sender list does not rescue it.

Microsoft also expects the surrounding hygiene: a valid From address, a working unsubscribe mechanism and list maintenance.

Weekly, Thursday morning, Central European Time.

The Thinking briefing

One email a week: what changed in European business software, which prices moved, and which comparison we published. No sales mail.

We store your address to send the briefing. One click unsubscribes you, and we never pass it on.

How do you tell a policy rejection from the November fault?

Read the bounce. A 550 5.7.515 rejection is the authentication policy and it is yours to fix in DNS. The late October and early November wave looked different: inconsistent failures, unclear errors, and senders well under any volume threshold. If your mail is still bouncing now that Microsoft says the issue is resolved, treat it as a configuration problem on your side and not as a Microsoft outage.

What it means for a small or mid-sized European operator

A booking confirmation, a quotation or an invoice that silently fails to a Hotmail address is lost revenue, and a lot of European consumer mailboxes are Outlook.com, Hotmail or Live. Three things are worth doing this week. Publish SPF, DKIM and DMARC for every domain and subdomain you actually send from, including the one your booking tool or accounting package sends through, because those vendor-relayed domains are the ones usually left unauthenticated. Then check whether your software sends on your behalf from its own domain, since that changes who has to fix the DNS. Finally, collect bounces somewhere a human reads them: the two week gap between the first failures and Microsoft's acknowledgement is exactly how long an unmonitored bounce mailbox hides a revenue problem. If you are reviewing the mail client in front of that pipeline, see /en/best/best-ai-email-clients-2026, and for the system that generates the invoices themselves, /en/best/best-accounting-software-luxembourg-2026.

Questions and answers

Does the 5,000 message threshold mean small senders are safe?
The documented high volume requirement starts above 5,000 messages a day to Outlook.com consumer addresses, but The Register reported very small senders caught by the November fault. Authentication is worth having at any volume, because it is also what gets you out of the junk folder.
What does error 550 5.7.515 mean?
It is Microsoft rejecting a message for failing its sender authentication requirements. It is fixed in your DNS by publishing correct SPF, DKIM and DMARC records for the sending domain, not by asking the recipient to allow you.

Sources

Every price and fact above was checked against these pages on the date shown.

  1. [1] The Register: Outlook.com bounces legit emails as Microsoft's authentication crackdown goes sideways accessed 2026-11-11
  2. [2] Microsoft: Outlook's new requirements for high volume senders accessed 2026-11-11
Topics emailmicrosoftdeliverabilitydmarcspf