DMARC Is Becoming A Business Requirement

Do you know if your business email getting through? In November of 2026 we have seen a major change in how email providers are handling emails and this could mean that many Small to Medium Businesses who do not have DMARC set up could find their emails not being delivered, with users reporting that they are receiving errors such as;
550 5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records

What would happen when;

• An invoice doesn’t reach a customer?
• A quotation that goes unanswered?
• An appointment confirmation fails to arrive?

When email delivery stops working, the impact reaches far beyond your IT systems. It can delay payments, disrupt customer service and leave people questioning whether your business has responded (or is even still in business). Stricter email authentication requirements are making it increasingly important to check how your business sends email.

DMARC is a key part of that protection, helping receiving email systems distinguish legitimate messages from attempts to impersonate your domain/web address (anything after the @ in your email address). But what is actually required, what has recently changed, and what should your business do?

 

What is DMARC?

DMARC stands for Domain-based Message Authentication, Reporting and Conformance. Put simply, it helps protect the use of your business’s email domain, the part after the @ symbol.

It works alongside two other checks;

SPF identifies servers authorised to send email for a domain.

DKIM adds a digital signature that receiving systems can verify.

DMARC connects authentication to the domain people see in the sender’s address. It also lets your business publish a policy requesting how receiving systems should handle messages that fail those checks. With reporting configured, it provides visibility into email claiming to come from your domain.

For businesses, the practical benefits are stronger protection against domain impersonation and better oversight of legitimate email delivery.

 

What requirements have already changed?

Microsoft introduced stricter requirements from May 5th 2025 for domains sending more than 5,000 emails a day to its consumer email services, including Outlook.com, Hotmail and Live.com.

Those senders must meet SPF, DKIM and DMARC requirements. Microsoft accepts a DMARC policy of p=none as the minimum, alongside the required authentication and domain alignment. Messages that do not meet its requirements can be rejected. These published rules concern delivery to Microsoft’s consumer services, rather than a blanket requirement covering every Microsoft 365 business mailbox.

Google also requires SPF, DKIM and DMARC for bulk senders to personal Gmail accounts. Its baseline requirements for all senders include SPF or DKIM, while it recommends all three technologies to improve delivery and protection.

However, as of November 5th 2026 Microsoft are now enforcing these same requirements for lower volume senders.

 

Are small to medium businesses now affected too?

Recent reports suggest that some smaller senders (under the previous 5,000 emails a day requirement) are experiencing authentication-related rejections when emailing Microsoft consumer addresses.

Reports in Microsoft’s community support forums describe intermittent failures in early November 2026, including this error:

550 5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Records (AS9031519)

businesses who have been receiving these errors have then reported improvements after adding DMARC and other records to their email service provider, however Microsoft have yet to provide a formal announcement regarding the change.

Regardless, the sensible response is to review your email configuration, email security and investigate failures, without assuming that every bounce has the same cause. Correctly implementing SPF, DKIM & DMARC can drastically increase email security and reduce the risk of your business being impersonated.

 

Why this matters even if you only send a few emails

Your business does not need to send thousands of marketing messages for email delivery to matter.

• A recruitment company may contact applicants using personal addresses.
• A trades business may send quotations to homeowners.
• A logistics firm may need to send delivery notes.
• A manufacturer may need to email suppliers.
• An accountant may email clients’ Hotmail accounts.

In each case, one failed message could delay an important conversation or harm business operations.

But it is also important to understand the potential reputational risk. If criminals forge/fake your business’s email domain, recipients may associate these fraudulent messages with your business. Correctly enforced DMARC helps receiving systems identify and act on this type of impersonation.

It’s also important to remember that it does not prevent every phishing attempt. Criminals can still use similar-looking domains, misleading display names or compromised accounts to attempt to phish your business. However, DMARC should be implemented along side wider approach to cyber security which includes Active Email Threat Protection that uses AI to analyse the emails your business receives. Do they include unusual requests? Is the display name different to the email domain? Are links being directed to malicious sites? Are email attachments a potential threat? Active Email Threat Protection analyses all of this and more.

 

Having a DMARC record is only the starting point

A basic DMARC record and an enforced DMARC policy provide different levels of protection.

Monitoring, or p=none, requests no specific action against messages that fail DMARC. When reporting is configured, it helps your IT team understand which systems are sending email and identify problems.

Quarantine, or p=quarantine, asks receiving systems to treat failing messages as suspicious, for example by placing them in junk.

Reject, or p=reject, asks receiving systems to refuse messages that fail DMARC. Receiving systems ultimately apply their own handling rules.

There is another important detail: publishing v=DMARC1; p=none alone does not request aggregate reports. A reporting destination must also be configured.

Microsoft recommends a gradual rollout, checking legitimate email before moving towards rejection. Switching immediately to a strict policy can disrupt genuine messages if their authentication has not been configured correctly. At TwentyFour we work with businesses to ensure that email security policies are correctly configured and implemented to avoid disruption to operations.

 

What should your business do now?

Start by asking your IT team or Managed Service Provider (MSP) to review your domain’s SPF, DKIM and DMARC configuration, alongside any systems sending email on your behalf.

Ask for a clear explanation of whether your current setup simply monitors activity or actively requests protection against unauthorised messages. Understand if you have tools in place to protect against phishing or other malicious emails, agree a controlled approach to strengthening that protection and reviewing it whenever new sending systems are introduced.

What if messages are already bouncing?

If messages are already bouncing, retain the full delivery failure notification and pass it to your IT team or Managed Service Provider so that they can investigate and remediate the cause. For urgent customer communications that you can not get through on email, use another legitimate established contact method while the issue is resolved.

It is important to remember that correct authentication supports reliable delivery, but it cannot guarantee inbox placement. Spam filtering, sender reputation and other delivery checks still apply. If you would like to review your email security and sender reputation score. Complete our email compliance checker to find out more.

 

Protect your business email with TwentyFour

You shouldn’t need to understand email authentication acronyms like DMARC, SPF and SKIM to understand if your communications are properly protected.

At TwentyFour, we can help review your email environment, investigate delivery problems and guide your business towards stronger protection as part of your wider IT and cyber security strategy.

Whether you are experiencing rejected messages or want to understand where your current setup could leave gaps, our team can help you identify the next steps.

Contact TwentyFour to discuss your email security and DMARC configuration, and help protect the communications your business relies on.

Enquire Here