Repair Message lacks SPF/DKIM/DMARC Auth Data (AS9031519)

There are lots of experiences final couple of days on Reddit and Microsoft Study emails despatched to Outlook.com, Hotmail, Reside and MSN addresses which can be bouncing with an SPF/DKIM/DMARC Auth error (AS9031519).

Now the fascinating half is that solely part of the emails are bouncing to these domains. The identical message can bounce after which undergo fantastic when the consumer sends it once more a couple of minutes later. Lacking DMARC information the place the supposed situation, however Microsoft has now confirmed it’s an ongoing Change service situation

On this article, we are going to take a look at what the error really means, whether or not including DMARC fixes it, and tips on how to verify the e-mail authentication of your domains with PowerShell whereas Microsoft works on a repair.

Message lacks SPF/DKIM/DMARC Auth Data (AS9031519)

The rejection comes from Microsoft’s shopper mail servers, those behind *.olc.safety.outlook.com, so the difficulty solely impacts shopper mailboxes. Mail to enterprise mailboxes in Change On-line are delivered as regular.

The sending aspect isn’t restricted to Microsoft 365. Neowin reported senders on Google and Zoho getting rejected as effectively, and admins on Reddit see the identical from on-premises Change servers.

What makes it complicated is the NDR. The consumer is advised that hotmail.com couldn’t verify the message was despatched from a trusted location, with standing code 550 5.7.23 and an SPF validation error. That’s solely the wrapper. Within the error particulars of the NDR, or within the message hint, you’ll find the precise cause:

550 5.7.1 Message rejected: Message lacks SPF/DKIM/DMARC Auth Data (AS9031519) [BN2PEPF000055DA.namprd21.prod.outlook.com 2026-11-06T09:39:53.095Z 08DF3765B6D5F6F3]

The primary rejections the place observed on November 5.

Notice

The NDR factors you to your SPF report, however normally there’s nothing mistaken with SPF. Search for the AS9031519 cause earlier than you begin altering your SPF report.

And the rejections are intermittent. A message bounces, the consumer resends it quarter-hour later and it’s delivered. Or one consumer will get rejected whereas a colleague in the identical area sends to the identical Outlook.com handle with none drawback. So a single profitable check e-mail tells you just about nothing.

Is It DMARC or a Microsoft Situation?

Microsoft has confirmed it’s a service situation on their aspect. However a lacking DMARC report may play an element as effectively.

Microsoft does have a revealed rule that requires SPF, DKIM and DMARC for Outlook.com: the necessities for high-volume senders, which apply to domains sending greater than 5,000 messages a day since Might 2025.

However that rule comes with its personal error, 550 5.7.515 Entry denied, and many of the affected domains ship nowhere close to 5,000 messages a day. The AS9031519 code isn’t documented anyplace by Microsoft.

What I do learn is that lots of the affected domains don’t have a DMARC report. Many admins on this r/sysadmin thread report that the bounces stopped after they revealed one.

However however, there are additionally experiences within the Microsoft Q&A thread of domains which have had SPF, DKIM and DMARC in place for years, with spf=move, dkim=move and dmarc=move within the message headers, and their mail nonetheless will get rejected at times. A lacking DMARC report doesn’t clarify these.

On November 9, a Microsoft moderator confirmed in that very same Q&A thread that there’s an ongoing Change service situation with messages to Outlook.com, Hotmail and Reside addresses. The advisory is classed as a service degradation, and Microsoft remains to be investigating the basis trigger.

I don’t see the advisory within the Service Well being of any tenant I handle but, however an consumer on Reddit mentions EX1540236 as ID.

So including the DMARC report appears to be a very good workaround that helps lots of domains. However the precise repair has to return from Microsoft.

Examine DMARC Document of your Area

Now regardless of the end result is, it’s at all times good to have the SPF, DKIM and DMARC information in place to your area. Including them solely takes a few minutes, so it’s value a brief as workaround.

The script beneath will get all accepted domains from Change On-line and checks the SPF, DKIM and DMARC information in public DNS.

For DKIM it checks two issues: whether or not DKIM signing is enabled in Change On-line, and whether or not the CNAME information in DNS level to the selectors that Change On-line expects. The CNAME format differs between tenants, so the script compares in opposition to the values from Get-DkimSigningConfig as an alternative of a hardcoded format.

You will have the ExchangeOnlineManagement module, and Resolve-DnsName solely works on Home windows.

Join-ExchangeOnline$dnsServer = '8.8.8.8'$domains = Get-AcceptedDomain | The place-Object { $_.DomainName -notlike '*.onmicrosoft.com' }$report = foreach ($area in $domains) {    $identify = $area.DomainName        $spf = Resolve-DnsName -Identify $identify -Sort TXT -Server $dnsServer -ErrorAction SilentlyContinue |        The place-Object { $_.Sort -eq 'TXT' -and ($_.Strings -join '') -like 'v=spf1*' }    $spfValue = ($spf | ForEach-Object { $_.Strings -join '' }) -join ' '        $dmarc = Resolve-DnsName -Identify "_dmarc.$identify" -Sort TXT -Server $dnsServer -ErrorAction SilentlyContinue |        The place-Object { $_.Sort -eq 'TXT' -and ($_.Strings -join '') -like 'v=DMARC1*' }    $dmarcValue = ($dmarc | Choose-Object -First 1 | ForEach-Object { $_.Strings -join '' })    $coverage = if ($dmarcValue -match 'p=(w+)') { $Matches[1] } else { '' }        $dkim = Get-DkimSigningConfig -Identification $identify -ErrorAction SilentlyContinue    $cname1 = (Resolve-DnsName -Identify "selector1._domainkey.$identify" -Sort CNAME -Server $dnsServer -ErrorAction SilentlyContinue |        The place-Object { $_.Sort -eq 'CNAME' }).NameHost    $cname2 = (Resolve-DnsName -Identify "selector2._domainkey.$identify" -Sort CNAME -Server $dnsServer -ErrorAction SilentlyContinue |        The place-Object { $_.Sort -eq 'CNAME' }).NameHost    [PSCustomObject]@{        Area       = $identify        SpfRecords   = @($spf).Rely             SpfIncludesEXO = $spfValue -match 'embody:spf.safety.outlook.com'        DkimEnabled  = [bool]$dkim.Enabled        DkimCnameOK  = [bool]($dkim -and $cname1 -eq $dkim.Selector1CNAME -and $cname2 -eq $dkim.Selector2CNAME)        Dmarc        = [bool]$dmarc        DmarcPolicy  = $coverage    }}$report | Format-Desk -AutoSize$report | Export-Csv -Path .Area-EmailAuth.csv -NoTypeInformation -Encoding UTF8$points = $report | The place-Object { $_.SpfRecords -ne 1 -or -not $_.DkimEnabled -or -not $_.DkimCnameOK -or -not $_.Dmarc }Write-Host "Domains that want consideration: $(@($points).Rely) of $(@($report).Rely)" -ForegroundColor Yellow

A website the place Dmarc is False is the very first thing to repair. SpfRecords must be precisely 1, as a result of a website with two SPF information fails SPF fully. And if DkimEnabled is True however DkimCnameOK is False, the CNAME information in DNS don’t match the selectors from Change On-line.

Notice

In the event you additionally ship mail by way of a third-party service (a e-newsletter instrument, a CRM, a scanner relay), SpfIncludesEXO solely tells you half of it. These providers should be in your SPF report too, or signal with DKIM to your area.

Repair It Whereas You Wait

Including DMARC received’t assist in the circumstances the place Microsoft rejects mail that passes all checks. Nevertheless it takes a couple of minutes, it stops the bounces for lots of domains, and it received’t damage. So be sure that all three are in place.

SPF

One TXT report on the basis area that features Change On-line and each different service that sends mail to your area:

v=spf1 embody:spf.safety.outlook.com -all

DKIM

Microsoft 365 indicators outgoing mail together with your onmicrosoft.com area till you allow DKIM to your customized area. That signature doesn’t match the area within the From handle, so it doesn’t depend for DMARC.

1. Open the Microsoft Defender portal
2. Go to E-mail & collaboration > Insurance policies & guidelines > Risk insurance policies > E-mail authentication settings
3. Open the DKIM tab and choose your area
4. Add the 2 CNAME information to your DNS, and allow Signal messages for this area with DKIM signatures as soon as they resolve

The entire steps are in tips on how to configure DKIM in Workplace 365.

DMARC

In case your area has no DMARC report but, begin with a monitoring coverage:

With p=none, receivers don’t take any motion on failed messages, they solely ship you experiences. So it doesn’t change how Gmail or anybody else treats your mail. As soon as the experiences look clear, you’ll be able to transfer to quarantine or reject, which I clarify within the Workplace 365 DMARC information.

Notice the host identify. It must be _dmarc, not @. Just a few folks on Reddit added the report to the basis area as a result of a generic tutorial advised them to, and the bounces continued till they moved it to _dmarc. Some DNS suppliers need the total identify, _dmarc.yourdomain.com, so verify what yours expects.

Notice

Give it a while after altering DNS. Some admins noticed bounces for just a few extra hours after including the report. And since the rejections are intermittent, check with just a few messages unfold over the day, not a single one.

Nonetheless Rejected?

In case your area passes SPF, DKIM and DMARC and messages nonetheless bounce with AS9031519, the issue is on Microsoft’s aspect. There isn’t a lot you’ll be able to repair your self then, however you can also make certain it will get reported:

1. Verify the rationale within the message hint. Within the Change admin heart, go to Mail circulate > Message hint, discover the failed message and open the main points. Examine that it says AS9031519 and never one other error.
2. Open a help case within the Microsoft 365 admin heart with contemporary Community Message IDs from the message hint and some affected messages saved as .eml recordsdata. That’s what Microsoft asks for to incorporate within the investigation. In the event you purchased your subscription by way of a companion, the companion has to open the case for you.
3. Report it to Microsoft’s Outlook.com sender help.
4. If the recipient is a buyer or contact you’re employed with, they will report it from their very own mailbox as effectively. In Outlook on the net, that’s Assist > Suggestions > Report an issue.

And inform your customers. A bounce that mentions SPF makes folks suppose their e-mail is damaged. A brief message that the issue is on the Outlook.com aspect, and that resending normally works, saves your helpdesk just a few calls.

Wrapping Up

Requiring DMARC from everybody who sends to Outlook.com isn’t a nasty transfer. Google and Yahoo have required it from bulk senders since 2024, and a website with out DMARC is fairly straightforward to spoof.

The onerous half is figuring out whether or not your repair really labored. As a result of just some messages are rejected, one profitable check e-mail doesn’t show a lot. So run the script, add DMARC and DKIM the place they’re lacking, and regulate the message hint for the following few days. I’ll replace this text when Microsoft shares the basis trigger or a repair.

I hope you appreciated this text, in case you have any questions, simply drop a remark beneath.