Problem Description
A Microsoft 365 mailbox hosted through GoDaddy had been working normally for several years. However, starting in early November 2026, outgoing emails to Outlook.com / Hotmail recipients began generating delivery failure notifications.
The error reported was:
550 5.7.23 The message was rejected because of
Sender Policy Framework violation
550 5.7.1 Message rejected:
Message lacks SPF/DKIM/DMARC Auth Records (AS9031519)Interestingly, the issue appeared to affect Outlook.com / Hotmail recipients, while there was no indication of a general outbound email service failure.
Investigation
1. Checked the existing SPF record
The domain’s DNS TXT records were checked using:
nslookup -type=TXT yourdomain.comThe existing SPF record was:
v=spf1 include:secureserver.net -allThis is the standard SPF configuration recommended for Microsoft 365 services hosted through GoDaddy.
There were no duplicate SPF records, and no other email servers were being used to send emails on behalf of the domain.
Therefore, the existing SPF record was left unchanged.
2. Checked the DMARC record
The following command was used:
nslookup -type=TXT _dmarc.yourdomain.comThe result indicated that no DMARC record existed:
Non-existent domainThis revealed a missing email authentication configuration.
Solution
A DMARC TXT record was added through the GoDaddy DNS management interface.
| Field | Value |
|---|---|
| Type | TXT |
| Host / Name | _dmarc |
| Value | v=DMARC1; p=none |
| TTL | Default |
The p=none policy enables DMARC authentication and monitoring without instructing receiving mail servers to quarantine or reject messages that fail DMARC validation.
After adding the record, DNS propagation was verified using:
nslookup -type=TXT _dmarc.yourdomain.comThe expected result was returned:
v=DMARC1; p=noneVerification
After the DMARC record was published, two emails that had previously failed delivery were sent again to the affected recipients.
Both emails were sent successfully, with no further delivery failure notifications received at the time of testing.
Conclusion
The issue appears to have been resolved by adding a DMARC DNS record.
The existing SPF configuration was already correct for GoDaddy-hosted Microsoft 365 and did not need modification.
Key takeaway: If Microsoft 365 emails suddenly start failing delivery to Outlook.com / Hotmail with error 550 5.7.23, check all three email authentication mechanisms:
- SPF – Ensure the sending service is authorised.
- DKIM – Ensure outgoing messages are digitally signed.
- DMARC – Ensure a valid DMARC policy is published in DNS.
Even when SPF is correctly configured, the absence of a DMARC record may contribute to email authentication and delivery problems.
Note: The successful tests suggest that adding DMARC resolved this particular issue, but they do not conclusively establish the underlying cause of Microsoft’s rejection. DKIM status was not independently verified during this troubleshooting process, and further monitoring is recommended.