'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
How to Fix Microsoft Encrypted Email Rejected by DMARC Policy
Question details
The recipient cannot receive the one-time passcode for a Microsoft encrypted email because their Google Workspace server rejects the message due to a DMARC policy failure.
- Product
- Microsoft Outlook
- Device & OS
- not provided
- Scenario
- A recipient using a Google-hosted email address attempts to open a Microsoft encrypted message and needs to receive a one-time passcode.
- Observed behavior
- The one-time passcode email from microsoft.com is rejected with SMTP error 550-5.7.26 due to failing the recipient domain's DMARC policy.
Ensure you have contact with the recipient's Google Workspace IT administrator, as this rejection happens at the recipient's mail provider level. Verify the exact SMTP error code received in the non-delivery report (NDR).
Contact Google Workspace Admin to Adjust Mail-Routing Rules
The most effective way to resolve this is by configuring the recipient's email environment to accept Microsoft's message-delivery domains.
Because the rejection occurs at the recipient's mail provider before the encrypted message sign-in process completes, the recipient's IT administrator must intervene. They should not disable DMARC broadly, but rather make verified adjustments to allow Microsoft's automated domains.
Identify the exact delivery domain failing the DMARC check by reviewing the SMTP error 550-5.7.26 logs in the non-delivery report.
Have the Google Workspace administrator navigate to their Google Admin Console and access the email security and routing settings.
Add Microsoft's message-delivery domains to the allowed sender list or adjust quarantine rules to bypass DMARC rejection for these specific system emails.
Check the relevant email security logs to confirm the changes have propagated and that the passcodes are now being delivered.
Use an Alternative Secure-Sharing Method
If adjusting the recipient's server rules is not immediately possible, the sender should utilize a different secure method to deliver the information.
Discover a Seamless Alternative with WPS Office
While email server routing rules are managed by IT administrators, managing your everyday documents shouldn't be complicated. WPS Office provides a lightweight, free alternative to Microsoft Office with high compatibility, enabling you to securely create, edit, and share files across platforms.
Frequently Asked Questions
What does SMTP error 550-5.7.26 mean?
This error indicates that the email was rejected because it failed the recipient domain's DMARC (Domain-based Message Authentication, Reporting, and Conformance) policy, meaning the sender's domain could not be successfully authenticated.
Why does the one-time passcode email fail DMARC?
The one-time passcode is generated by an automated Microsoft system. If the recipient's mail server strictly enforces DMARC, it may flag these automated emails as unauthenticated if Microsoft's delivery IPs or domains aren't explicitly whitelisted by the receiving server.
Can the sender fix this DMARC rejection issue?
No, the sender cannot fix this directly through their email client. The resolution requires the recipient's IT administrator (such as the Google Workspace admin) to adjust their mail-routing and quarantine rules to accept Microsoft's system emails.
Is it safe to disable DMARC to receive these emails?
No, broadly disabling DMARC is highly discouraged as it protects your domain from spoofing and phishing. Instead, administrators should make verified, provider-recommended adjustments for specific delivery domains.
