Outlook "This sender failed our fraud detection checks": how to fix it

What it means

Recipients using Outlook.com, Hotmail or Outlook on the web see a warning bar at the top of your email. The text usually reads:

This sender failed our fraud detection checks and may not be who they appear to be. Learn about spoofing

Microsoft could not confirm that the email really came from the domain shown in the From address. It still delivered the message (often to Junk), but warns the reader that it might be spoofed: sent by someone pretending to be you.

This warning is stronger than the grey "?" picture and the "We can't verify the sender" line. Those mean "not verified"; this one means "verification failed". If you see the "?" only, read Outlook shows "?" or "We can't verify the sender" instead.

Why it happens

Microsoft combines SPF, DKIM, DMARC and other signals into a single verdict called composite authentication (compauth). The banner appears when that verdict is a fail. Common reasons:

• The sending server is not in your SPF record and there is no valid DKIM signature for your domain. Typical case: a website, CRM or newsletter tool sending "From" your domain without being authorized.
• DMARC alignment fails: SPF and DKIM pass, but for another domain (the tool's own domain), not the one in your From address. See DMARC fails: SPF and DKIM do not match your domain.
• Forwarding or mailing lists: the message was forwarded or sent through a list that changed it, so SPF fails and the DKIM signature breaks.
• A contact form sends "From" the visitor's address (for example a Gmail address) through your web server. That is spoofing from Microsoft's point of view.
• Real spoofing: someone else is sending fake emails with your domain.

How to check

1. Send a test email from the same tool or server to the unique address on the Delivmail home page. The report shows SPF, DKIM and DMARC results and whether each one is aligned with your From domain.
2. Read the headers of a flagged message in the recipient's mailbox (in Outlook on the web: the three dots, then View > View message source). Look at Authentication-Results:

   Authentication-Results: spf=fail (sender IP is 203.0.113.25) smtp.mailfrom=yourdomain.com;
    dkim=none (message not signed) header.d=none;
    dmarc=fail action=none header.from=yourdomain.com;
    compauth=fail reason=001

   Microsoft documents the reasons: 000 means DMARC failed with a quarantine or reject policy; 001 means implicit authentication failed (no records, or weak ones like SPF ~all or DMARC p=none).
3. Check your DNS with the domain scanner: one SPF record that lists all your senders, a DKIM key for each tool, and a DMARC record.

How to fix it

1. List every service that sends as your domain: mailbox provider, website, invoicing, CRM, newsletter, helpdesk.
2. Authorize each one in SPF (one record, at most 10 DNS lookups):

   Host: yourdomain.com
   Type: TXT
   Value: v=spf1 include:spf.protection.outlook.com include:_spf.example-esp.com -all

   Use the include values given by each provider; the example above is only a shape.
3. Enable DKIM with your own domain in each tool (not the tool's default domain). This is what keeps authentication working when mail is forwarded.
4. Publish DMARC, starting with monitoring:

   Host: _dmarc.yourdomain.com
   Type: TXT
   Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

   Read the reports, fix every legitimate source, then move to quarantine or reject.
5. Fix contact forms: send From an address on your domain and put the visitor's address in Reply-To.
6. If you use Microsoft 365 to send, follow SPF, DKIM and DMARC for Microsoft 365; DKIM is not active until you turn it on for your custom domain.

Asking recipients to add you to Safe Senders hides the banner for them only. It is not a fix and does not help other recipients.

Check that it is fixed

• Wait for DNS changes to propagate, then send a new test to the Delivmail address: SPF or DKIM must pass and be aligned, and DMARC must pass.
• Send a new message to an Outlook.com address and check that compauth=pass appears in its headers and the banner is gone. Old messages keep their warning.