Outlook.de DKIM and DMARC records broken

I did a couple of country checks myself as well and saw that for many the SPF, DKIM and DMARC records are missing or inconsistent when compared to Outlook.com

I've escalated it to the Outlook Team for review (hopefully followed by a speedy fix...).

Thanks for reporting!

It is getting worse - since 2 months no fix and google rejects mail now from outlook outright:

Diagnoseinformationen für Administratoren:

Generierender Server: MI3PR02MB12437.eurprd02.prod.outlook.com

email address removed for privacy reasons
mx.google.com
Remote server returned '554 5.7.0 <mx.google.com #5.7.350 smtp;550 5.7.350 Remote server returned message detected as spam -> 550 5.7.1 [2a01:111:f403:d201::3 12] Gmail has detected that this message;is likely unsolicited mail. To reduce the amount of spam sent to;Gmail, this message has been blocked. For more information, go to; https://support.google.com/mail/?p=UnsolicitedMessageError 956f58d0204a3-669491271fdsi2754975d50.176 - gsmtp>'

So finally we are at a point where I really think cancelling my Office subscription and moving to Google instead - Opening support tickets is also useless as the only answer is "We are Outlook.com support and can't fix DNS. That is another team. We also cannot forward this issue internally as we are simply not capable of doing so.

This is really sad for a company like Microsoft.

That's exactly, why I posted it here - MS ignores this since June - so they need other to comply (which is fine) but break their own DMARC and DKIM since at least June.

I want MS to get some attention on this - and this seems the only way. The dkim=permerror happens of course on any email sent from outlook.de domain - as the DNS entries are missing.

This is on Microsoft to fix - and only on Microsoft.

You’re seeing @outlook.de messages signed with selector1 while DNS returns no public DKIM key, and you also cannot find a DMARC record. Microsoft’s guidance confirms that an absent matching public key produces “no key for signature” and must be corrected by the sender’s domain operator. Because outlook.de is Microsoft-managed, a mailbox owner cannot publish those records or repair this in Outlook.

Repeat both TXT lookups through two independent resolvers, send a fresh test, and save the complete Authentication-Results header plus any nondelivery report. Contact Outlook.com support while signed in and include the UTC send time, Message-ID, selector, receiving domain, and exact lookup results. Ask support to escalate an outbound DKIM/DNS incident for outlook.de. SPF passing does not repair the missing DKIM key, and resetting the Outlook profile will not help. Until Microsoft confirms remediation, re-test delivery rather than assuming all recipient systems will handle the message identically.