Some of the email you sent last week never showed up.
Not everyone's. Probably not most of it. But if any part of your list uses a Hotmail, Outlook.com, Live or MSN address, there is a real chance that a slice of the mail you sent between November 5 and November 9 bounced and never reached anybody.
You weren't told. Your sending platform didn't flag it. Microsoft didn't announce it. And the people who didn't get your email have no idea they didn't get it — nothing landed in their junk folder, nothing came back marked undeliverable. From where they sit, you just went quiet for a few days.
What Happened, in Plain English
Microsoft changed something in the rules it uses to catch spam, and the change was wrong. For about four days, its system started rejecting perfectly legitimate mail, mostly from organizations whose domains were missing one particular setting. Microsoft rolled the change back on November 9 and classified the whole thing as a service problem on their end.
Here's the part worth knowing. While it was happening, a lot of the email industry reported it as a new rule — Microsoft now requires every sender to have this setting, get it or else. That wasn't true. It was a bug, and it got reversed. But the explanation traveled a lot further and faster than the correction did, which is often how this goes. The people quickest to publish news about email deliverability tend to be the people selling the fix for it.
The setting in question is called DMARC, and it is less complicated than it sounds. It's a short line of text that lives in your domain's settings — the same back-end place where somebody once pointed your website and your email in the right directions. All it says to Gmail, Outlook and the rest is: here's how to check whether mail claiming to come from us actually did. It doesn't change how your email looks. It doesn't change how you send. Most organizations that have one set it up once, years ago, and never thought about it again.
If you have never touched a domain setting in your life, that's normal, and it isn't your job. The question was never whether you understand this. The question is whether somebody took care of it.
The Part That Should Bother You
Think about what your November numbers are going to look like.
Say you sent an appeal, or a newsletter, or a program update on November 6. Opens come in a little soft. Clicks are down a bit from last month. You'd look at that and think: holidays, probably. Everybody's distracted. Subject line could've been sharper.
What you would not think is that a chunk of your audience never received it at all. Because nothing in your reporting would tell you that. The failures were intermittent rather than total, so your delivery rate barely moved. The bounces went into a log almost nobody opens. And a supporter who stopped hearing from you for four days looks, in every chart your platform produces, exactly like a supporter who quietly lost interest.
That's the real cost of this one. Not the four days. The fact that you'd have filed it under something else entirely.
One thing worth knowing about who got hit: the problem affected personal email addresses, not business ones. Mail to Microsoft 365 work accounts went through fine. So if you're emailing people at their offices, last week was probably uneventful for you. If you're emailing people at home — which is nearly every donor file, membership list, advocacy list and constituent list there is — part of your audience went dark and your dashboard said everything was normal.
Nobody Can Tell You What It Cost
Suppose you wanted to go back and figure out what you lost. You can't, really.
You'd think you could line it up against Microsoft's own record of the incident, except Microsoft says it started on the evening of November 6, and the people watching their mail bounce were reporting it on November 5. Their timeline is short by about a day.
So the only honest account of what happened to your email is the one in your own sending data — specifically, how much of your mail got delivered broken out by where it was going, Gmail versus Yahoo versus Outlook, over a window you'd have to define yourself. Almost nobody runs that report. Most platforms don't put it in front of you unless you go looking.
Which means that for a lot of organizations, the true answer to "did last week hurt us" is: no way to know.
That's not Microsoft's fault. It's what happens when a program watches opens and clicks closely and treats delivery as something that either works or doesn't.
The Ones Who Were Fine Didn't Do Anything That Week
Here's what I keep coming back to.
The organizations that sailed through this didn't react fast. They didn't spot it early. They didn't know something everyone else missed — nobody did, including the experts who published the wrong explanation inside two days.
They just already had the setting in place. Usually put there a long time ago, by somebody who had a different reason for doing it.
That was the entire difference.
And it describes a whole category of work that gets pushed to next quarter in every communications shop I've ever seen. Making sure your domain is set up properly. Keeping your sender reputation clean. Pruning dead addresses off the list. Actually watching whether your mail gets delivered. None of it is expensive. None of it is urgent — there is never a week where it's the most pressing thing on your desk. And when it's working, it is completely invisible, which is exactly why it keeps getting deferred.
Then a week like last week happens, and it turns out that boring, deferred, invisible work was the only thing that mattered.
Both chambers of Congress, as it happens, had theirs sorted — neither was required to, and both did it anyway. So did every nonprofit, association and company that handled it back when it was merely a good idea instead of a fire.
What to Actually Do
Find out whether you have a DMARC record. That's it, that's the first step.
You don't have to do this yourself — there are free lookup tools all over the web where you type in your domain and get a yes or no in about ten seconds. Or send one sentence to whoever manages your website: do we have a DMARC record, and do we have one for every domain we send email from?
That second half matters more than the first. Your main domain is probably fine. The ones that bite are the others — the advocacy arm's separate domain, the domain you set up for a campaign or an event, the one your email vendor sends from on your behalf, the one somebody registered three staffers ago and pointed at a mail service. They all send real email to real people. They're also the ones nobody has looked at in years.
If something's missing, adding it is a fifteen-minute job for whoever handles your domain, and it changes nothing about how your email sends or looks.
This is unglamorous and it's the floor everything else stands on. On one Senate program we built, 841,000-plus emails went out at a 98.7 percent delivery rate — not because we diagnosed problems quickly, but because the plumbing was sorted before the first message ever went out. Same thing works for a membership organization, a national nonprofit, a company with a customer list. The inbox doesn't care what sector you're in.
Nobody will ever compliment you on this. Constituents, voters and stakeholders don't notice any of it when it's working, which is the only review it's ever going to get.
And the next one won't be announced either. It won't come with a warning you can act on, and by the time anyone can explain what happened, it'll be over.
You don't get a warning. You get whatever you already had.