Sign in Get up to 500 free credits

Outlook.com requirements for high-volume senders

Since 5 May 2025, Microsoft requires domains that send more than 5,000 messages a day to Outlook.com, Hotmail and Live addresses to pass SPF and DKIM and to publish a DMARC policy of at least p=none that aligns with one of them. Mail from such a domain that fails can be rejected with 550 5.7.515. Microsoft also recommends valid sender addresses, working unsubscribe links, prompt removal of invalid addresses and clear consent.

What Microsoft announced

Microsoft published the rules on 2 April 2025 in a post on its Tech Community blog, Strengthening Email Ecosystem: Outlook's New Requirements for High-Volume Senders. They cover Microsoft's consumer mail service, that is addresses at outlook.com, hotmail.com and live.com. They follow the requirements Gmail and Yahoo introduced in February 2024 (Gmail and Yahoo sender requirements), and a sender that already meets those is most of the way there.

Business mailboxes on Microsoft 365 are a different service, filtered by Exchange Online Protection; Microsoft documents what senders to them should do in Troubleshooting mail sent to Microsoft 365.

Who counts as a high-volume sender

The blog post applies the rules to domains that send more than 5,000 emails a day. Microsoft's support article Fix NDR error "550 5.7.515" in Outlook.com counts the messages that share the same domain in the From: address (the 5322.From address, the one recipients see). Messages from several services, such as your newsletter platform, your CRM and your help desk, therefore add up when they all use your domain.

The three requirements

  1. SPF passes for the sending domain. Your SPF record must list every IP address or service that sends mail for the domain. Check it with the SPF checker; the SPF generator helps you write one. Stay within SPF's 10-lookup limit.
  2. DKIM passes. Each message carries a valid DKIM signature for your domain. Look up a selector with the DKIM checker.
  3. DMARC is published and passes. A policy of at least p=none, and the message must pass DMARC: SPF or DKIM (Microsoft prefers both) must authenticate a domain that aligns with the From: domain. Check your record with the DMARC checker or create one with the DMARC generator.

These match Gmail's bulk rules closely: both ask for SPF and DKIM to pass, and one aligned pass is enough for DMARC. Microsoft's Postmaster policies list p=none as the minimum and recommend p=reject.

The most common way to fail is a sending service that authenticates with its own domain. The support article suggests checking each third-party sender: it should use your domain in the envelope sender (the return-path), sign with a DKIM key on your domain, and your SPF record should include it.

What happens to mail that fails

Microsoft's own pages describe the first step differently. The blog post first said that non-compliant mail would go to the Junk folder from 5 May 2025, with rejection to follow at a later date; an update to the post dated 29 April 2025 changed this to rejection from 5 May 2025. The Postmaster policies page still describes the Junk folder first and rejection if the problem is not fixed. Either way, the rejection reads:

550; 5.7.515 Access denied, sending domain [SendingDomain] does not meet the required authentication level.

The blog post adds that Microsoft may take other negative action, such as filtering or blocking, and that a recipient's Safe Senders list will not override the requirements.

To find which check failed, open a delivered test message in Outlook and read its authentication headers: they show the SPF, DKIM and DMARC results and which domain each one checked.

Besides the three requirements, the announcement recommends four practices for large senders. They are recommendations rather than conditions, but the post adds that Outlook may filter or block mail after serious breaches of authentication or list hygiene:

Microsoft's Postmaster policies add rules of their own: do not retry a message to a recipient after a permanent (5xx) failure, stop sending to a recipient after repeated non-delivery reports, have valid reverse DNS for your sending IP, and open no more than 500 simultaneous connections without prior arrangement.

Bounces, complaints and reputation

Authentication proves who you are; it does not make your mail welcome. Microsoft names the junk-mail complaint rate as one of the main factors in a sender's reputation, together with list accuracy. It runs two free programs for senders, described on its Postmaster services page: the Junk Email Reporting Program (JMRP), which sends you reports with headers of the messages Outlook.com users mark as junk, so you can remove those people, and Smart Network Data Services (SNDS), which shows how Outlook.com sees the mail from your IP addresses, including how many users complained (how to use SNDS and JMRP).

For list accuracy, verify addresses before you mail them, especially lists collected long ago or imported from another system. Addresses that no longer exist produce the non-delivery reports Microsoft tells you to act on, and some Outlook.com mailbox errors have their own codes, such as 550 5.5.0. If you move to new IP addresses, raise volume gradually: by Microsoft's estimate a new IP takes up to about two weeks to reach full volume, less with a small, accurate list and few complaints (email warm-up).

Questions

Do the rules apply below 5,000 messages a day?

The authentication requirements and the 550 5.7.515 rejection are defined for high-volume senders. Below the line, SPF, DKIM and DMARC still help Outlook.com tell your mail from forgeries, and Microsoft's recommended practices apply to everyone, so set them up anyway.

Does Microsoft publish a spam-rate limit like Gmail and Yahoo?

Not in the announcement. Microsoft names complaint rates as a main reputation factor but gives no threshold; Gmail and Yahoo ask for a spam rate below 0.3%.

Is p=none enough for Outlook.com?

Yes, as the minimum: the policy must exist and DMARC must pass. Microsoft's Postmaster policies recommend p=reject; move to it once your DMARC reports show that all your legitimate mail passes (a staged DMARC rollout).

Does this affect mail to companies on Microsoft 365?

The announcement is about Outlook.com consumer addresses. Business mailboxes on Microsoft 365 have their own filtering and their own error codes, such as 5.7.606 for a banned sending IP.

Try it

Check your SPF, DKIM and DMARC records with the DNS tools, and remove addresses that would bounce with bulk email verification or the free email checker.

Sources

How we wrote this: drafted by the email-validation.org team with the help of AI writing tools, from our product documentation and the sources linked in the text.

Get up to 500 free credits. No card needed.

New accounts get 500 free credits (100 when you sign up with a free email provider such as Gmail, Outlook or Yahoo, or another personal mailbox such as a paid one like Fastmail or one from your internet provider). Try it on your own list before you buy.

Create your account Open the free email checker

Updated · Maintained by the email-validation.org team