Guides · Updated 2026-10-11

Microsoft Outlook.com sender requirements for high-volume senders

Starting in May 2025, Microsoft began enforcing authentication requirements for domains that send more than 5,000 messages per day to Outlook.com consumer addresses (outlook.com, hotmail.com, live.com).

Requirements

SPF must pass for the sending domain.
DKIM must pass.
DMARC must be published with at least p=none, aligned with SPF or DKIM (ideally both).

Microsoft also recommends compliant From/Reply-To addresses, working unsubscribe links, list hygiene, and transparent mailing practices.

Enforcement

Microsoft said non-compliant messages would first be routed to Junk, with rejection to follow. Fixing authentication before you hit the threshold avoids surprises.

Using Microsoft 365 yourself?

See DMARC for Microsoft 365 for the exact SPF, DKIM and DMARC setup.

Check your domain now. Our free checker grades DMARC, SPF, DKIM, MX, BIMI and MTA-STS in seconds.

Sources

This guide is general information, not legal or professional advice. Provider screens change; always confirm the exact values shown in your own account.