Microsoft’s Bulk Sender Requirements: What Changed and What You Need to Do

In May 2025 Microsoft began enforcing the same kind of bulk-sender rules Gmail and Yahoo rolled out in February 2024. The threshold is 5,000+ messages per day to Outlook.com / Hotmail / Live addresses (consumer side). Microsoft announced junking first, from 5 May 2025, then rejection with 550 5.7.515. By mid-2026 most enforcement is at the rejection stage.

Here is the full checklist.

Requirement 1: SPF Must Pass

The sending IP must be authorized by the SPF record of the domain in the Return-Path / Mail From.

• Use a single SPF record per domain.
• Stay under 10 DNS lookups.
• Avoid +all. Use -all or ~all.

Validate with our SPF lookup tool.

Requirement 2: DKIM Must Pass

Every message must be DKIM-signed by the sending domain (or a subdomain that aligns with the From: header).

• 2048-bit keys preferred over 1024.
• Rotate keys at least annually.
• Don't sign with a selector for a third party unless it aligns with DMARC.

Validate with DKIM lookup.

Requirement 3: DMARC Must Be Published — At Least p=none

Microsoft requires a DMARC record on the organizational domain. p=none technically satisfies the rule, but Microsoft scores p=quarantine and p=reject more favorably. Unauthenticated mail spoofing your domain also damages your reputation if DMARC isn't enforced.

Generate or upgrade with DMARC generator.

Requirement 4: One-Click List-Unsubscribe (RFC 8058)

Microsoft lists a working, visible unsubscribe as a recommendation rather than a requirement. RFC 8058 one-click headers are the safe way to meet it, and Gmail and Yahoo ask for them anyway. Include both:

List-Unsubscribe: <mailto:unsub@yourdomain.com>, <https://example.com/unsub?token=xyz>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

When a mail client offers one-click unsubscribe, it POSTs to your URL. Your endpoint should:

• Accept POST requests (not just GET).
• Honor unsubscription within 24 hours, ideally seconds.
• Not require the user to log in or fill anything in.

Requirement 5: Reverse DNS (PTR)

Sending IPs must have a PTR record that resolves to a hostname on a domain you control. The hostname should match your HELO/EHLO.

Check with reverse DNS (PTR) lookup.

Requirement 6: Complaint Rate Below 0.3%

Microsoft watches JMRP complaint rate but publishes no threshold. Treat 0.3%, the ceiling Gmail and Yahoo publish, as the outer limit.

Practical target: < 0.1%. Enroll in JMRP and suppress complainers immediately.

Requirement 7: No Spoofing of Major Brands

Microsoft tightly filters mail that attempts to look like notifications from major brands (Microsoft itself, banks, parcel carriers). Don't use display names like "Microsoft Account Team" unless you actually are.

Requirement 8: Valid From / Reply-To

• From: address must be on a domain you control and that has working MX.
• Reply-To: must accept mail. Bouncing reply-to addresses are a major reputation drag.

Requirement 9: Encrypted Transport

TLS 1.2 or 1.3 on outbound SMTP. Microsoft is gradually deprioritising unencrypted connections.

Requirement 10: One-Sender, One-Identity

Don't mix transactional and marketing on the same domain unless you've split them with subdomains (e.g. mail.yourdomain.com for marketing, notify.yourdomain.com for transactional). Cross-contamination of reputation is a common cause of "my transactional mail is going to junk".

The Enforcement Timeline

Stage	Behaviour
Junking	Non-compliant mail is delivered to junk folder regardless of content
Rejection	Non-compliant mail is rejected at SMTP with 550 5.7.515

Most senders sending 5,000+/day to Outlook.com are now in the rejection stage if SPF/DKIM/DMARC isn't passing.

How to Audit Your Setup

1. Run Domain Health on every sending domain.
2. Send a test message to a Microsoft mailbox and inspect the headers with email header analyzer. All Authentication-Results lines should read pass.
3. Check that one-click unsubscribe actually triggers your unsubscribe handler: send to yourself, click in Outlook, confirm your backend received a POST.
4. Verify rDNS with reverse DNS (PTR) lookup.

FAQ

Does the 5,000/day threshold apply per IP or per domain? Per sending domain to Outlook.com / Hotmail / Live addresses, summed across all IPs.

Do these rules apply to Microsoft 365 recipients too? Microsoft 365 (Exchange Online) enforces a similar but separately-scored set of rules. In practice, if you comply with the bulk-sender requirements you'll be in good shape for both.

What if I'm under 5,000/day? You're not strictly required to comply, but the same signals affect your reputation. Treat the list as best-practice regardless of volume.

Related

• Why Emails Land in Outlook Junk
• Microsoft Outlook Delisting Guide

Sources

• Strengthening Email Ecosystem: Outlook's New Requirements for High-Volume Senders (Microsoft Tech Community), the requirements (SPF pass, DKIM pass, DMARC at least p=none and aligned), the recommendations, and the 550 5.7.515 rejection.
• Outlook.com Postmaster: Troubleshooting, Outlook.com's SMTP error list, including 550 5.7.515 for domains over 5,000 a day that fail authentication.
• Outlook.com Postmaster: Services for Senders and ISPs, JMRP and SNDS, the complaint and reputation feeds for Outlook.com.
• RFC 8058: Signaling One-Click Functionality for List Email Headers, the one-click unsubscribe POST.