Microsoft's Bulk Sender Requirements: What Changed and What You Need to Do
Microsoft's bulk-sender requirements mirror Gmail and Yahoo — but with stricter enforcement timelines. If you send 5,000+ messages a day to Outlook addresses, this is the checklist.
In May 2025 Microsoft began enforcing the same kind of bulk-sender rules Gmail and Yahoo rolled out in February 2024. The threshold is 5,000+ messages per day to Outlook.com / Hotmail / Live addresses (consumer side). The enforcement is staged — warnings first, then junking, then rejection. By mid-2026 most enforcement is at the rejection stage.
Here is the full checklist.
Requirement 1: SPF Must Pass
The sending IP must be authorized by the SPF record of the domain in the Return-Path / Mail From.
- Use a single SPF record per domain.
- Stay under 10 DNS lookups.
- Avoid
+all. Use-allor~all.
Validate with our SPF Lookup tool.
Requirement 2: DKIM Must Pass
Every message must be DKIM-signed by the sending domain (or a subdomain that aligns with the From: header).
- 2048-bit keys preferred over 1024.
- Rotate keys at least annually.
- Don't sign with a selector for a third party unless it aligns with DMARC.
Validate with DKIM Lookup.
Requirement 3: DMARC Must Be Published — At Least p=none
Microsoft requires a DMARC record on the organizational domain. p=none technically satisfies the rule, but Microsoft scores p=quarantine and p=reject more favorably — and unauthenticated mail spoofing your domain damages your reputation if DMARC isn't enforced.
Generate or upgrade with DMARC Generator.
Requirement 4: One-Click List-Unsubscribe (RFC 8058)
Bulk mail must include both:
List-Unsubscribe: <mailto:unsub@yourdomain.com>, <https://example.com/unsub?token=xyz>
List-Unsubscribe-Post: List-Unsubscribe=One-Click
When the recipient clicks "Unsubscribe" in Outlook, the client POSTs to your URL. You must:
- Accept POST requests (not just GET).
- Honor unsubscription within 24 hours, ideally seconds.
- Not require the user to log in or fill anything in.
Requirement 5: Reverse DNS (PTR)
Sending IPs must have a PTR record that resolves to a hostname on a domain you control. The hostname should match your HELO/EHLO.
Check with PTR Lookup.
Requirement 6: Complaint Rate Below 0.3%
Microsoft watches JMRP complaint rate. Sustained rates above 0.3% trigger throttling; above 0.5% triggers blocks.
Practical target: < 0.1%. Enroll in JMRP and suppress complainers immediately.
Requirement 7: No Spoofing of Major Brands
Microsoft tightly filters mail that attempts to look like notifications from major brands (Microsoft itself, banks, parcel carriers). Don't use display names like "Microsoft Account Team" unless you actually are.
Requirement 8: Valid From / Reply-To
- From: address must be on a domain you control and that has working MX.
- Reply-To: must accept mail. Bouncing reply-to addresses are a major reputation drag.
Requirement 9: Encrypted Transport
TLS 1.2 or 1.3 on outbound SMTP. Microsoft is gradually deprioritising unencrypted connections.
Requirement 10: One-Sender, One-Identity
Don't mix transactional and marketing on the same domain unless you've split them with subdomains (e.g. mail.yourdomain.com for marketing, notify.yourdomain.com for transactional). Cross-contamination of reputation is a common cause of "my transactional mail is going to junk".
The Enforcement Timeline
| Stage | Behaviour |
|---|---|
| Warning | Microsoft accepts the mail but adds an X-header noting the violation |
| Junking | Non-compliant mail is delivered to junk folder regardless of content |
| Rejection | Non-compliant mail is rejected at SMTP with a 550 response |
Most senders sending 5,000+/day to Outlook.com are now in the rejection stage if SPF/DKIM/DMARC isn't passing.
How to Audit Your Setup
- Run Domain Health on every sending domain.
- Send a test message to a Microsoft mailbox and inspect the headers with Email Headers Analyzer. All Authentication-Results lines should read
pass. - Check that one-click unsubscribe actually triggers your unsubscribe handler — send to yourself, click in Outlook, confirm your backend received a POST.
- Verify rDNS with PTR Lookup.
FAQ
Does the 5,000/day threshold apply per IP or per domain? Per sending domain to Outlook.com / Hotmail / Live addresses, summed across all IPs.
Do these rules apply to Microsoft 365 recipients too? Microsoft 365 (Exchange Online) enforces a similar but separately-scored set of rules. In practice, if you comply with the bulk-sender requirements you'll be in good shape for both.
What if I'm under 5,000/day? You're not strictly required to comply, but the same signals affect your reputation. Treat the list as best-practice regardless of volume.