Outlook 2025 Sender Requirements for Bulk Email

What changed in 2025

A domain that used to limp into Outlook Junk can now bounce with a 550 5.7.515 error.

Starting May 5, 2025, Microsoft began enforcing stricter authentication for high-volume senders to its consumer mailboxes, including Outlook.com, Hotmail, Live.com, and MSN. Microsoft defines a high-volume sender as a domain that sends 5,000 or more messages per day to those services and uses the same domain in the visible 5322.From address.

Once a domain hits that level, Microsoft expects every message from that domain to meet the authentication rules. The sender must publish SPF and DKIM records, SPF and DKIM must both pass, the domain must publish a DMARC record, and the message must pass DMARC through SPF or DKIM alignment. If it does not, Outlook.com can reject the message with 550 5.7.515. Check Microsoft's sender support pages for the current enforcement notes before a large send, because mailbox rules can change.

The records Outlook checks

SPF, DKIM, and DMARC answer a simple receiver question: can this domain prove it sent the message?

• SPF (RFC 7208): a TXT record that lists which hosts may send mail for a domain. SPF has a 10 DNS-lookup limit for mechanisms such as include, a, mx, ptr, exists, and redirect. Going over that limit causes a permanent SPF error. Use ~all while you are still finding legitimate senders, then consider -all only when the list is complete.
• DKIM (RFC 6376): a cryptographic signature added by the sending service. The public key is published in DNS under a selector, such as selector1._domainkey.example.com. DKIM passes when the receiver can verify the signature and the signed parts of the message were not changed.
• DMARC (RFC 7489): a TXT record at _dmarc.example.com. DMARC passes when SPF or DKIM passes and that passing domain aligns with the visible From domain. A starter policy such as v=DMARC1; p=none; rua=mailto:dmarc@example.com gives you reports. Move to p=quarantine or p=reject after reports show your real mail is aligned.

The common failure is alignment. A message can pass SPF for a vendor's return-path domain and still fail DMARC for your visible From domain. DKIM often fixes that because the vendor can sign with your domain. Run the free deliverability scorecard before a big Outlook send so you can catch missing records, lookup-limit failures, and weak DMARC policy early.

Other signals that affect Outlook delivery

Authentication is the floor. Reputation decides whether mail earns inbox placement.

• Use a sending domain that can receive mail. A broken MX record does not decide SPF, DKIM, or DMARC, but it makes replies and abuse handling look careless.
• Keep reverse DNS (PTR) and HELO/EHLO names sensible for dedicated sending IPs. Shared email platforms usually manage this for you.
• Send wanted mail. High complaint rates, spam-trap hits, sudden volume jumps, and blocklist listings can hurt delivery even when authentication passes.
• For marketing mail, include an unsubscribe path that works and honor opt-outs quickly. One-click unsubscribe is part of the modern bulk-sender baseline from major mailbox providers.

DMARC aggregate reports are the best early warning system. They show which services send as your domain and whether those messages pass alignment. If the XML is hard to read, the free DMARC report reader turns those reports into a plain source-by-source view.