Microsoft Enforces SPF, DKIM, DMARC for High-Volume Senders
May 2, 2025 update
Beginning May 5, Microsoft will reject emails that don’t meet their new bulk sender requirements. Instead of going to the junk folder, messages that don’t comply won’t be delivered at all.
Rejected messages result in error code 550 5.7.15 Access denied.
Microsoft has strengthened its email authentication requirements to be in line with other providers. These changes have been forecast since Google and Yahoo made similar changes in 2024.
Microsoft is now requiring DMARC and its supporting technologies of SPF and DKIM for large senders (5,000 or more emails per day) in their consumer email services outlook.com, hotmail.com and live.com.
Key Authentication Requirements
For domains sending over 5,000 emails per day, Outlook requires compliance with the following:
- SPF (Sender Policy Framework)
- Must pass for the sending domain.
- Your domain’s DNS record should accurately list authorized IP addresses/hosts.
- DKIM (DomainKeys Identified Mail)
- Must pass to validate email integrity and authenticity.
- DMARC (Domain-based Message Authentication, Reporting, and Conformance)
- At least p=none and align with either SPF or DKIM—preferably both.
Messages not complying with these guidelines will be rejected beginning May 5, 2025.
Enforcement Timeline
Microsoft encourages all senders, particularly those that send at high volume, to review and update their SPF, DKIM and DMARC records in preparation for enforcement.
After careful consideration and to ensure the protection of users and remove any confusion on why a message was in the junk folder for both the recipient and sender, we have made a decision to reject messages that don’t pass the required authentication requirements detailed above. The rejected messages will be designated as “550; 5.7.15 Access denied, sending domain does meet the required authentication level.” This change will state taking effect on May 5 as originally stated.
Learn how to configure Microsoft 365 to send DMARC-compliant messages.
Additional Best Practices from Microsoft
In addition to the DKIM, SPF and DMARC requirement, Microsoft recommends the following for large senders:
- Use valid “from” or “Reply-To addresses: Ensure the “From” or “Reply‐To” address is valid, reflects the true sending domain, and can receive replies.
- Provide clear unsubscribe links: Provide an easy, clearly visible way for recipients to opt out of further messages, particularly for marketing or bulk mail.
- Maintain clean mailing lists and manage bounces: Remove invalid addresses regularly to reduce spam complaints, bounces and wasted messages.
- Follow transparent mailing practices: Use accurate subject lines, avoid deceptive headers and ensure your recipients have consented to receive your messages.
Microsoft notes that “Outlook reserves the right to take negative action—including filtering or blocking—against non‐compliant senders, especially for critical breaches of authentication or hygiene.”
Who is affected?
If you send 5,000 messages or more per day to Microsoft’s consumer email addresses (@outlook.com, @live.com, @hotmail.com), your email domain must have DKIM, SPF and DMARC records in your DNS by May 5, 2025, or the bulk messages sent from your domain(s) will be rejected.
These messages must pass DMARC Alignment. This includes messages sent on behalf of your organization by third-party email service providers (ESPs) like Constant Contact and MailChimp that use your email domain.
dmarcian can help
At dmarcian, we know that proper deployment is key—and we offer the superior tooling and expertise you need to get it right the first time. We help organizations of all sizes:
- Deploy DMARC the right way—no guesswork, no disruptions
- Gain full visibility into your email ecosystem
- Stay ahead of evolving email security policies
Don’t let your emails get blocked. Get DMARC done right—fast.
Want to continue the conversation? Head over to the dmarcian Forum.
