Outlook requires authentication from high-volume senders
Microsoft’s May 2025 change makes SPF, DKIM, and DMARC an operational requirement for affected senders.
What changed
Microsoft introduced authentication requirements for domains sending more than 5,000 messages per day to its Outlook consumer email service, including Outlook.com, Hotmail, and Live addresses. The enforcement date in the announcement is 5 May 2025.
Affected senders need SPF and DKIM, plus a DMARC record with at least p=none. The domain in the visible From address must align with the domain authenticated by SPF or DKIM.
Microsoft updated the announcement to say non-compliant messages would be rejected, replacing its earlier plan to place them in Junk. The published rejection code is 550 5.7.515.
What to check
Test messages from each sending service, including application mail and marketing platforms. Verify authentication and alignment at the recipient, rather than checking only that DNS records exist.
These are requirements for the specified consumer service and affected sending volumes. Avoid assuming that every Microsoft-hosted mailbox has identical rules. Read the original announcement for its precise scope and subsequent updates.
Sources
Sources reviewed .