Microsoft (Outlook.com) sender rules
In April 2025, Microsoft announced new rules for high-volume senders to Outlook.com. Outlook.com is Microsoft's consumer email service. It includes addresses at hotmail.com, live.com and outlook.com. The rules took effect on 5 May 2025. They focus on email authentication. Here is a plain summary of what Microsoft asks.
Last checked 10 November 2026
The rules in detail
Who the rules apply to
Effective 5 May 2025
The rules apply to domains that send more than 5,000 emails a day to Outlook.com consumer addresses. Microsoft's post is about its consumer service. It does not describe these rules for mail to business accounts.
Rules for all senders
Effective 5 May 2025
Microsoft's 2025 post does not add new rules for smaller senders. Good practice still applies to everyone. Authenticated mail with SPF, DKIM and DMARC is easier for any receiver to trust.
Extra rules for high-volume senders
Effective 5 May 2025
SPF must pass for the sending domain. Your SPF record should list the IP addresses and hosts allowed to send for you. DKIM must pass. Publish DMARC with at least p=none. It must align with SPF or DKIM, preferably both. Microsoft also recommends a valid From: or Reply-To: address that can receive replies, a clear and working unsubscribe link, removing invalid addresses, honest subject lines and headers, and sending only to people who agreed to get your mail. Microsoft says it may filter or block senders that don't follow these practices.
Effective dates and enforcement
Effective 5 May 2025
Microsoft announced the rules on 2 April 2025. Enforcement started on 5 May 2025. At first, Microsoft said non-compliant mail would go to the Junk folder. In an update on 29 April 2025, it said it would reject mail that does not meet the authentication rules instead. Its postmaster page still mentions Junk first and rejection after, so check both sources.
What happens if you don't comply
Effective 5 May 2025
Microsoft says rejected mail gets this error: "550; 5.7.515 Access denied, sending domain [SendingDomain] does not meet the required authentication level." If you see this error, check SPF, DKIM and DMARC for the domain in your From: address.
Checklist
Effective 5 May 2025
Find out if you send more than 5,000 emails a day to Outlook.com addresses. Check that SPF passes and lists every service that sends for your domain. Sign your mail with DKIM and check that it passes. Publish DMARC with at least p=none, aligned with SPF or DKIM. Use a From: address that can receive replies. Add a clear unsubscribe link to marketing mail and clean your list. Check these settings again whenever you add a new service that sends mail for your domain, such as a newsletter tool or a CRM.
Questions
Which addresses do these rules cover?
Outlook.com consumer addresses, such as hotmail.com, live.com and outlook.com.
Does Microsoft publish a spam-rate limit?
Not in these rules. Microsoft asks for clean lists and consent, but it does not give a number like Gmail and Yahoo do.
What does error 5.7.515 mean?
It means Outlook.com rejected the mail because the sending domain did not meet the required authentication level. Check SPF, DKIM and DMARC.
Sources
These are Microsoft (Outlook.com)'s own pages. If they differ from our summary, the provider's page is right.
- Microsoft Defender for Office 365 Blog: Strengthening Email Ecosystem: Outlook's New Requirements for High-Volume Senders
- Outlook.com Postmaster: Policies and announcements
This is our summary, not the provider's official text. Rules can change; always check the linked source.
How we keep this up to date
We read each provider's own public pages and write a plain summary. Every rule links to its source, and each page shows the date we last checked it. When a provider changes a rule, we update the page and add an entry to the changes log.
Last updated 10.11.2026 19:01 IL (10.11.2026 17:01 UTC)