Microsoft Outlook bulk sender requirements checker
Microsoft's Outlook sender requirements say domains sending more than 5,000 emails a day to Outlook.com, Hotmail.com and Live.com addresses must pass SPF, pass DKIM, and publish DMARC of at least p=none aligned with one of them. Failing mail is rejected with 550 5.7.515. Enter your domain and this checker looks up all three records and lists Microsoft's recommendations separately.
Sample result
acme.example meets Microsoft's SPF, DKIM and DMARC rules for Outlook.com.
- Domain
- acme.example
- SPF
- Pass, -all
- DKIM
- Pass, selector1
What this means for you
You clear the bar, but DMARC at p=none blocks nothing; tighten it over time.
- SPF, DKIM and DMARC against Microsoft's rules
- Applies to over 5,000 messages a day
- Recommendations listed apart from rules
- Checks the sender can receive replies
- Outlook
- SPF
- DMARC
By SimpleVerifier Team · Last updated
How do I check if my domain meets Outlook's sender requirements?
- Enter the domain in your From address, or any email address at it.
- Press Check Outlook rules. The tool looks up SPF, DMARC and MX, and tries about 40 common DKIM selectors.
- Fix anything marked Fail first. These are the records Microsoft requires.
- Work through the Manual items: whether SPF and DKIM actually pass can only be seen on a delivered message, so send a test to an Outlook.com inbox and read its headers.
Example
- You enter
- The From domain
acme.example. - You get
- Requirements met in DNS: SPF passes (ends in
-all), DKIM is found on selector1, and DMARC passes atp=none, which meets Microsoft's rule but blocks nothing. List hygiene is listed as a manual recommendation. - Limits
- One domain per check and 10 checks a minute per connection. DKIM is tried on about 40 common selectors.
What are Microsoft's Outlook.com sender requirements?
Domains sending over 5,000 messages a day to Outlook.com addresses must pass SPF, pass DKIM, and publish DMARC at p=none or stronger, aligned with SPF or DKIM. The source is Microsoft's announcement, Outlook's New Requirements for High-Volume Senders, published 2 April 2025 and updated 29 April 2025. In its words, SPF "Must Pass for the sending domain", DKIM "Must Pass to validate email integrity and authenticity", and DMARC needs "At least p=none and align with either SPF or DKIM (preferably both)". Enforcement began on 5 May 2025, and the update says non-compliant mail is rejected with 550; 5.7.515 Access denied, sending domain [SendingDomain] does not meet the required authentication level.
Note the shape: SPF and DKIM must each pass. DMARC on its own accepts a message when either one passes and aligns, so a setup that relies on DKIM while SPF fails can pass DMARC and still miss Microsoft's stated SPF rule. That usually happens when the envelope (Return-Path) domain belongs to your sending platform; setting up a custom return-path domain fixes it.
Which Outlook rules are requirements and which are recommendations?
Only SPF, DKIM and DMARC are enforced; everything else in the post is a recommendation. The same post lists four "Additional Email Hygiene Recommendations": compliant sender addresses that can receive replies, functional unsubscribe links, list hygiene and bounce management ("Remove invalid addresses regularly"), and transparent mailing practices. They aren't enforced like the authentication rules, but Microsoft reserves the right to filter or block senders who ignore them. The checker marks them Recommended so they don't read as failures.
Two things differ from Gmail and Yahoo. Microsoft doesn't require one-click unsubscribe (RFC 8058) headers or publish a spam-rate threshold. And its FAQ says recipients' Safe Senders lists won't override a failing domain. If you already meet the Gmail and Yahoo rules, you meet Microsoft's, provided SPF passes on its own.
Do Outlook's sender requirements apply to Microsoft 365 business mail?
Not as announced. Microsoft scopes the rules to Outlook.com, its consumer service for outlook.com, hotmail.com and live.com addresses, and doesn't apply them to business domains hosted on Microsoft 365. It also doesn't say whether subdomains count together or what "per day" means exactly. Our close reading of the requirements covers those gaps.
DNS shows whether the records exist and look valid. It can't show whether a particular message passed, because SPF depends on the sending IP and DKIM on the signature in each message. Send a test to an Outlook.com mailbox and paste the headers into the email header analyzer: you want spf=pass, dkim=pass and dmarc=pass.
How do Outlook's sender requirements compare with Gmail's and Yahoo's?
| Outlook.com | Gmail and Yahoo | |
|---|---|---|
| Who is covered | Domains sending over 5,000 a day | Gmail: close to 5,000+ a day; Yahoo: no number |
| SPF and DKIM | Both must pass | Both required for bulk senders |
| DMARC | At least p=none, aligned | At least p=none, aligned |
| One-click unsubscribe | Recommended (functional unsubscribe links) | Required for marketing mail; Yahoo also accepts mailto |
| Spam complaint threshold | None published | Below 0.3% |
| Typical rejection | 550 5.7.515 | Gmail: 550 5.7.26 |
Who uses this tool, and for what?
- Cold emailers
- Check that each sending domain passes SPF on its own, not just DKIM, since Microsoft requires both. A missing custom return-path on your platform is the usual gap.
- Marketers
- Before a large send to a list with many Hotmail and Outlook.com subscribers, confirm all three records, then segment the list by mailbox provider to watch Outlook.com bounces on their own.
- Agencies
- When a client's campaigns start bouncing with
5.7.515, run their domain here, then fix records with the DKIM checker and the DMARC generator. - IT admins
- Audit the domains your organisation sends newsletters and notifications from, including subdomains used by third-party platforms.
What can’t this tool tell you?
- DKIM is tried on about 40 common selectors. A platform that uses a unique selector per account needs checking with that selector.
- It reads DNS, so it can't confirm that SPF and DKIM pass on a real message. That needs a test message and its headers.
- It doesn't know your sending volume. Whether the 5,000-a-day threshold applies to you is something only your own sending logs can show.
- Microsoft hasn't said how subdomains are counted or exactly how a day is measured, so the threshold can't be checked precisely by anyone outside Microsoft.
Common questions
- What are Microsoft's requirements for bulk senders?
- Domains sending more than 5,000 emails a day to Outlook.com, Hotmail.com and Live.com addresses must pass SPF, pass DKIM, and publish a DMARC policy of at least p=none that aligns with SPF or DKIM. Microsoft announced this on 2 April 2025, with enforcement from 5 May 2025.
- What does 550 5.7.515 mean?
- It's the rejection Microsoft returns when a high-volume sending domain fails its authentication requirements: "Access denied, sending domain does not meet the required authentication level." Fix SPF, DKIM and DMARC for the domain named in the bounce, then send a test.
- When did Outlook's new sender requirements start?
- Microsoft announced them on 2 April 2025 and began enforcing them on 5 May 2025. The post was updated on 29 April 2025 to say failing mail would be rejected with 550 5.7.515.
- Do the rules apply to Microsoft 365 business mailboxes?
- Microsoft's announcement scopes them to Outlook.com, its consumer service for outlook.com, hotmail.com and live.com addresses. It doesn't describe them as applying to mail sent to Microsoft 365 business tenants, which have their own filtering.
- What is the Outlook sending limit?
- That's a separate rule, about how much you can send from an Outlook account. Microsoft lists 5,000 recipients a day for Outlook.com accounts with a Microsoft 365 subscription, and 10,000 recipients a day for a Microsoft 365 business mailbox. The 5,000-a-day sender requirements are about mail received by Outlook.com, from any platform.
- Can recipients allow a failing sender in Outlook?
- Not for this. Microsoft's FAQ says adding a sender to Safe Senders won't override a high-volume domain that fails the authentication requirements. The fix has to be on the sending domain's SPF, DKIM and DMARC.
- I send fewer than 5,000 emails a day. Does this matter?
- The enforcement targets domains over 5,000 a day, but Microsoft's FAQ says all senders benefit from authentication, and Outlook.com's ordinary spam filtering applies to everyone. SPF, DKIM and DMARC are worth having at any volume.
- Does Microsoft require one-click unsubscribe?
- No. It recommends functional unsubscribe links, especially for marketing and bulk mail. Gmail and Yahoo do require RFC 8058 one-click unsubscribe for marketing mail, so if you send to all three, add the headers anyway.
Sources
Authentication and capacity are half of deliverability.
The other half is who you send to. Every hard bounce counts against the domain and inboxes you are sending from, and nothing in DNS can tell you which addresses on your list are dead.
- Bulk verification with real SMTP mailbox checks
- Hard bounces removed before a send, not discovered after
- Catch-all, disposable and role detection on every row
One plan, cancel anytime, no contract. Sign in with Google and your first 100 email checks are free, no card. The free tools stay free either way.