Microsoft Outlook.com Sender Requirements

Microsoft's postmaster guidance for senders delivering to consumer Outlook.com mailboxes (outlook.com, hotmail.com, live.com, msn.com). It covers the authentication mandate for high-volume senders announced in April 2025 and enforced from May 5, 2025, plus the standing technical and policy requirements that apply to all senders.

Comparable mandates exist at Yahoo (see Yahoo Sender Requirements) and Gmail; Microsoft's version is the strictest on rejection behavior — non-compliant high-volume mail is rejected at SMTP time with 550 5.7.515 rather than only junk-foldered.

High-volume sender requirements (effective May 5, 2025)

Applies to domains sending more than 5,000 emails per day to Outlook.com. Enforcement is at the sending-domain level.

Mechanism	Requirement
SPF	Must pass for the sending domain. The domain's DNS record must accurately list authorized sending IP addresses/hosts.
DKIM	Must pass to validate email integrity and authenticity.
DMARC	Publish at least p=none, and the message must align with either SPF or DKIM (preferably both).

Enforcement behavior and timeline

• April 2025 (announcement): senders urged to audit and update SPF, DKIM, and DMARC records before enforcement.
• Original plan: after May 5, 2025, non-compliant high-volume mail would be routed to the Junk folder, with rejection at an unannounced later date.
• Revised (final) plan: Microsoft decided to reject non-compliant messages outright, effective May 5, 2025, "to ensure the protection of users and remove any confusion on why a message was in the junk folder for both the recipient and sender."
• Rejection string: 550; 5.7.515 Access denied, sending domain [SendingDomain] does not meet the required authentication level.
• Outlook additionally "reserves the right to take negative action, including filtering or blocking — against non-compliant senders, especially for critical breaches of authentication or hygiene."
• Senders below 5,000/day are not initially targeted by enforcement, but Microsoft states all senders benefit from the same practices; small-sender enforcement is not ruled out.

Hygiene recommendations for large senders

Published alongside the mandate as best practices (not SMTP-enforced, but grounds for negative action):

Practice	Detail
Compliant P2 (Primary) sender addresses	The From or Reply-To address must be valid, reflect the true sending domain, and be able to receive replies
Functional unsubscribe links	Easy, clearly visible opt-out, particularly for marketing/bulk mail; must be "easy to find and reliable when clicked"
List hygiene & bounce management	Remove invalid addresses regularly to reduce spam complaints, bounces, and wasted messages
Transparent mailing practices	Accurate subject lines, no deceptive headers, recipients must have consented

To verify compliance, inspect the Authentication-Results header on mail received at an Outlook.com mailbox (Microsoft documents header reading at learn.microsoft.com, "message-headers-eop-mdo").

Standing policies for all senders

From the Outlook.com postmaster policy page:

• Comply with the Microsoft Services Agreement and Anti-Spam Policy, plus CAN-SPAM and the laws of the sender's jurisdiction; unsubscribe claims must be honored per FTC guidance.
• The unsubscribe mechanism must be "clearly documented and easy for recipients to find and use."
• RFC 2821 / RFC 2822 (SMTP / message format) compliance is mandatory.
• Valid reverse DNS (PTR) records required for sending IPs.
• Mail from dynamic IP space is not accepted.
• No insecure relays or open proxies.
• No namespace mining (probing for valid addresses without sending mail).

Connection and retry limits

Rule	Value
Simultaneous connections	Max 500 without prior arrangement
Repeated non-delivery	Stop sending to an address after multiple non-delivery responses
Permanent errors	Do not retransmit a message after any 500–599 SMTP response

SMTP error codes

Outlook.com's documented deferral and rejection codes. 421 codes are temporary (reputation-based throttling); 550 codes are permanent.

Code	Meaning	Remediation
421 RP-001	Sending IP has exceeded the rate limit allowed (IP/domain reputation)	Improve reputation; slow down; escalate via sender support
421 RP-002	Rate limit exceeded on this connection (reputation)	Same as RP-001
421 RP-003	Connection limit exceeded (reputation)	Reduce simultaneous connections (≤500); improve reputation
550 5.7.515	Sending domain (>5,000/day) does not meet required authentication level	Pass SPF and DKIM; publish DMARC (p=none minimum) with alignment
550 SC-001	Rejected for policy reasons — spam-like content or poor reputation	Review content and reputation; request mitigation
550 SC-002	Namespace mining behavior detected	Verify machines aren't compromised; stop address-harvesting
550 SC-003	IP appears to be an open proxy/relay	Close the relay; remediate before requesting delisting
550 SC-004	IP blocked due to user complaints	Enroll in JMRP; remove complainers; request mitigation
550 DY-001	Mail from dynamic IPs is not accepted	Send from static IP space (Spamhaus PBL lists dynamic ranges)
550 DY-002	Sending pattern suggests a compromised or virus-infected host	Clean the host; contact ISP
550 OU-001	Generic policy rejection (third-party listing)	Check/request removal via Spamhaus
550 OU-002	Rejected for spam characteristics or reputation	Review content, authentication, and reputation

Additional documented remediation notes: verify reverse DNS; allow 48 hours of propagation after updating sender-authentication DNS records when a domain's purpose changes; enroll in JMRP to see what recipients mark as junk.

Reputation and monitoring tools

Microsoft provides two free programs — SNDS (per-IP reputation data: complaint rates, spam-filter verdicts) and JMRP (a feedback loop returning the full message when a recipient marks it junk/phishing). Both are covered in Microsoft SNDS & JMRP. Abuse can be reported to Microsoft at report_spam@outlook.com in RFC 2822 or ARF format.

Related

• DMARC — alignment, record syntax, moving to enforcement
• Yahoo Sender Requirements — the parallel 2024 Yahoo mandate
• Foundations of Email Deliverability — why complaint and engagement signals drive filtering