To reach the Outlook.com and Hotmail inbox, you need passing SPF, DKIM, and DMARC on a domain you control, a clean sending IP with valid reverse DNS, a low complaint rate, and a list of people who actually want your mail. Microsoft enforces authentication strictly for anyone sending more than 5,000 messages a day to its consumer mailboxes, and it gives senders two free tools, SNDS and JMRP, to watch how its filters see them. Most Outlook deliverability problems trace back to one of those areas.

This guide covers the rules, the technical details Microsoft publishes, the monitoring tools, and a troubleshooting order for when mail goes to Junk. For the specific story of Microsoft moving from Junk-foldering to outright rejection of non-compliant bulk mail, read Microsoft now rejects non-compliant bulk mail outright.

Outlook.com vs Microsoft 365: two different filtering systems

When marketers say “Outlook deliverability,” they usually mean two different things.

Consumer mailboxes: addresses at outlook.com, hotmail.com, live.com, and msn.com. Microsoft runs the filtering, and the rules on its sender policies page apply.
Business mailboxes on Microsoft 365 (Exchange Online): addresses at a company’s own domain, like jane@acme.com, hosted by Microsoft. Filtering is shaped by Microsoft’s defaults and by each organization’s admin settings, such as quarantine policies and allow or block lists.

The high-volume sender requirements described below apply to Microsoft’s consumer services. Microsoft’s 550 5.7.515 support article lists Outlook.com, Hotmail, Live.com, and MSN. B2B senders whose recipients are on Microsoft 365 still benefit from the same authentication work, but a block there may come from the recipient company’s own policy.

Microsoft’s requirements for high-volume senders

Microsoft’s sender policies page says domains sending more than 5,000 emails per day to Outlook.com accounts must be fully compliant with SPF, DKIM, and DMARC, effective May 5, 2025. Its support article frames the threshold as 5,000 or more messages using the same 5322.From domain.

Requirement	What Microsoft asks for
SPF	Must pass for the sending domain
DKIM	Must pass
DMARC	Record published with at least `p=none`; `p=reject` recommended
Alignment	DMARC must pass, with SPF or DKIM aligned to the From domain (ideally both)
Reverse DNS	Sending servers need valid PTR records

Microsoft’s announcement on its Tech Community blog originally said non-compliant mail would go to Junk first, with rejection to follow at a later date. Microsoft’s current support documentation describes non-compliant messages being rejected with this error:

550 5.7.515 Access denied, sending domain example.com does not meet the required authentication level.

If you see that code in your bounce logs, your domain is over the threshold and at least one of SPF, DKIM, or DMARC isn’t passing or aligning. The usual cause is a single sending platform still signing with its own domain instead of yours.

These rules mirror what Gmail and Yahoo already require. See Gmail and Yahoo bulk sender requirements for a side-by-side view.

Minimum DNS setup for Outlook

example.com.                 IN TXT  "v=spf1 include:_spf.your-esp.example -all"
s1._domainkey.example.com.   IN TXT  "v=DKIM1; k=rsa; p=MIIBIjANBgkqh..."
_dmarc.example.com.          IN TXT  "v=DMARC1; p=none; rua=mailto:dmarc@example.com"

Then check a delivered message. In Outlook.com, open the message, choose View > View message source, and find the Authentication-Results header:

Authentication-Results: spf=pass (sender IP is 192.0.2.10) smtp.mailfrom=mail.example.com;
 dkim=pass (signature was verified) header.d=example.com;
 dmarc=pass action=none header.from=example.com;
 compauth=pass reason=100

You want dmarc=pass and a header.d that matches or is a subdomain of header.from. The full walkthrough is in How to Set Up SPF, DKIM, and DMARC Step by Step.

Technical rules Microsoft publishes

Microsoft’s sender policies page lists infrastructure rules that many senders never read:

Connection limits. Don’t open more than 500 simultaneous connections without prior arrangement.
No dynamic IPs. Connections from dynamic (residential) IP space may not be accepted.
Reverse DNS. Sending servers need valid PTR records. The hostname should resolve back to the same IP.
Respect permanent failures. Don’t retry after a 500-599 response, and stop sending to addresses that keep failing.
No namespace mining. Don’t guess addresses (john@, john.smith@, jsmith@) to see which ones are accepted.

The last two points matter for list quality. Microsoft explicitly treats repeated sends to dead addresses as bad behavior. Retrying permanent failures or “testing” addresses by sending to them is exactly the pattern its filters are built to catch. When Microsoft defers you with 4xx codes, slow down rather than retrying harder.

Monitoring Outlook deliverability with SNDS and JMRP

Microsoft offers two free programs through its postmaster site, both described on its services page:

Smart Network Data Services (SNDS) shows per-IP data: how much mail you sent, the share Microsoft’s filters judged as spam (shown as green, yellow, or red), complaint rates, and whether an IP is currently blocked.
Junk Mail Reporting Program (JMRP) sends you a report each time an Outlook.com user marks your message as junk. Microsoft says feedback typically starts within as little as 72 hours of enrolling.

Both are IP-based, so they’re most useful if you send from dedicated IPs. On a shared IP pool, your ESP sees the data, not you. We cover setup and interpretation in Microsoft SNDS and JMRP.

Why Outlook sends your mail to Junk

When authentication passes and mail still lands in Junk, the cause is usually reputation or recipient behavior. Work through these in order.

1. Complaints

Every “Report junk” click counts. Complaints come from people who don’t remember signing up, get more mail than they expected, or can’t find the unsubscribe link. Process JMRP reports as unsubscribes immediately.

2. Bad addresses and spam traps

High bounce rates and trap hits signal a poorly maintained list. In SNDS, a big gap between RCPT commands and actual message recipients can point to outdated addresses, according to Microsoft’s SNDS FAQ. Old lists, purchased lists, and addresses typed with errors are the usual sources. See spam traps: the two kinds and how they got on your list.

Before you import a list or after a long sending gap, screen it. Our free email verifier checks syntax and MX records, flags disposable and role-based addresses, detects free-mail domains, and catches typos like hotnail.com or outlok.com. It doesn’t open an SMTP connection to the mailbox, so it won’t confirm that a specific inbox exists, but it removes the addresses that are guaranteed to fail.

3. Volume spikes

Going from 2,000 messages a week to 200,000 overnight looks like a compromised account. Increase volume gradually on new domains and IPs. See email warm-up.

4. Shared IP neighbors

On a shared pool, other senders’ behavior affects you. If your own metrics look clean, ask your ESP about the pool’s SNDS status. At steady, high volume, a dedicated IP puts your reputation in your own hands.

5. Content and links

Links to domains with poor reputation, URL shorteners, and mismatched display and link domains can all hurt. Keep link domains consistent with your sending domain where possible.

Getting help from Microsoft sender support

If you believe your IP is blocked in error, Microsoft’s services page lists Sender Support for escalating deliverability issues. Before you file:

Confirm SPF, DKIM, and DMARC pass and align.
Check SNDS for your IP’s filter result and status.
Fix whatever caused the block (list source, volume spike, compromised account).
Include the exact error text and timestamps from your logs.

Requests that say “we fixed the problem, here is what changed” get further than requests that just ask for removal.

Watch Microsoft separately in your own data

Blended metrics hide Microsoft-specific problems. Break your reporting out by recipient domain so outlook.com, hotmail.com, live.com, and msn.com form their own group:

Bounce codes. Track 5.7.515 (authentication), other 5.7.x policy blocks, and 4xx deferrals separately. A sudden rise in one code at Microsoft only points to a Microsoft-specific issue.
Click rates. If clicks from Microsoft addresses drop while Gmail and Yahoo hold steady, suspect Junk placement.
Complaint trends. Compare JMRP report counts with send volume to Microsoft domains week over week.
Delivery time. Long delays to Microsoft domains usually mean deferrals your MTA is retrying.

Set these up as a simple weekly table. Most Outlook problems show up there days before anyone notices a drop in revenue.

Outlook deliverability checklist

Area	Check
Authentication	SPF, DKIM, and DMARC pass and align on every sending source
Infrastructure	Static IP, valid PTR, under 500 concurrent connections
Bounces	No retries after 5xx; suppress repeated failures
Monitoring	SNDS access for your IPs; JMRP feed enrolled
List quality	New lists screened; inactive subscribers sunset
Unsubscribe	Visible link in body plus `List-Unsubscribe` header
Volume	Gradual ramps on new domains and IPs

FAQ

Do Microsoft’s high-volume rules apply to Microsoft 365 business mailboxes?

Microsoft’s published high-volume requirements target its consumer services: Outlook.com, Hotmail, Live.com, and MSN. Mail to companies on Microsoft 365 goes through Exchange Online Protection plus each organization’s own policies. Passing SPF, DKIM, and DMARC helps in both cases.

What does 550 5.7.515 mean?

It means Microsoft rejected the message because your From domain didn’t meet the required authentication level for a high-volume sender. Check that SPF and DKIM pass and that DMARC passes with alignment for every platform that sends as your domain.

Can recipients fix Junk placement by adding me to Safe Senders?

For an individual recipient, adding you to Safe Senders or moving your mail out of Junk helps their own inbox. It doesn’t fix your reputation with everyone else, and it won’t override a rejection that happens during the SMTP transaction.

Do I need dedicated IPs to use SNDS?

SNDS works on IP addresses, so you can only register IPs you’re responsible for. If you’re on your ESP’s shared pool, the ESP holds that data, and you should ask them for it.

Outlook Deliverability: Getting Into the Outlook and Hotmail Inbox