Outlook's Bulk Sender Requirements: What Cold Emailers Must Do Now

Microsoft has published formal bulk sender requirements for Outlook.com and Hotmail addresses, targeting domains that send 5,000 or more messages per day. Enforcement is phased: non-compliant mail gets routed to junk first, then rejected outright. If your sequences touch Outlook inboxes and your authentication records are incomplete, you have a concrete deliverability problem to fix.

What Microsoft Actually Announced

The requirements mirror what Google and Yahoo rolled out in early 2024. Domains crossing the 5,000 emails/day threshold to Outlook.com and Hotmail recipients must have:

1. A valid SPF record that passes for the sending domain
2. DKIM signing with at least a 2048-bit key
3. A DMARC record with at minimum p=none

Microsoft has set a phased enforcement schedule. In the first phase, non-compliant messages are silently routed to junk. In the second phase, they are rejected at the gateway. Microsoft has not published exact cutover dates publicly, but the blog post signals the transition from phase one to phase two is already underway as of mid-2025.

The 5,000 Threshold Is Easier to Cross Than It Looks

Five thousand emails per day sounds like a lot. It isn't, for most active cold email operators.

Consider a typical setup: three sending domains, each running 10 to 15 mailboxes, each mailbox sending 40 to 50 emails per day. That's 1,200 to 2,250 messages per domain, or 3,600 to 6,750 across the full rotation. You can hit the threshold with a single well-warmed sending infrastructure.

The count is per sending domain, not per campaign or per tool account. If you run separate domains for different clients or verticals and any single domain clears 5,000 daily sends to Outlook addresses, that domain falls under the requirement. Your other domains do too, because the safest assumption is that your volume patterns put you in scope for all of them.

The Three Requirements, Broken Down

SPF (Sender Policy Framework) is a DNS TXT record that lists which mail servers are authorized to send on behalf of your domain. A basic SPF record for a domain using Google Workspace looks like v=spf1 include:_spf.google.com ~all. The ~all softfail is acceptable for compliance, but -all hardfail is better hygiene. Check that every sending IP or mail service your domain uses is included. Forgotten includes from legacy tools are a common failure point.

DKIM (DomainKeys Identified Mail) attaches a cryptographic signature to outgoing messages. The receiving server verifies the signature against a public key in your DNS. Microsoft's requirement is a minimum 2048-bit key. Many default setups from older ESP configurations still use 1024-bit keys. Audit this specifically. If your DNS host or sending tool generated a DKIM key more than two or three years ago, it may be undersized.

DMARC (Domain-based Message Authentication, Reporting, and Conformance) ties SPF and DKIM together and tells receiving servers what to do when checks fail. At minimum, a p=none record satisfies the requirement and starts generating forensic and aggregate reports. A record like v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com covers baseline compliance. Moving to p=quarantine or p=reject over time gives you more protection if your domain is spoofed.

What Happens If You're Non-Compliant

Phase one: your messages land in junk for Outlook and Hotmail recipients. Open rates drop. Replies drop. You may not immediately know why, because many cold email tools don't expose mailbox-level junk routing data.

Phase two: rejection. The receiving server returns a bounce. Your campaigns stop delivering to those addresses entirely. For sequences targeting enterprise contacts who use Microsoft 365 for their corporate email (which is a large share of the business market), this is a significant problem.

How This Compares to Google and Yahoo

Google's bulk sender requirements have been enforced since February 2024. They cover the same three authentication standards with a nearly identical 5,000/day threshold. Yahoo aligned requirements launched at the same time.

The broader pattern across providers is clear: authentication is becoming a baseline table-stakes requirement, not a nice-to-have. Microsoft is the last major provider to formalize these rules. There is no realistic expectation that non-compliant sending will remain viable anywhere in the medium term.

Compliance Checklist for Cold Email Operators

Go through this for every sending domain you own or manage:

Check	Tool / Method	Pass Criteria
SPF record exists	MXToolbox SPF lookup	Record found, all sending IPs/includes covered
SPF result	Send test, check headers	spf=pass
DKIM record exists	MXToolbox DKIM lookup	Record found for selector
DKIM key size	DKIM record inspection	2048-bit minimum
DKIM result	Send test, check headers	dkim=pass
DMARC record exists	MXToolbox DMARC lookup	Record found
DMARC policy	Record inspection	p=none minimum
DMARC alignment	Headers on received mail	SPF or DKIM aligned with From domain

For each domain, run the check before assuming it's clean. Inherited domains from acquisitions or agency setups frequently have gaps.

How Cold Email Tools Handle This

Instantly and Smartlead both support multi-domain inbox rotation heavily. Neither tool automatically configures your DNS records, but both provide documentation and some UI prompts for DKIM and DMARC during domain setup. The actual DNS changes still happen at your registrar or DNS host.

Quickmail and Woodpecker are more typically used with Google Workspace or Microsoft 365 SMTP connections. If you're sending through those providers, DKIM is handled at the provider level, but you still need to publish SPF and DMARC on your sending domain.

Lemlist has a domain health checker built into the onboarding flow that flags missing authentication records. It doesn't fix them for you, but the visibility helps.

None of these tools can publish DNS records on your behalf. The authentication setup is infrastructure work that lives outside any sending platform.

What This Means for Your Operation

If you run any volume against Outlook or Hotmail addresses, check your DNS records this week. The work is not complicated. For most domains, it's 30 minutes of DNS edits and a few test sends to verify headers. The risk of skipping it is real: silent junk routing is hard to diagnose, and rejection bounces hurt domain reputation further.

Authentication records are infrastructure. Set them once, verify them on a schedule, and move on. The industry has consolidated around these standards. There is no path forward that doesn't require them.