What are Microsoft's new email authentication rules?

Microsoft’s New Email Authentication Rules

Microsoft announced it will enforce the same email authentication standards that Google and Yahoo already require. This means every email sent to Outlook.com, Hotmail, or other Microsoft services must pass SPF, DKIM, and DMARC checks. The enforcement timeline is still “when, not if,” so preparing now is essential.

If your team is deciding whether to run this work itself or use outside help, see how to choose an email authentication service before assigning sender inventory, report review, and policy approval.

Key Requirements

• All outbound mail must have valid SPF, DKIM, and DMARC records.
• DMARC enforcement will move from “none” to “quarantine” or “reject” as providers roll out.
• Maintain low spam complaint rates to protect sender reputation.

Why It Matters

These standards aim to stop phishing, spoofing, and fraudulent emails that damage brands and users. By adopting them, you improve deliverability and protect your reputation.

Steps to Get Ready

• Audit your DNS for correct SPF, DKIM, and DMARC entries.
• Use Palisade’s Email Security Score to check DMARC compliance.
• Implement BIMI branding to boost brand visibility – Learn about BIMI.
• Validate DKIM signatures – DKIM verification tool.
• Confirm SPF records – SPF checker.

Steps senders can take now, before Microsoft's enforcement begins.

At a glance

Quick Takeaways

• Microsoft will enforce SPF, DKIM, and DMARC for all senders.
• Enforcement timeline is “when, not if.”
• DMARC will shift to quarantine/reject soon.
• Low spam rates are essential for reputation.
• Use Palisade tools to verify each authentication layer.

Additional Resources

• Google Email Sender Guidelines- Google & Yahoo Bulk Sender Requirements- New Gmail Delivery Requirements