# What are Microsoft's new email authentication rules? > Microsoft announced it will enforce the same email authentication standards that Google and Yahoo already require. Microsoft has brought its consumer mailboxes in line with the rest of the industry. Since **May 5, 2025**, anyone sending **more than 5,000 messages a day** to Outlook.com, Hotmail.com, or Live.com must authenticate that mail with [SPF](/learning/what-is-spf), [DKIM](/learning/what-is-dkim), and [DMARC](/learning/what-is-dmarc). This is the same [email authentication](/learning/what-is-email-authentication-and-why-does-it-matter) bar that Google and Yahoo began enforcing for bulk senders in February 2024, so Microsoft is closing a gap rather than inventing a new standard. If your team is deciding whether to run this work itself or use outside help, see [how to choose an email authentication service](/learning/email-authentication-service) before assigning sender inventory, report review, and policy approval. ## Who the rules apply to The 5,000-messages-per-day threshold is measured across Microsoft’s consumer domains, Outlook.com, Hotmail.com, and Live.com, not across your entire recipient list. A newsletter, a billing system, and a helpdesk that together push more than 5,000 messages a day to those mailboxes all count toward the same limit. Lower-volume senders are not carved out in practice: Microsoft evaluates the same authentication signals for everyone, and unauthenticated mail from any source is more likely to be filtered. ## What Microsoft now requires - **SPF must pass.** Publish an [SPF record](/tools/spf) that lists every service authorized to send for your domain, and keep it under SPF’s ten-DNS-lookup limit so it does not silently break. - **DKIM must pass.** Sign outbound mail with [DKIM](/tools/dkim) (a 1024-bit key is the floor, and 2048-bit is recommended) so receivers can verify the message was not altered in transit. - **DMARC must be published at a minimum of `p=none`,** and each message must align: the SPF- or DKIM-authenticated domain has to match the domain in the visible From address. A monitor-only record satisfies the letter of the rule, but only [`p=quarantine` or `p=reject`](/resources-post/why-you-need-to-enforce-dmarc-in-2025) actually stops someone spoofing your domain. Microsoft also expects the hygiene basics that bulk receivers now treat as table stakes: valid forward and reverse DNS (PTR) for your sending IPs, a functional From and Reply-To address, and a working one-click unsubscribe on marketing mail. ## What happens to non-compliant mail At enforcement, high-volume mail that fails these checks is routed to the **Junk** folder rather than the inbox. Microsoft has been explicit that this is a grace period: once senders have had time to fix their configuration, failing mail will be **rejected** outright with the SMTP error `550 5.7.15 Access denied`. A hard bounce is far more costly than a spam placement. The message never reaches the recipient, and repeated rejections erode your domain’s standing with Microsoft. ## Why it matters These standards exist to stop phishing, spoofing, and fraudulent mail that damages both brands and recipients. For a legitimate sender the upside is direct: authenticated mail is trusted, reaches the inbox more reliably, and carries your brand’s reputation instead of an attacker’s. Ignoring the rules risks the opposite: junking today, hard bounces tomorrow, and a domain that anyone can impersonate in the meantime. ## Steps to get ready - Audit your DNS for correct SPF, DKIM, and DMARC entries, and inventory every service that sends as your domain. - Check your posture with Palisade’s free [Email Security Score](/tools/email-security-score) to see which layer is missing or misaligned. - Validate DKIM signatures with the [DKIM checker](/tools/dkim) and confirm your [SPF record](/tools/spf) resolves within the lookup limit. - Publish DMARC at `p=none`, read the aggregate reports, and ramp toward `p=quarantine` then [full enforcement at `p=reject`](/learning/glossary/dmarc-p-reject) as your senders pass. Our guide to [simplifying the journey to DMARC enforcement](/learning/how-can-you-simplify-the-journey-to-dmarc-enforcement) walks through each stage. - Once you reach enforcement, add [BIMI](/tools/bimi) so your logo appears next to authenticated mail. ![Five-step preparation flow: audit DNS records, check your Email Security Score, add BIMI, validate DKIM, and confirm SPF.](/images/figures/microsoft-email-auth-requirements-fig1.webp "1200x800") *Steps senders can take now that Microsoft's enforcement is live.* ## Quick takeaways - Microsoft enforces SPF, DKIM, and DMARC for senders of more than 5,000 messages a day to Outlook.com, Hotmail.com, and Live.com. - Enforcement began May 5, 2025. - DMARC must be at least `p=none` and aligned with SPF or DKIM. - Non-compliant mail is junked now and will be rejected with `550 5.7.15 Access denied` after the grace period. - The rules mirror the Google and Yahoo bulk-sender requirements from February 2024. ## Frequently Asked Questions - **When did Microsoft start enforcing these rules?** Enforcement began May 5, 2025. Non-compliant high-volume mail is filtered to Junk first, and Microsoft has said it will progress to outright rejection after a grace period. - **Do these rules apply to bulk marketing emails?** Yes. Any sender pushing more than 5,000 messages a day to Outlook.com, Hotmail.com, or Live.com must meet the SPF, DKIM, and DMARC standards, marketing mail included. - **What happens if my DMARC policy is still `p=none`?** A `p=none` record satisfies the minimum requirement, so your mail can still be delivered, but `p=none` does nothing to stop spoofing, so quarantine or reject is the real goal. - **What error do rejected messages return?** Once Microsoft moves from junking to rejection, failing mail bounces with `550 5.7.15 Access denied`. - **Is BIMI required?** No. BIMI is optional and only displays once DMARC is at quarantine or reject, but it reinforces brand trust and is worth adding after you reach enforcement. ## Additional Resources - [Outlook’s new requirements for high-volume senders (Microsoft)](https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/strengthening-email-ecosystem-outlook%E2%80%99s-new-requirements-for-high%E2%80%90volume-senders/4399730) - [Google email sender guidelines](https://support.google.com/a/answer/81126?hl=en) - [Google is making email sender requirements stricter](/learning/google-is-making-email-sender-requirements-stricter-starting-nov-2025) For a provider-specific implementation of these authentication checks, see [Why does Outlook show an unverified sender warning?](/learning/outlook-unverified-sender-warning).