Microsoft DMARC requirements – What it means and how it impacts Outlook.com users

microsoft-dmarc

South Africa, Apr 16, 2025

Updated: November 2026

What are Microsoft's DMARC requirements?

 

Microsoft's rules bring Outlook.com in line with the bulk sender requirements Google and Yahoo introduced in 2024. High-volume senders must meet four authentication requirements:

  • SPF must pass. Your SPF record lists the mail servers and services allowed to send email on behalf of your domain.
  • DKIM must pass. DKIM adds a digital signature to each email, proving it was authorised by your domain and wasn't altered in transit.
  • A DMARC record must be published, with a policy of at least p=none. DMARC tells receiving mail servers how to handle emails that fail authentication, and sends reports back to the domain owner.
  • DMARC must align with SPF or DKIM, and Microsoft recommends both. Alignment means the domain in the visible From address matches the domain authenticated by SPF or DKIM.

     

Which domains do the requirements apply to?

The requirements apply to any domain that sends more than 5,000 emails a day to Microsoft's consumer email services:

  • outlook.com
  • hotmail.com
  • live.com
  • msn.com


Once a domain crosses that threshold, Microsoft expects all email from that domain to comply, including lower-volume streams such as transactional and service emails.


Business mailboxes on Microsoft 365 are a separate case. They are filtered by Exchange Online Protection, which uses SPF, DKIM and DMARC as signals without applying the same 5,000-a-day rule. Microsoft 365 does honour a sender's own DMARC policy, so an email that fails DMARC from a domain publishing p=reject can be rejected at any volume.


In South Africa, the organisations most affected are those that email consumers at scale, such as banks, insurers, retailers, travel and hospitality groups, and municipalities sending statements and billing notices.

What happens if the organisation's emails do not comply?

Microsoft said non-compliant email from high-volume domains would first be routed to the Junk folder, with rejection to follow. Senders now report outright rejections, returned with this error:
550; 5.7.515 Access denied, sending domain [your domain] does not meet the required authentication level.


The rejection happens during delivery, before the email reaches the mailbox, so a recipient's safe sender list won't override it. For organisations that rely on email for statements, renewals, bookings or marketing, that means lower deliverability, fewer customer responses and lost revenue.

How do Microsoft's rules compare with Google and Yahoo?

All three providers now expect bulk senders to authenticate with SPF, DKIM, and DMARC, with some differences in the details:

  • Google (Gmail): since February 2024, bulk senders must pass SPF and DKIM, publish an aligned DMARC record of at least p=none, offer one-click unsubscribe on marketing email, and keep spam complaint rates below 0.3%. Gmail moved to permanent rejections for non-compliant senders in November 2025.
  • Yahoo: introduced similar requirements for bulk senders in 2024, including authentication, DMARC, and easy unsubscribe.
  • Microsoft (Outlook.com): since May 2025, senders of more than 5,000 emails a day must pass SPF and DKIM and publish an aligned DMARC record of at least p=none. Microsoft recommends a working unsubscribe link but hasn't published a spam complaint threshold.


If your domain already meets Gmail's requirements, it most likely meets Microsoft's as well.

Should low-volume senders comply anyway?

Yes. Below 5,000 emails a day the rules aren't enforced as hard requirements, but the same authentication checks feed into Microsoft's spam filtering and sender reputation at every volume. Meeting them improves the chances of your emails reaching the inbox.


Microsoft also recommends these practices for all senders:

  • Send from a valid From address that recipients can reply to.
  • Include a clear, easy-to-use unsubscribe link.
  • Keep mailing lists clean by removing bounced addresses, duplicates and people who have opted out.
  • Avoid misleading subject lines and email headers.

 

Why p=none isn't enough

A DMARC policy of p=none meets Microsoft's minimum, but it only monitors. It reports on emails that fail authentication without stopping them, so cybercriminals can still send emails that appear to come from your domain.


The strongest protection is p=reject, which tells receiving mail servers to block any email that fails DMARC. Getting there safely takes planning. You need to identify every legitimate service sending email on your behalf, authenticate each one, and move from p=none to p=quarantine to p=reject without blocking genuine email along the way.

How Logicalis helps you comply with DMARC

Logicalis South Africa has partnered with Sendmarc to help organisations test, implement and manage SPF, DKIM and DMARC across every domain and sending service they use.


We help you meet Microsoft, Google and Yahoo's requirements, then take your domains through to full p=reject protection, so your emails reach the inbox and cybercriminals can't impersonate your brand.

For more information on our DMARC protection solution, please click here 
 

Topic

Related Insights