Outlook Bulk Sender Requirements: SPF, DKIM, DMARC and the 550 5.7.515 Error (2026)

Outlook's bulk sender requirements, in short: any domain sending more than 5,000 emails a day to Outlook.com, Hotmail and Live addresses must pass SPF, pass DKIM, and publish a DMARC record of at least p=none that aligns with SPF or DKIM. Since 5 May 2025, mail that fails is rejected with “550 5.7.515 Access denied”.

More on this topic: Cold email and deliverability, every guide in one place.

Microsoft announced the rules on 2 April 2025, following Google and Gmail and Yahoo, which set similar rules for bulk senders in 2024. The original plan sent failing mail to Junk first; a 29 April update changed that to outright rejection from the same 5 May date. This guide sets out exactly what Microsoft requires, how it compares with Gmail and Yahoo, and what it means for a cold email programme.

Key takeaways

What are Outlook's requirements for bulk senders?

Outlook requires high-volume senders to pass SPF, pass DKIM and publish a DMARC policy of at least p=none that aligns with SPF or DKIM. These three are mandatory; Microsoft also lists hygiene practices it expects and reserves the right to filter or block senders who ignore them.

Requirements checked on 26 October 2026 against Microsoft's announcement on the Microsoft Defender for Office 365 blog (techcommunity.microsoft.com, updated 30 April 2025) and Microsoft Support's article on NDR error 550 5.7.515; Google's email sender guidelines and FAQ; and Yahoo's sender best practices. Providers can change their rules without notice.

Microsoft Support's article on the rejection error words the authentication rules slightly differently: SPF and DKIM should both pass, a DMARC record should exist (its example is v=DMARC1; p=none), and the message must pass DMARC with at least one of SPF or DKIM aligned to the From domain. In practice, set up all three and make DKIM sign with your own domain.

Who counts as a high-volume sender for Outlook?

Microsoft's announcement applies the rules to domains sending more than 5,000 emails a day to its consumer service, which covers outlook.com, hotmail.com and live.com addresses. Its support article counts 5,000 or more messages to Microsoft consumer email services where all of them use the same domain in the From address.

• The count is per domain, not per mailbox. Ten mailboxes on one domain sending 600 each to Outlook.com addresses is 6,000 from that domain.
• Only consumer addresses count. The announcement names Outlook.com and its hotmail.com and live.com domains; it does not describe the rules as applying to company mailboxes hosted on Microsoft 365.
• All mail from the domain counts, so newsletters, receipts and cold email sent from the same domain add up.

Microsoft's own FAQ answers the question small senders ask: enforcement targets large senders first, but all senders benefit from the same practices. Mail that is not authenticated is more likely to be filtered whatever the volume.

What happens if you do not comply?

Since 5 May 2025, Outlook rejects messages from high-volume domains that fail the authentication requirements, with the bounce “550; 5.7.515 Access denied, sending domain [SendingDomain] does not meet the required authentication level.” The message is not delivered at all, not even to Junk.

Two details in Microsoft's FAQ matter for senders. A recipient adding you to their safe senders list will not bypass the enforcement, and an SPF record that needs more than ten DNS lookups can fail SPF, which is easy to hit once you add several sending services.

How do you fix a 550 5.7.515 error?

Fix a 550 5.7.515 bounce by making the From domain pass authentication: confirm SPF authorises the server that sent it, that DKIM signs with your domain, and that a valid DMARC record exists and passes with at least one of them aligned. Microsoft Support suggests working through it in this order.

• Read the headers. Open a delivered test message and check the SPF, DKIM and DMARC results, and whether the return-path domain matches the From domain.
• Check DNS. SPF lists every service that sends for you, DKIM keys are published for each selector, and DMARC is published at _dmarc.yourdomain.com with p=none, p=quarantine or p=reject.
• Check every third-party sender. Your cold email tool, CRM and newsletter platform must sign with your domain's DKIM key and appear in your SPF record.
• Re-send a test to an Outlook.com address and confirm all three pass before resuming volume.

Our email deliverability checklist walks through each record with examples.

How do Outlook's rules compare with Gmail and Yahoo?

All three require SPF, DKIM and DMARC of at least p=none for bulk senders, so one correct setup satisfies all of them. Gmail and Yahoo add a spam-rate limit and one-click unsubscribe; Microsoft lists unsubscribe and list hygiene as recommended practices rather than mandatory requirements.

All senders, at any volume, must already meet Gmail's and Yahoo's baseline: SPF or DKIM, valid forward and reverse DNS, and a spam rate under 0.3%; Gmail also requires TLS. Microsoft has not published an equivalent all-sender list for its new rules.

Do Outlook's bulk sender rules apply to cold email?

They apply to any mail from a domain that crosses the threshold, cold email included, but most small cold email programmes never send 5,000 emails a day to Outlook.com addresses from one domain. The authentication itself is still worth doing at any volume, because unauthenticated cold email is far more likely to be filtered.

A careful cold sender keeps each mailbox to a few dozen emails a day and spreads volume across several domains, which keeps most domains well below 5,000 a day. Microsoft's hygiene recommendations line up with cold email best practice anyway: a real reply-to address, a clear opt-out and a verified list. For volume planning, see how many cold emails per day per inbox; for a new domain, how to warm up a new sending domain.

If you send cold email from Scalry, which publishes this guide, you connect your own mailboxes over SMTP or a sending service, so SPF, DKIM and DMARC are set on your own domain with your mail provider. Each mailbox has its own daily cap, unsubscribes are suppressed across every campaign, and a CAN-SPAM footer is applied to every send.

Frequently asked questions

What are Microsoft's requirements for bulk email senders?

Domains sending more than 5,000 emails a day to Outlook.com, Hotmail and Live addresses must pass SPF, pass DKIM and publish a DMARC policy of at least p=none aligned with SPF or DKIM.

When did Outlook's bulk sender rules start?

Enforcement began on 5 May 2025. Microsoft announced the rules on 2 April 2025 and on 29 April changed the penalty from Junk to rejection.

What does error 550 5.7.515 mean?

Outlook rejected the message because the sending domain does not meet the required authentication level: SPF, DKIM or DMARC failed or is missing for a high-volume domain.

Does DMARC have to be p=reject for Outlook?

No. p=none is the minimum. Microsoft says p=reject offers the best protection once all legitimate sources are aligned, and advises moving gradually from none to quarantine to reject.

Do the rules apply to Microsoft 365 business mailboxes?

Microsoft's announcement says the rules apply to Outlook.com, its consumer service for outlook.com, hotmail.com and live.com addresses. It does not describe them as covering company mailboxes on Microsoft 365.

I send fewer than 5,000 emails a day. Do I need SPF, DKIM and DMARC?

Yes. Gmail and Yahoo require SPF or DKIM from every sender, and Microsoft says all senders benefit from authentication. Setting up all three costs nothing and protects your domain from spoofing.

Will a safe senders list stop Outlook rejecting my mail?

No. Microsoft's FAQ says safe sender lists are not honoured for this enforcement.

How Scalry sends sequences from your own authenticated mailboxes, with per-mailbox caps, is described on the cold email page.