Microsoft Joins Google and Yahoo: New Email Rules for Bulk Senders

One year ago, Google and Yahoo announced new email rules to combat spam.

Starting May 5, 2025, Microsoft joins them with a new announcement.

Microsoft will start enforcing new authentication rules and requirements for high-volume senders emailing to recipients using Microsoft consumer services, aka @outlook.com, @hotmail.com, and @live.com addresses.

The changes mirror the recent email requirements from Google and Yahoo.

And like the Google and Yahoo changes, this shift in email deliverability standards impacts digital PRs and link builders.

In this post, I’ll explain what’s changing, what to do next, and how this impacts your campaigns.

• Take effect May 5, 2025
• Impact bulk senders, aka sending 5,000+ emails/day to Microsoft consumer email addresses
• Must pass SPF and DKIM
• Must publish a DMARC record (at least p=none)
• Must align the “From” domain with SPF/DKIM
• Must use valid reply-to/from addresses
• Must include working unsubscribe links

Who Do the New Rules Apply To?

If you send over 5,000 emails/day to Microsoft consumer emails (outlook.com, live.com, or hotmail.com), you must meet their new standards.

Even if you’re sending outreach from multiple addresses, you are still considered a bulk sender if they are from the same primary domain.

Agencies are most at risk for this. Let me show you how:

What Microsoft means by “same primary domain”

It’s easy to qualify as bulk senders without even realizing it. Let’s pretend you work at a big agency with a domain like @agency.com.

If these senders all email people in 24 hours, you’d be considered a bulk sender:

• John@agency.com sends 1,500.
• Lucy@agency.com sends 2,000.
• Tim@agency.com sends 500.
• Kareem@agency.com sends 1,100.

You’ve sent 5,100 emails from the same domain, @agency.com, so Microsoft sees this as one sender.

Here it is broken down visually:

It’s essential to add that even if no one answers, the addresses are incorrect and they bounce back, or you get an auto-reply like out of office, it still counts as a “sent” email.

What Microsoft means by “free consumer services”

To clarify one other point, when Microsoft says “free consumer services”, here’s what they mean:

• If you send to: outlook.com, hotmail.com, or live.com addresses, these rules apply.

• If you send to: business emails (even if they use Microsoft 365/Outlook), these rules don’t apply (yet).

This is similar to Google/Yahoo, but business emails may be the next in line for these requirements.

When Do the Rules Go Into Effect?

Here is the timeline as explained by Microsoft:

May 5, 2025 – Microsoft will route any non-compliant emails directly to Junk folders.

Future Date (TBA) – Microsoft will reject non-compliant emails.

Although we don’t know the full date yet when Microsoft will begin to reject emails that fail to comply, Google took about two months to start.

Google launched its new requirements in February 2024, and by April 2024, it was already rejecting a small percentage, with a gradual increase over time.

What Are the New Requirements and How to Comply?

Before you start, use this free tool to check if you already meet requirements using a tool like Redsift.

This will point out most of the core requirements for general email health. If you’re already in compliance, you may even be able to skip some of the requirements below.

Here are the requirements:

1. Authenticate with SPF

Sender Policy Framework (SPF) helps authenticate email addresses and prevent spam.

To pass, you must ensure your domain’s SPF record lists the IP address you are sending from.

How: Your DNS provider has specific instructions for doing this. Here is how to add an SPF record on Microsoft.

Two things they point out:

• If you use a “Microsoft Online Email Routing Address” (MOERA) domain for email (like @agency.onmicrosoft.com), you already have SPF records set up.

• If you use a custom domain, like @agency.com, you must set up SPF records. Microsoft further recommends setting up a subdomain when using bulk email services with your custom domain.

Also, each subdomain requires its own SPF authentication.

2. Authenticate with DKIM

DomainKeys Identified Mail (DKIM) helps match up information (like the from: address) to ensure the message wasn’t altered.

The requirement is that your messages are authenticated with DKIM.

How: Microsoft 365 outlines how to set up your DKIM records here, but here are some important things to point out:

• If you use (MOERA) domain for email (like @agency.onmicrosoft.com), again, you already have DKIM set up.

• If you use a custom domain, like @agency.com, you must set up DKIM records. Microsoft also recommends setting up a subdomain if you use bulk email services with your custom domain.

• Each subdomain requires its own DKIM record.

Most of the work can be done through Email authentication settings and selecting the DKIM tab.

3. Publish a DMARC Record

Domain-based Message Authentication, Reporting, and Conformance (DMARC) is yet another email validation and authentication method.

For example, here is a screenshot of GoDaddy’s DMARC setup screen via DMarcly.

Microsoft requires a basic DMARC record (p=none), but in the post comments, a Microsoft representative said, “over time, we aim to move toward stricter authentication without causing major email disruptions.”

This means that for stronger protection, it’s recommended to use p=quarantine or p=reject.

How: Microsoft outlines how to publish a DMARC record here, but here are some important considerations:

• If using MOERA for email, you must create the DMARC TXT record.
• If using custom domains, you must set up a DMARC TXT record.

The rest are Microsoft’s “recommendations” for maintaining “email hygiene,” meaning that we think they are important but maybe not explicitly required.

The documentation says, “Outlook reserves the right to take negative action, including filtering or blocking against non‐compliant senders, especially for critical breaches of authentication or hygiene.”

4. Align “From” Domain with SPF/DKIM

Email providers want to ensure that the person sending the email is allowed to send it on behalf of the sender address.

• If sending from a subdomain, the SPF/DKIM/DMARC must include the subdomain.

• If you use a custom mail server, ask your dev team to validate that headers are RFC 5322 compliant.

Basically, the “From” address must be tied to an actual mailbox that can receive replies (not an unmonitored address like noreply@).

5. Include an Unsubscribe Link

Microsoft also wants users to include unsubscribe links within the email message.

They also recommend header-level unsubscribe support via the “List-Unsubscribe” and “List-Unsubscribe-Post” to enable the Unsubscribe button in the UI:

To display the unsubscribe link like the above screenshot, you need to use a List-Unsubscribe header with the one-click unsubscribe link (RFC 8058).

6. Clean Your Email List

Invalid email addresses and high bounce rates will hurt your deliverability. So, use a tool like NeverBounce to clean your email lists before sending.

Next, I’ll help answer users’ specific questions on the Microsoft announcement blog post.

FAQ About Microsoft Email Requirements

Here are some questions (and answers) based on the comments section.

Who Do These Rules Apply To? Just Free Outlook Addresses?

These rules only apply when sending to personal, consumer emails (name@hotmail.com, name@live.com, name@outlook.com).

These rules don’t apply to emails sent to Microsoft 365 business accounts (name@company.com) or corporate domains hosted on Exchange Online.

Microsoft said, “We don’t plan to expand this to Enterprise yet… This is focused only on Microsoft’s consumer services.”

Do Subdomains Count Toward the 5,000 Bulk Sender Limit?

Yes, all messages from subdomains count as sent from the primary domain.

For example, it counts as 5,000 emails you’re sending:

• 2,500 emails from @promo.agency.com
• 2,500 emails from @agency.com

Again, the total would also include bounced emails, auto-replies, etc.

Do “No-Reply” or Unmonitored Addresses Hurt Deliverability?

Microsoft requires the From or Reply-To address be able to receive replies.

So, using noreply@yourdomain.com is discouraged.

For this, Microsoft said, “We may start blocking non-RFC-compliant addresses… We encourage all senders to ensure their P2 sender addresses comply with RFC standards.”

Do I Need Both SPF and DKIM to Pass?

Yes, both SPF and DKIM must pass authentication checks.

For DMARC to work correctly, only one of SPF or DKIM needs to align.

Can I Just Tell Recipients to Add Me to the Safe Sender List?

Unfortunately, it’s not as easy as asking recipients to add your bulk emails to a safe sender list.

As Microsoft said, it can “be counterproductive… it increases the risk of spoofing.”

What is Buzzstream Doing to Help Users Send to Microsoft Addresses?

If you use BuzzStream for outreach, there is a range of built-in features to ensure emails comply with Microsoft, Google, and Yahoo’s new guidelines.

One-Click Unsubscribe Support

BuzzStream users can enable one-click unsubscribe:

This is an optional feature for users but is recommended for compliance.

We can also include header-level unsubscribe links for most users.

Email Format Standard Adherence

BuzzStream formats all email messages using the Internet Message Format standard, which is needed to meet many of Microsoft’s requirements.

Prospect Vetting with BuzzMarker

The BuzzMarker and ListIQ (in beta) make it simple to find relevant email targets, reducing the likelihood of spam complaints.

Personalization of Emails

BuzzStream’s template features help customize and personalize emails, reducing the recipient’s risk of marking them as spam.

Custom Tracking Domain Setup

BuzzStream offers a custom tracking domain option.

This helps ensure that tracking URLs align with a user’s domain, aiding sender reputation and deliverability.

Last, let’s compare Microsoft’s requirements with Google/Yahoo’s.

Comparing Microsoft vs Google/Yahoo Bulk Sender Requirements

The two announcements are virtually identical, with a few minor differences. Here’s the quick side-by-side comparison:

Who’s affectedSenders emailing 5k emails/day to Gmail/Yahoo personal inboxesSenders emailing 5k emails/day to @outlook, @hotmail, @live.com addresses

What Does This All Mean for PRs and Link Builders?

Although Google and Yahoo are slightly more strict, the writing is on the wall: email senders need to stop spamming or they risk getting filtered, flagged, or blocked.

Their requirements and recommendations, like SPF/DKIM/DMARC, go beyond the technical side.

Notice how they also recommend sending to real emails from confirmed addresses.

All of the major providers are pushing for transparency.

They recommend personalizing emails and keeping your lists up to date.

Gone are the days of spray and pray. To succeed today in link building and PR, you need highly targeted, highly relevant outreach.

Vince Nero

Vince is the Director of Content Marketing at Buzzstream. He thinks content marketers should solve for users, not just Google. He also loves finding creative content online. His previous work includes content marketing agency Siege Media for six years, Homebuyer.com, and The Grit Group. Outside of work, you can catch Vince running, playing with his 2 kids, enjoying some video games, or watching Phillies baseball.

More Posts by Vince Nero
Website: https://buzzstream.com