Since May 5, 2025, Microsoft has implemented stricter email authentication policies for emails sent to Outlook.com, Hotmail.com, and Live.com addresses. These changes aim to improve email security and reduce spam, phishing, and spoofing.
While these rules mainly apply to high-volume senders (over 5,000 emails per day), businesses of all sizes may experience email delivery issues if their domain is not properly configured.
What Are the New Requirements?
Microsoft expects all senders to have the following authentication protocols in place:
- SPF (Sender Policy Framework) – Authorises which mail servers can send email on your behalf.
- DKIM (DomainKeys Identified Mail) – Uses a digital signature to verify the sender and message integrity.
- DMARC (Domain-based Message Authentication, Reporting, and Conformance) – Tells receiving email systems how to handle emails that fail SPF or DKIM checks.
At minimum, Microsoft requires a DMARC policy of p=none, along with valid SPF and DKIM records.
What Happens If These Are Not Set Up?
- Emails may be marked as spam or junk.
- Some messages may be blocked completely.
- Increased risk of domain spoofing and phishing attacks.
Who Should Take Action?
You should review your email authentication settings if your business:
- Sends email to Outlook, Hotmail, or Live accounts.
- Uses third-party email services (e.g. CRMs, newsletters, marketing tools).
- Relies on email for communicating with customers, suppliers, or partners.
Even if your sending volume is low, correct authentication helps ensure emails are delivered successfully and securely.
What You Can Do
- Check your domain’s SPF, DKIM, and DMARC records – Use tools like MXToolbox or DMARCian.
- Contact your IT provider or domain host – They can help configure the required DNS records.
- Test email deliverability – Send test emails to Microsoft accounts and monitor spam placement.
Summary
Email Deliverability = Business Continuity
Being blocked before your message even arrives? That’s a risk.
This isn’t a technical ‘nice-to-have’ – it’s now a compliance essential.
- Microsoft’s rules came into effect on 5 May 2025.
- SPF, DKIM, and DMARC are now essential for all domains.
- Businesses of all sizes may be affected, not just high-volume senders.
- Proper setup improves delivery and reduces risk of impersonation.
To maintain trust and reliable email communication, businesses are encouraged to review their domain settings and take corrective action if needed.
Need Guidance?
Want to check if your domain is set up correctly?
We offer a free domain check to help you understand where things stand and what steps may be needed. Securing your email domain isn’t just a technical task – it’s a business-critical move.
Email: [email protected] Phone: 0330 229 0041
