All you need to know about Microsoft's new deliverability rules for May 2025

From May 5, Microsoft will tighten its deliverability rules for bulk emailers. The aim is to similar to the new deliverability rules established by Gmail and Yahoo! in 2024: strengthen email security to protect recipients.

These new Outlook deliverability rules therefore concern mainly email authentication by SPF, DKIM and DMARC. But someother parameters such as response addresses are also highlighted.

This article will be regularly updated as new information is received and behaviors observed by Badsender's deliverability consultants.

In short: you need to authenticate your emails correctly to deliver to Microsoft :

The tightening of deliverability rules announced by Microsoft mainly concerns theemail authentication which becomes mandatory.

What are the new obligations?

Here are the details delivered by Outlook:

1. SPF - Sender Policy Framework For SPF, all you need is SPF registration which authorizes the servers and IPs you use (I hope this is already the case).
2. DKIM - DomainKeys Identified Mail You must pass DKIM to validate the authenticity and integrity of your emails.
3. DMARC - Domain-based Message Authentication, Reporting, and Conformance : It is necessary to have a DMARC record with at least "policy=none". At the very least, domains should be aligned with SPF or DKIM, but ideally with both.

To cut a long story short, it's nothing new. These recommendations can be found in every email deliverability guides a long time ago.

What are the consequences of non-compliance?

What's new are the consequences that Outlook will apply between now and May 5. From that date, Microsoft will be able to move non-compliant emails to spam boxes.

In the futurebut the date is not yet known, emails that have not been properly authenticated will simply be able to be rejected without arriving in your spam or inbox.

Outlook also takes stock of other recommendations

In announcing these new rules, Microsoft is also taking stock of other issues, such as best practices deliverability never a bad thing to remember. Beyond the "best practices" aspect, Microsoft does not rule out taking action if they are not respected. This can range from spamming to blocking emails.

Here they are:

• Ensure that From and Reply-to addresses are real addresses: This means that these addresses must be able to receive replies from recipients, and that the Reply-to must be on the same domain as the From domain.
• A functional unsubscribe link This means that your unsubscribe links must not be stashed away and must work (immediately, not 2 weeks later)
• Managing bounces and list quality : Microsoft puts the emphasis on regularly delete invalid addresses and work to reduce spam complaints.
• Transparent email marketing practices First and foremost, of course, consent! Secondly, it's important to be honest, and not to oversell in objects and headers, at the risk of generating disappointment and spam complaints.

What changes from the Gmail and Yahoo! rules unveiled in 2024?

If you have complied with new deliverability rules for Gmail and Yahoo! from 2024, these new features from Microsoft shouldn't affect you too much. Chances are you've already done most of the actions requested.

One notable difference is the recommendation on reply-to addresses which must be functional. If indeed this leads to spam or blocked emails, a point of differentiation to keep an eye on.

At Badsender, we always encourage our customers to refuse to have a no-reply policy. You should do the same.

What does Outlook define as a mass sender?

Under Microsoft's new deliverability rules, high-volume email senders are all those who send over 5,000 emails a day.

As with other e-mail providers, this figure of 5,000 e-mails per day should be treated with great caution. Generally speaking, if you're sending commercial emails from a dedicated email solution, it's strongly recommended that you apply the new Outlook rules to the letter.

Microsoft, Outlook... which mailboxes are affected by these changes?

Only consumer mailboxes are concerned, excluding corporate mailboxes managed by Office365.

When Microsoft talks about its "Outlook" service, it's talking about the consumer mailboxes managed by what is traditionally known as "Hotmail". This concerns a very large number of domain names: hotmail.com, live.com, outlook.com, hotmail.com, live.fr, outlook.fr, hotmail.be, hotmail.it, live.de...

Source: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/strengthening-email-ecosystem-outlook's-new-requirements-for-high?volume-senders/4399730