Outlook's High-Volume Sender Rules: Does Your Newsletter Comply?

What Microsoft requires from high-volume senders

Microsoft announced the requirements on 2 April 2025 in a Microsoft Defender for Office 365 blog post. They apply to Outlook.com, Microsoft's consumer service covering outlook.com, hotmail.com and live.com addresses, for domains sending more than 5,000 emails a day.

Microsoft's update of 29 April 2025 changed the penalty. Instead of sending non-compliant mail to Junk first, Outlook.com rejects it with the error "550; 5.7.515 Access denied, sending domain does not meet the required authentication level", taking effect on 5 May 2025. Microsoft also reserves the right to filter or block senders who break the hygiene recommendations.

Does this apply to a Singapore small business?

Strictly, only if your domain sends more than 5,000 emails a day to Outlook.com consumer addresses. Very few small businesses reach that from normal email. A newsletter to a list of 6,000 sent in one go, or a busy online shop's order emails, can.

Microsoft's own FAQ answers the obvious question: even below 5,000 a day, all senders benefit from the same practices. Google's email sender guidelines use a similar 5,000-a-day threshold for bulk senders and require SPF or DKIM from every sender. Missing DMARC and newsletter platforms not authenticated on the company domain are two common reasons small business mail ends up in Junk.

This rule does not change how mail to Microsoft 365 business mailboxes is filtered. If your emails land in Junk at companies using Microsoft 365, see our guide to emails going to spam in Outlook.

How to check your domain and newsletter platform

You can check all of this without technical tools, using a test email to an Outlook.com address you control.

1. 1

   Send a test campaign to an Outlook.com address

   Create a free outlook.com account if you have none. Send a real campaign from your newsletter platform and a normal email from your mailbox.

2. 2

   Open the message headers

   In Outlook.com, open the message, choose the three-dot menu, then View, View message source. Search for Authentication-Results.

3. 3

   Look for spf=pass, dkim=pass and dmarc=pass

   All three should say pass. If DKIM passes but shows the platform's domain (for example mcsv.net or sendinblue.com), DKIM is not aligned with your domain.

4. 4

   Set up the platform's domain authentication

   Mailchimp, Brevo and Klaviyo each have a domain authentication page that gives you DKIM (and sometimes SPF) records to add to your DNS. Add them and verify.

5. 5

   Publish a DMARC record

   Add a TXT record at _dmarc.yourdomain.com, starting with v=DMARC1; p=none; and a rua address to receive reports. Move to quarantine or reject once reports look clean.

6. 6

   Check the From address accepts replies

   Send from an address on your own domain that a person reads, not a free Gmail address or an unmonitored no-reply.

Microsoft's guide to configuring DMARC explains the record format. Our SPF, DKIM and DMARC guide walks through the DNS records step by step.

Unsubscribe links: one-click and the Spam Control Act

Microsoft recommends a functional, visible unsubscribe link. Gmail goes further for bulk senders and requires one-click unsubscribe, the List-Unsubscribe-Post header defined in RFC 8058. Mainstream newsletter platforms add these headers automatically once your domain is authenticated.

Singapore law sets its own minimum. The Spam Control Act 2007 treats emails as sent in bulk if more than 100 messages with the same or similar content go out in 24 hours, or more than 1,000 in 30 days. Under its Second Schedule, unsolicited commercial emails sent in bulk must:

• include an email address the recipient can use to unsubscribe, with a statement saying they may use it;
• stop further unsolicited messages within 10 business days of an unsubscribe request;
• keep unsubscribe requests confidential;
• carry the label <ADV> with a space before the title in the subject line.

A newsletter sent only to people who opted in is not unsolicited, but the opt-in has to be real. If part of your list was bought, scraped or imported from old contacts, those addresses are a legal and deliverability risk. This is general information, not legal advice.

List hygiene and sending habits that keep you out of Junk

Authentication gets you through the door; reputation decides the folder. Microsoft lists bounce management, consent and accurate subject lines as expected practice.

Do it yourself or get help?

If you can edit your DNS and your newsletter platform has a clear domain authentication page, you can fix this in an hour. It gets harder when several systems send as your domain: website forms, online shop, invoicing, CRM and the newsletter, each needing its own records without breaking SPF.

Our Emails Land in Spam Fix (S$249) sets up SPF, DKIM and DMARC for every service that sends as your domain, authenticates your newsletter platform and monitors delivery for 14 days. If you are still choosing a platform, compare Mailchimp, Brevo and Klaviyo first.