On this pageJump to a section
Picture the sequence you spent a weekend writing. Five emails. A good subject line. A call to action that actually fits.
Now picture a buyer on an Outlook address who never sees any of it, because the first email went to junk and the next four followed it there. No bounce. No error. Just silence that looks exactly like "they weren't interested."
That is what this is about. As of this week, Microsoft joins Gmail and Yahoo in setting authentication rules for high-volume senders. If your nurture email is running on a domain that is not set up properly, the problem is not your copy.
What did Outlook actually require?
Microsoft's announcement, posted April 2, 2025 and updated April 30, applies to domains that send more than 5,000 emails per day to Outlook.com consumer addresses, which covers outlook.com, hotmail.com and live.com.1 Three technical requirements stand out.
The three checks
- SPF must pass for the sending domain, with a DNS record that accurately lists the servers allowed to send for you.1
- DKIM must pass, which validates that the message was not altered and really came from the domain.1
- DMARC must be at least p=none and align with SPF or DKIM, preferably both.1
At least p=none and align with either SPF or DKIM (preferably both).
What happens if you fail
Microsoft said non-compliant messages from high-volume domains would be routed to Junk beginning May 5, 2025. Rejection will follow at a date not yet announced, and rejected messages return an error that says the sending domain does not meet the required authentication level.1 The post also says Safe Sender lists are not honored for this enforcement.1 In plain terms, your recipient adding you as a contact does not rescue a message that fails the checks.
Is this just Gmail and Yahoo all over again?
Yes, and that is the point. The big mailbox providers are converging on one standard.
In October 2023, Google announced that starting in 2024 it would require bulk senders, defined as those sending more than 5,000 messages a day to Gmail addresses, to authenticate their email. It also said senders must let recipients unsubscribe with one click, and must stay under a reported spam threshold.2 Yahoo announced the same week that in the first quarter of 2024 it would require bulk senders to authenticate with SPF, DKIM and DMARC, support one-click unsubscribe, honor those requests within two days and keep user-reported spam under a threshold.3
With Microsoft in, the three largest consumer inboxes now expect the same basics. The era of sending marketing email from an unverified domain and hoping for the best is closing.
What do SPF, DKIM and DMARC do, in plain English?
Think of three questions a mailbox provider asks about every message.
| The question | The answer that proves it |
|---|---|
| Is this server allowed to send for this domain? | SPF: a published list of authorized senders |
| Was this message tampered with, and does it really come from you? | DKIM: a digital signature attached to each email |
| What should I do if the first two fail? | DMARC: your published policy, plus reports back to you |
- Message sentFrom your own authenticated domain
- SPFIs this server allowed to send for you?
- DKIMWas the message signed and unaltered?
- DMARCDoes the policy align with SPF or DKIM?
- PlacementInbox if checks pass, Junk if they fail
Why alignment matters
It is not enough for each check to pass somewhere. The domain in the visible "From" address needs to line up with the domain that passed SPF or DKIM. That is what "aligned" means, and it is why a sloppy setup with a shared sending domain can pass SPF yet still fail DMARC.
Start with p=none
The minimum Microsoft asks for is a DMARC policy of p=none, which tells receivers to take no special action on failures but lets you receive reports about who is sending as your domain.1 That is a safe place to start. Tightening the policy later is a decision for your IT person or email provider, not something to rush.
How do you check your setup in 15 minutes?
You do not need to be technical to find out where you stand. You need two tabs open: your email platform's help pages, and the place where your domain's DNS is managed.
- Find your sending domain. Look at the "From" address on your nurture emails. That domain is the one that needs to be authenticated.
- Search your email platform's help for "authenticate domain." Most platforms walk you through adding the SPF and DKIM records. Copy their exact values.
- Add the records in your DNS settings. If you do not control DNS, ask whoever registered your domain.
- Publish a DMARC record at p=none. Include an address for the reports so you can see what is sending as you.
- Send a test to a Gmail address and an Outlook address. Open the message details and look for pass results for SPF, DKIM and DMARC.
- Re-check after every tool change. Adding a new form, CRM or booking tool that sends email as you can break alignment.
What else keeps nurture emails out of junk?
Authentication gets you through the door. It does not make anyone want your email (the full cadence is in Build the Follow-Up Before You Buy the Traffic).
Make unsubscribing easy
Both Google and Yahoo set the expectation of one-click unsubscribe, honored within two days.23 I would do this for every list, no matter the size. A visible unsubscribe link costs you a few names and protects you from spam complaints, which cost far more.
Watch complaints, not just opens
Google and Yahoo both said senders must keep user-reported spam below a threshold.23 The two providers did not publish a specific number in the announcements I opened, so I will not quote one. What I will say is that complaints are the signal that gets domains in trouble, and they come from sending to people who did not ask for it or no longer want it.
Send to people who want it
Clean your list. Stop emailing people who have not opened anything in a long time. Confirm opt-ins on your forms, and keep your consent language tight. A smaller engaged list beats a bigger cold one at every provider.
Why this is a revenue problem, not an IT problem
A lead who does not see your first email never enters your funnel. They do not book, they do not buy and you will never know why. That is lost revenue disguised as a low response rate.
From the ad side, the pattern is familiar: money spent to bring people in, then lost in the first inbox, the gap I described in Leads Are Not the Product. Fixing authentication is an hour of setup that protects every dollar you spend on traffic.
Traffic is expensive. Letting the first email land in junk is the cheapest way to waste it.
A connected review of ads, pages and follow-up is what I do for experts.
Keep building.Ekai
Questions people ask
What are Outlook's new requirements for high-volume senders?
Microsoft requires domains sending more than 5,000 emails per day to Outlook.com consumer addresses to pass SPF and DKIM and publish a DMARC policy of at least p=none that aligns with SPF or DKIM. Enforcement began May 5, 2025.
What happens if my emails fail Outlook's requirements?
Per Microsoft's announcement, non-compliant messages from high-volume senders are routed to the Junk folder starting May 5, 2025, with outright rejection planned later on a date not yet announced.
Do small senders need SPF, DKIM and DMARC?
The formal thresholds apply to senders above 5,000 messages a day. My view is that every business sending marketing email should authenticate anyway, because mailbox providers filter on trust signals at every volume.
What did Gmail and Yahoo require in 2024?
Both announced that bulk senders must authenticate their email and offer one-click unsubscribe that is honored within two days, and keep user-reported spam below a threshold.
Sources
- 1
- 2
- 3
