Last reviewed: July 13, 2026 · Written by Email Solutions
This guide covers two related but different problems:
- Business DNS setup — making Microsoft 365 mail authenticate so Gmail and others trust it
- Outlook.com bulk sender rules — domains sending 5,000+ messages/day to consumer Outlook/Hotmail/Live addresses
Scan your domain anytime on the free report.
Sources:
- Configure DKIM in Microsoft 365
- Outlook.com postmaster policies
- Google sender guidelines (for Gmail recipients)
Part A — Authenticate your Microsoft 365 domain
SPF
Publish one SPF TXT at the apex (or the sending subdomain). Microsoft's include for Exchange Online is commonly:
v=spf1 include:spf.protection.outlook.com -all
If Google Workspace or an ESP also sends as the same From domain, merge includes into a single record. Multiple v=spf1 TXT rows cause failures — see SPF PermError.
dig +short TXT example.com
dig +short MX example.com
MX for Microsoft 365 typically looks like example-com.mail.protection.outlook.com. If MX still points at an old host, fix routing before chasing spam complaints.
DKIM
- Sign in to Microsoft 365 Defender / the DKIM page in Exchange Online for your domain
- Microsoft asks for two CNAME records (selectors such as
selector1/selector2pointing at Microsoft-hosted targets) - Publish those CNAMEs at your DNS host (GoDaddy, Namecheap, Cloudflare, etc.)
- Enable DKIM signing for the domain in the admin UI after DNS propagates
dig +short CNAME selector1._domainkey.example.com
dig +short CNAME selector2._domainkey.example.com
Exact hostnames are shown in Microsoft's UI for your tenant — copy them; do not invent selector names from a blog.
DMARC
Start with monitoring:
v=DMARC1; p=none; rua=mailto:dmarc@example.com
Host: _dmarc
dig +short TXT _dmarc.example.com
DMARC passes when SPF or DKIM aligns with the visible From domain. Third-party tools that send as billing@yourdomain.com need their own SPF authorization and/or DKIM alignment — otherwise reports will show failures even when M365 itself is clean.
Part B — Outlook.com high-volume senders (5,000+/day)
Effective May 5, 2025, Microsoft's postmaster policies require domains sending more than 5,000 emails per day to Outlook.com consumer accounts (@outlook.com, @hotmail.com, @live.com) to be compliant with SPF, DKIM, and DMARC.
Non-compliant high-volume mail may be junked or rejected with:
550; 5.7.515 Access denied, sending domain [SendingDomain] does not meet the required authentication level.
Microsoft documents p=none as the minimum DMARC policy, with stronger policies recommended.
This bulk consumer rule is not identical to "my coworker on Exchange Online says mail is in junk." Always separate:
| Symptom | First checks |
|---|---|
| Internal M365 → M365 junk | Transport rules, user junk settings, Safe Links |
| External Gmail junk | SPF/DKIM/DMARC to Gmail + content/reputation |
High volume → Outlook.com 5.7.515 |
Bulk auth compliance per postmaster policies |
Practical verification order
- MX points at
*.mail.protection.outlook.com - Single SPF includes
spf.protection.outlook.com - DKIM enabled with both CNAMEs resolving
_dmarcpublished- /report + a real test send to a personal Gmail and Outlook.com address
- If you send marketing volume, also read the bulk sender checklist
Related
- Landing summary: /deliverability/microsoft-365-email-authentication
- Hands-off DNS: /fix