Executive Summary: New email authentication rules from Microsoft will impact bulk senders starting May 2025. To protect users from spoofing and phishing, Microsoft will require SPF, DKIM, and DMARC authentication—bringing its policies in line with Google and Yahoo. Red Sift offers tools to help organizations comply and maintain deliverability.
This article:
- Outlines Microsoft’s new email requirements for bulk senders effective May 5, 2025.
- Highlights the need for SPF, DKIM, and DMARC to avoid junking or rejection.
- Discusses the benefits of Red Sift OnDMARC and free tool Red Sift Investigate—for fast, effective compliance.
Microsoft has officially announced new authentication requirements for bulk email senders—referred to as ‘high volume senders’ in their documentation—aligning with the policies rolled out in 2024 by Google and Yahoo. These changes aim to improve email security and deliverability for Outlook.com users, covering domains like outlook.com, hotmail.com, and live.com.
The update marks a significant shift as Microsoft moves to require SPF, DKIM, and—critically—DMARC (Domain-based Message Authentication, Reporting, and Conformance). This signals a broader industry push toward stronger sender authentication, helping protect users from spoofed or fraudulent emails.
These changes will roll out progressively:
- After May 5th, 2025, Outlook will begin routing messages from high-volume non‐compliant domains to the Junk folder, giving senders an opportunity to address any outstanding issues.
- At a later date, messages that are not compliant will be rejected.
If your organization isn’t compliant yet, now is the time to act. This article compiles essential resources, including our free Bulk Sender’s Compliance Checker, Red Sift Investigate, to help you prepare for Microsoft’s new requirements with confidence.
Ready to get started? Unlock your free Red Sift OnDMARC trial and start your DMARC implementation now.
What’s changing—and what it means for your organization
Microsoft’s latest announcement signals a major shift in how businesses must manage email authentication. Much like Google and Yahoo’s February 2024 policy changes, this move aims to stop phishing, spoofing, and spam by ensuring only properly authenticated emails reach recipients.
For senders, the key takeaway is clear: DMARC compliance is now essential. Without it, organizations risk having their emails to Outlook, Hotmail, and other Microsoft domains filtered to spam—or blocked entirely.
If your business hasn’t implemented DMARC yet, now’s the time to act. You’ll need to ensure your SPF, DKIM, and DMARC records are correctly configured to meet Microsoft’s requirements.
While non-compliance could disrupt email marketing, transactional messages, and customer communications, organizations that act now stand to benefit: stronger security, better deliverability, and enhanced brand protection.
Key resources to help you stay compliant
What is DMARC?
DMARC is an email security protocol that enables domain owners to protect their domains from unauthorized use, such as phishing and email spoofing. By implementing DMARC, organizations can specify how receiving mail servers should handle emails that fail authentication checks, thereby enhancing email security and preserving brand reputation.
The protocol also provides reporting mechanisms, offering visibility into potential abuse of the domain. Read more in our complete email security guide.
The role of DMARC in email security
DMARC plays a crucial role in protecting your business from phishing and business email compromise (BEC) attacks. By setting your policy to ‘p=reject’ (the strongest enforcement), you can prevent unauthorized senders from using your domain, keeping your emails secure and your brand protected.
Learn more about the role of DMARC in email security.
How DMARC supports marketers
Boost email marketing ROI by implementing DMARC
Email deliverability hinges on compliance but is also an essential step in securing ROI for those email marketing campaigns. Hear from Rebecca Warren, VP of Marketing at Red Sift, on how you can maximise ROI in email marketing.
What should I do next?
Check if you’re bulk sender compliant with Red Sift Investigate
Using our free tool Red Sift Investigate, you can instantly assess whether your email domains meet Microsoft’s new requirements. Our tool delivers a visual breakdown of whether your organization is ready and what actions are required.
Unlock your Red Sift OnDMARC trial today
Adapting to Microsoft’s changes need not be daunting. With Red Sift OnDMARC, you can streamline your DMARC implementation while unlocking a range of benefits:
- Simplified email authentication: Manage SPF, DKIM, DMARC, and MTA-STS all in one place. A single DNS update eliminates the need for ongoing manual changes.
- In-depth forensic insights: Get real-time alerts and detailed reports on failed authentication attempts, including AI-driven spoofing detection backed by a vast security database.
- Boost brand visibility: Achieve full DMARC enforcement (p=reject) and display your logo in inboxes with BIMI, enhancing email recognition and trust.
- Powerful AI automation: Red Sift Radar accelerates issue detection and resolution, cutting response times by up to 10x and reducing operational costs.
- DNS Guardian: Red Sift’s DNS Guardian monitors for unauthorized DNS changes and safeguards critical email security records.
- Seamless expansion: Easily integrate with Red Sift Brand Trust, Red Sift ASM, and Red Sift Certificates, scaling your email security strategy as your needs evolve.
Ignoring today’s new requirements could result in email deliverability issues, spam filtering, or outright rejection. Take the first step today by starting your free Red Sift OnDMARC trial to begin your DMARC implementation and step-by-step guide to reaching enforcement (p=reject).
Need expert guidance? Speak to the Red Sift team today.
