Microsoft now rejects non-compliant bulk mail outright

Microsoft began enforcing bulk sender requirements for Outlook, Hotmail and Live in May 2025, with a grace period during which failing mail was filtered rather than refused. That grace period ended in April 2026.

Non-compliant bulk mail to Microsoft consumer domains now gets a permanent rejection. This is a different failure mode from the spam folder, and it needs a different response.

The requirements

They are deliberately close to Gmail's, which is the useful part — one configuration satisfies both.

• SPF published and passing
• DKIM signing, aligned with the From domain
• DMARC published, at minimum p=none
• Valid reverse DNS on the sending IP, forward-confirming
• Functional unsubscribe, honoured promptly
• Low complaint rate — Microsoft's threshold sits under 0.2%

The threshold is the one real difference. Gmail's stated ceiling is 0.3%; Microsoft is stricter. If you are targeting 0.1% as a matter of habit you satisfy both without thinking about it.

What rejection looks like

A filtered message is delivered to a folder you cannot see. A rejected message produces a 5xx response at the SMTP transaction, and your sending system records a hard bounce.

This has a consequence people rarely plan for. If your bounce handling is strict — and it should be — a wave of compliance rejections will suppress a batch of addresses that were never actually invalid. The recipients exist and the mailboxes work; your configuration was wrong.

So before you let automatic suppression act on a sudden spike of Microsoft bounces, read the response text. A 5xx citing authentication or policy is a configuration problem, not a bad address, and suppressing the address solves nothing while losing you the recipient.

Smart Network Data Services

Microsoft's equivalent of Postmaster Tools is SNDS, and it works differently: you register a sending IP range and prove you control it, after which you get complaint rates and trap hits for those IPs.

It is IP-based rather than domain-based, which makes it genuinely useful if you send from dedicated IPs and considerably less useful if you are on a shared pool. Pair it with the Junk Mail Reporting Program, which is Microsoft's feedback loop — complaints come back to you as messages rather than as a statistic.

The practical order of work

1. Confirm SPF, DKIM and DMARC all pass and align. Alignment is where this usually fails: a message can pass both checks against a provider's domain and still fail DMARC because the From domain is yours.
2. Check the PTR record on every sending IP, and that it resolves forward to the same IP.
3. Verify the HELO name matches that hostname.
4. Confirm one-click unsubscribe works without a login and is honoured within two days.
5. Register your IPs with SNDS and sign up for JMRP.

Steps one to three are checkable in a few minutes with the SPF, DKIM and DMARC checkers. Step four is the one that quietly fails, because a preference centre behind a login looks like an unsubscribe flow and does not satisfy the requirement.

If you are already being rejected

Fix the configuration first — there is no point requesting review of a setup that still fails. Then reduce volume to Microsoft domains while the fix takes effect, because continuing to hammer a provider that is refusing your mail does further damage to the sending IP.

Rejections are not a filtering decision that reverses when reputation improves. They are a policy decision that reverses when the policy is satisfied, which means the recovery is usually faster than recovering from a reputation problem — provided you actually satisfied it.