Emails Going to Spam in Outlook or Hotmail? Fix This First

For Outlook.com and Hotmail recipients, fix authentication first: Microsoft requires SPF pass, DKIM pass and DMARC with at least p=none plus alignment for domains sending over 5,000 emails per day. If you ignore that, mail can land in Junk or be rejected with 550 5.7.515. This guide gives the checks, records, warm-up limits and verification steps.

Use this as a fix flow, not a theory page. Start with the header and bounce checks. Then repair SPF, DKIM and DMARC before you change copy, volume or tools. Keep the Outlook warm-up guide open if you need provider-specific context, and use the free SPF checker, DKIM checker and DMARC checker while you work.

What should you check first?

Do not start by rewriting your email. Outlook.com and Hotmail filtering begins with identity and trust signals. A useful email from an unauthenticated domain can still look risky.

Send one message to an Outlook.com or Hotmail recipient you can contact. In Outlook.com web, open the message, choose More actions (...) → View → View message source, and copy the full headers. Look for Authentication-Results, From, Return-Path, DKIM-Signature, Junk placement, and any bounce text.

If headers show authentication failures, stop there. Reputation work is wasted until Microsoft can verify who sent the mail.

Why are emails going to spam in Outlook?

Outlook.com and Hotmail are consumer mailboxes. They see large volumes of unwanted mail, so Microsoft filters based on authentication, past recipient behaviour, sender reputation and current sending patterns.

The most concrete rule is for high-volume senders. For domains sending more than 5,000 emails per day, Microsoft requires SPF pass, DKIM pass and DMARC with at least p=none plus alignment. Since 5 May 2025, non-compliant mail can be rejected with 550 5.7.515.

Microsoft also recommends working unsubscribe handling, list hygiene and consent. It does not state a numeric complaint threshold in the sender-rules facts used here.

Do not treat 5,000 emails per day as a safe zone. A smaller sender can still land in Junk when authentication fails, volume jumps, or recipients dislike the mail. The threshold tells you when Microsoft’s stated high-volume requirements apply.

Use primary sources when you need current Microsoft routes. Start with Microsoft sender support and, for IP-level visibility where available, Smart Network Data Services.

How do you fix SPF, DKIM and DMARC?

Authentication is the fastest useful repair. It gives Microsoft a stable identity to judge. Without it, you are asking a recipient provider to trust mail that cannot be tied cleanly to your domain.

Repair SPF

SPF is a DNS TXT record that lists the servers allowed to send for a domain. It normally lives at the root domain or the sending subdomain.

A simple record looks like this:

v=spf1 include:your-sending-provider.example ~all

Do not copy that include. Use the include or IP mechanism from your actual sender: Google Workspace, Zoho, SendGrid, Mailgun, Amazon SES, your hosting mail server or another provider.

Keep one SPF record per hostname. Multiple SPF TXT records at the same name can cause SPF failure. If you use several senders, merge them into one record.

Check it with the free SPF checker. You want the domain in your visible From address, or the return-path domain used by your provider, to authorise the server that actually sent the message.

Repair DKIM

DKIM signs the message with a private key held by your sending provider. The public key is published in DNS, usually at:

selector._domainkey.yourdomain.com

The selector comes from the provider. Common examples include google, zmail, default, selector1, selector2, k1, s1, mail, dkim, lark, feishu and zoho. Use the selector your provider gives you.

In an Outlook.com header, find dkim=pass or dkim=fail inside Authentication-Results. If DKIM is missing, enable it in the sending platform. If it fails, check the selector, DNS value and whether a forwarding or security gateway modified the message.

Use the free DKIM checker to confirm the public key exists.

Publish DMARC

DMARC tells receivers how to evaluate SPF and DKIM against the visible From domain. Microsoft’s high-volume rule requires DMARC at least p=none with alignment.

Start with this record if you are not ready to quarantine or reject mail:

_dmarc.yourdomain.com TXT "v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com"

p=none is a monitoring policy. It does not ask receivers to block mail. It does create a DMARC policy and lets you collect reports if you publish a valid reporting address.

Check it with the free DMARC checker. If DMARC still fails, the problem is usually alignment, not the existence of the record. For the standard itself, use RFC 7489.

How do you prove alignment?

Alignment means the domain the recipient sees in the From address matches, or is a relaxed subdomain match for, the domain authenticated by SPF or DKIM.

This matters because a message can technically pass SPF for one domain while showing a different From domain. DMARC connects the visible identity to the authenticated identity.

Use this test:

1. Send a message to an Outlook.com or Hotmail test recipient.
2. Open the full headers.
3. Find From, Return-Path, DKIM-Signature and Authentication-Results.
4. Confirm spf=pass, dkim=pass and dmarc=pass.
5. Confirm the passing SPF or DKIM domain aligns with the From domain.

If you send through an email service provider, the return-path may use a provider domain until you configure a custom bounce or return-path domain. DKIM alignment is often the cleaner route because the DKIM signature can use your domain.

If you send through a cold email platform, check whether each connected mailbox signs with the correct domain. If you send through SMTP relay, check whether the relay signs your mail or expects your mailbox provider to sign it.

A common failure looks like this: your From address is you@company.com, SPF passes for mailer.vendor.example, and DKIM is missing. DMARC fails because nothing aligned with company.com passed.

How do you reduce complaints?

Once authentication passes, look at recipient behaviour. Microsoft recommends consent, list hygiene and a working unsubscribe process. The sender-rules facts here do not include a numeric Outlook.com complaint threshold, so do not invent one for your dashboard.

Use operational signals instead:

• Negative replies from Outlook.com or Hotmail recipients.
• Unsubscribes concentrated in one list source.
• Bounces from old or scraped addresses.
• Low replies from a segment that still receives high volume.
• More Junk placement after adding links, tracking or attachments.

Consent matters because unwanted mail creates reputation damage. A technically valid message can still be mail that recipients do not want.

Clean the list before you blame Microsoft. Remove role accounts if they do not fit your use case. Stop mailing addresses that bounced. Suppress unsubscribes permanently. Avoid purchased or rented lists. Keep prospecting sources separated, so one weak source does not poison the whole campaign.

Make unsubscribing easy. Microsoft recommends working unsubscribe handling. Your footer should not hide the opt-out path. If a person asks to stop, suppress them before the next send.

If you run cold outreach, keep sending per mailbox conservative. Our published practice is to keep real outreach around 30–50 emails per day per mailbox, then add mailboxes rather than forcing one mailbox to carry the whole campaign. For a deeper limit plan, use how many cold emails per day is safe.

Volume changes are reputation events. A domain that sent 20 human emails yesterday and 2,000 automated emails today looks different, even when DNS is correct.

Track three levels of volume:

• Mailbox volume: how much one inbox sends.
• Domain volume: how much all mailboxes on the domain send.
• Recipient-provider volume: how much goes to Outlook.com and Hotmail.

A campaign can look safe globally while overloading one recipient provider. If half your list is Microsoft consumer addresses, your Outlook.com pattern may spike before Gmail or Yahoo shows the same problem.

Ramp by domain and provider, not only by total campaign size. Keep a daily count of sends to Outlook.com, Hotmail, Live and MSN addresses. If Junk placement increases, reduce that slice first.

If you are warming a new domain, use a 2–3 week ramp before serious campaigns. If the domain already has normal business mail, a 7-day warm-up can be enough to create a recent positive pattern. The new-domain warm-up guide gives a slower plan.

When does warm-up help?

Warm-up helps when the mailbox or domain needs a recent pattern of normal sending and receiving. It is useful after a long idle period, before a new outbound campaign, or when a new domain has correct DNS but little reputation.

Warm-up is not the fix when Microsoft rejects mail with 550 5.7.515. That points first to the high-volume authentication requirements. Repair SPF, DKIM, DMARC and alignment before you spend time on reputation.

Warm-up also will not fix non-consensual lists, high bounce rates, misleading copy, broken unsubscribe handling or a sudden volume spike. Those are campaign problems.

BobWork Email Warm-up can help with the reputation part after DNS is correct. It is free for up to 10 mailboxes, starts at 3 emails per day, adds 2 per day, and caps at 30 per day by default. The cap is editable per mailbox up to 100. Weekends run at 30%, and sends are spread between 09:00 and 18:00 in the mailbox’s own time zone.

The free pool does this step automatically through a shared warm-up network, or you can switch to a private pool per account if you prefer. The engine uses plain text office-style mail, replies to about 40% of received warm-up mail, and ends threads after 3 messages. It only touches mail carrying its own hidden header. Real mail is never read, moved or answered.

Be careful with Outlook expectations. BobWork does not support Outlook or Microsoft 365 mailboxes yet because Microsoft requires OAuth. You can still warm supported sending mailboxes before you contact Outlook.com and Hotmail recipients, but the warm-up spam-rate metric is not an Outlook-only inbox placement test.

For more on what warm-up can and cannot prove, read does email warm-up work and manual versus automated warm-up.

What should you do now?

Work in this order. The fastest fixes are first, and the slower reputation changes come after Microsoft can authenticate you.

If your domain appears on common blocklists, investigate it, but do not use a blacklist check as a substitute for Outlook.com headers. You can start with the email blacklist checker, then confirm the actual delivery result in Microsoft mailboxes.

If you are unsure how fast to ramp, generate a plan with the warm-up schedule generator. Keep real campaigns below the warm-up pace until replies and complaints look stable.

Do not declare victory after one Inbox placement. Confirm across several sends and at least a few Outlook.com or Hotmail recipients who expected the message.

Use four proof points:

1. Headers show spf=pass, dkim=pass and dmarc=pass.
2. Bounces no longer show 550 5.7.515.
3. Microsoft consumer recipients stop seeing the same message type in Junk.
4. Campaign behaviour improves without increasing volume.

Ask real recipients to check Junk only for test purposes. Do not ask them to mark unwanted mail as wanted.

For dedicated IP senders, Microsoft SNDS can provide extra IP-level signals where available. Shared SMTP platforms may not expose the same view, so rely on headers, bounces and your own campaign suppression data.

A clean final state looks like this: SPF passes, DKIM passes, DMARC passes with alignment, unsubscribes work, weak list sources are suppressed, and volume grows gradually. Warm-up then supports reputation. It does not replace those controls.

If you want the warm-up part handled while you repair DNS and volume, connect a supported mailbox at BobWork Email Warm-up. It is free with no credit card for up to 10 mailboxes, and you can keep checking SPF, DKIM and DMARC with the free tools while you work through the Outlook.com and Hotmail fixes.

Frequently asked questions