Email authentication for Outlook and Microsoft 365
Authenticate the service that sends your email. Delivering to an Outlook recipient does not mean you should configure Microsoft 365 as your sending provider.
When you send to Outlook
For domains sending more than 5,000 messages a day to consumer Outlook.com, Hotmail and Live addresses, Microsoft requires SPF and DKIM to pass and DMARC with at least p=none. The visible From domain must align with SPF or DKIM. These consumer sender requirements are distinct from Microsoft 365’s business-tenant policies. Use all three protections at any volume.
In Nitrosend, add the exact records shown under Settings → Domains. For BYO sending, those records come from your selected provider. Keep one SPF record per domain, include every legitimate sending service, and stay within SPF’s DNS lookup limit. Do not replace an existing SPF record with one that drops your other senders.
The technical sending subdomain and visible From domain can differ when properly verified and aligned. A subdomain helps separate configuration and mail streams, but does not guarantee independent reputation from the parent domain.
When you send through Microsoft 365
If Microsoft 365 actually transports your mail, follow its domain-authentication and mailbox-sending requirements. A mailbox authentication or sending-permission error is a configuration problem on that sending service; it does not explain mail that another provider already delivered to Microsoft.
Microsoft’s outbound guidance says Exchange Online is not a supported bulk-mail sending service. Use a campaign-capable provider for bulk marketing. Do not enable legacy SMTP authentication or weaken recipient filtering to address an unrelated Inbox-placement problem.
Authentication is one part of delivery
A valid signature does not guarantee Inbox placement. Microsoft also considers reputation, audience quality, content, links and recipient policies. A delivery event means the receiving server accepted the email; it may still reach Junk or quarantine.
Use a recognisable sender, a working From or Reply-To mailbox, and permission-based audiences. Marketing needs a visible working unsubscribe. Preserve opt-outs, hard-bounce protections and complaint suppressions. See Nitrosend’s Microsoft delivery guide for the complete checklist and how to investigate a rejection, Junk result or link warning.
FAQ
Do I need Microsoft’s SPF include to send to Outlook?
Only if Microsoft 365 is one of your sending services. Use the DNS records supplied by the provider that sends your mail. Receiving at Outlook does not require authorising Microsoft to send for your domain.
Why can authenticated email still reach Junk?
SPF, DKIM and DMARC establish authentication. Microsoft also evaluates sender reputation, content, links and recipient policies. Inspect the actual message’s delivery and threat details before changing DNS.