Look out: Outlook's new email requirements and what they mean for Braze senders

Google and Yahoo’s updated sender requirements shook up the email marketing landscape when they were announced back in 2024, and now Microsoft is following suit. Starting May 5, 2025, Microsoft’s Outlook.com (including domains like hotmail.com, live.com, and outlook.com) will begin enforcing stricter authentication requirements for high-volume senders—meaning anyone sending more than 5,000 emails per day.

This announcement is one more step in the broader email ecosystem’s push toward stronger authentication, better security, and less spam in consumer inboxes. For some brands, it will mean additional work to comply, but it’ll also support a clearer line of communication from you to your customers. That said, if you’re using an ESP or customer engagement platform, now’s the perfect time to double-check your setup and evaluate your email sending practices.

Outlook email updates: What’s changing?

The new authentication requirements that Outlook is introducing will apply to high-volume senders. If your domain doesn’t meet these requirements—or if something's misconfigured—your emails could start landing in the Junk folder. And later this year, Outlook may begin to reject non-compliant messages altogether.

Here’s what Outlook will be looking for:

• SPF (Sender Policy Framework): This validates which servers are authorized to send on your behalf.
• DKIM (DomainKeys Identified Mail): This uses a digital signature to verify that your message hasn’t been tampered with.
• DMARC (Domain-based Message Authentication, Reporting, and Conformance): This tells mailbox providers what to do if a message fails SPF or DKIM. Requires at least a p=none policy and alignment with either SPF or DKIM (ideally both).

Good news for Braze customers

• SPF and DKIM? Braze handles those for you—no action needed.
• DMARC? That’s your responsibility. You’ll need to configure this in your domain’s Domain Name Service (DNS).

Need help getting started with DMARC? Reach out to Braze Support, and we’ll help point you in the right direction.

Outlook email updates: What else should you know?

In addition to the updates mentioned above, Microsoft is also recommending senders adopt some tried-and-true email best practices. These aren’t technically required yet, but their inclusion is a strong signal that the industry is heading this way. Senders who don't eventually comply are likely to be left behind!

Sender hygiene tips to keep in mind

• Use a valid “From” or “Reply-To” address that reflects your real domain and can receive messages. No more noreply@ addresses—email is a two-way street. If you can send emails, you should also be able to receive them.
• Include a clear, working unsubscribe link in every marketing or bulk message.If recipients can’t easily opt out, they’ll hit “Report Spam”—hurting your sender reputation. Not only is this a recommendation, it’s actually a legal requirement in many jurisdictions (including the US).
• Perform list hygiene regularly to remove invalid or inactive addresses.Braze automatically suppresses hard bounces, but you’ll need to manage soft bounces using our soft bounce filter or by targeting recipients based on positive engagement history.
• Be transparent.Use accurate subject lines and make sure everyone on your list voluntarily opted in to your mailing list, ideally through a double opt-in.
• Monitor your Microsoft reputation data. The Braze Deliverability Center provides you insights directly from Microsoft’s Outlook.com domains on how you’re performing in these mailboxes as a sender. Proactively monitor your spam filtering, spam trap hits, and complaint rate to gauge your sender reputation.

Outlook email updates: Enforcement timeline

As we get closer to the enforcement deadline, there’s more that email marketers may need to do. Here's what to expect:

• Now: Start preparing ASAP. Review your SPF, DKIM, and DMARC records and make sure everything is aligned. Not sure how? Send yourself a test email and inspect the headers. If SPF, DKIM, or DMARC don’t show “pass,” something needs attention. Braze customers should reach out to their CSM or open a Support ticket for assistance.
• May 5, 2025: Outlook begins routing messages from non-compliant high-volume senders to the Junk folder.
• Later in 2025 (exact date TBD): Microsoft plans to start rejecting non-compliant messages entirely.

Even if you currently send fewer than 5,000 emails per day, this is a great time to implement these best practices. Solid authentication and adherence to email best practices protects your customers, and your brand.

TL;DR for Braze senders

Here’s a quick checklist to stay compliant and maintain inbox trust:

• SPF & DKIM? Already covered by Braze.
• DMARC? You need to set it up (p=none at a minimum) in your domain’s DNS.
• “From” and “Reply-To” addresses must be valid and monitored (ditch the noreply@).
• Include working unsubscribe links. Any message without one is more vulnerable to spam complaints.
• Manage your list regularly. Either target sends based on positive engagement like opens or clicks, or suppress non-engagers.

Need a hand? Contact Braze Support and we can point you in the right direction.

Final thoughts from the Braze Email Deliverability Services team

Here at Braze, we’re all about secure, trustworthy email—and these changes from Outlook are a step in the right direction. If you’re already sending through Braze, you’re likely in great shape. For additional deliverability support, consider obtaining Deliverability Services.

Let’s work together to keep inboxes clean, sending reputations strong, and email ROI sky-high.