Why Are My Emails Going to Spam in Outlook? (And How to Fix It)

"Outlook" is three different filters, and the fix depends on which one moved your email to Junk. There is Outlook.com, Microsoft's consumer mail service, which also carries hotmail.com, live.com and msn.com addresses. There is Microsoft 365, the business mailboxes companies pay for, where an admin at the recipient's company sets the spam policy. And there is the Outlook app on somebody's computer, which can run a Junk filter of its own on top of whatever the server decided. The sender rules Microsoft announced in 2025 apply only to the first of these.

So before I change a single DNS record, I look at the recipient's address. A hotmail.com or outlook.com address means the consumer rules below. An address at a company that runs its mail on Microsoft means a tenant policy, written by that company's IT team.

01Outlook.com and the May 2025 rules

In April 2025 Microsoft announced requirements for domains sending more than 5,000 emails a day to its consumer service, and the Postmaster policies page gives May 5, 2025 as the date they took effect. Above that volume:

• SPF must pass for the sending domain.
• DKIM must pass.
• DMARC must be published at "at least p=none" and align with SPF or DKIM, "preferably both". The policies page adds that p=reject is recommended.

The support article for the bounce words it a little differently. It counts 5,000 or more messages to Microsoft consumer services that all use the same domain in the From address, it says both SPF and DKIM checks must pass, and once a domain reaches that point Microsoft expects "all messages from senders in the domain" to meet the rules, not just the newsletter that pushed it over. Its DMARC example is about as small as a record gets:

Hostname:   _dmarc
TXT value:  v=DMARC1; p=none

I'd add a reporting address to it, rua=mailto:dmarc@example.com or wherever you actually read mail. Outlook.com does send aggregate reports (Microsoft's FAQ says it sends RUA and has no plans to send RUF), and the DMARC checker will show whether the address you list is able to accept them.

Google drew the same 5,000-a-day line for Gmail in February 2024 and began ramping up enforcement, rejections included, in November 2025. Yahoo enforces a similar list without naming any threshold.

How the rule is enforced changed while the announcement was still fresh. The original post said non-compliant mail would go to Junk first and might be rejected later. An update dated April 29 says Microsoft decided to reject instead, and yet the same post still contains the older Junk-first paragraph further down. The careful reading today is that since May 5, 2025 non-compliant mail goes to Junk, and Outlook.com now also rejects it with this:

I haven't found a published date for the switch to rejection. The support article simply describes it in the present tense.

02What the bounce code is telling you

A bounce from Outlook.com is more useful than a message sitting quietly in Junk, because it names a reason. Microsoft's troubleshooting page has a table of the codes, and these are the ones that come up for ordinary senders:

A plain 550 5.7.1 without Microsoft's own codes is another kind of refusal, and there's a separate page on reading that one.

03Third-party senders and the SPF requirement

Many domains send through several services at once: a newsletter platform, a CRM, a help desk, billing. Each of them sends with your domain in the From line, and each has to be covered by your records. Asked whether the rules still apply when a provider sends for you, Microsoft's FAQ answers "Yes. Even if you outsource sending, authentication is tied to your domain." The support article spells out what to verify: that DKIM signs with your domain, and that your SPF record "includes the IP address or include values required by the service".

Here is where requiring both SPF and DKIM gets confusing. Plenty of platforms put the bounce address on their own domain, and that Return-Path is what SPF actually checks. SPF then passes for the platform, which satisfies the "must pass" part, and DMARC alignment has to come from DKIM signing with your domain. If the platform signs with its own domain instead, you get two passes and no alignment, and the DMARC fail that follows is exactly what 5.7.515 is about. The support article also asks you to check whether the Return-Path domain aligns with the From domain.two passes, zero alignment: the whole 5.7.515 story

Each service you add to SPF also costs DNS lookups. Microsoft's FAQ puts it this way: "If you exceed 10 DNS lookups, your SPF check might fail." The SPF checker counts them for you, and if you're over, here's how to get back under ten. The DKIM checker does the matching job for each platform's selector.

04Microsoft 365 is filtered by someone else's policy

A Microsoft 365 organisation has anti-spam policies its admins configure, and out of the box spam, high-confidence spam and bulk mail go to the Junk Email folder, while phishing goes to quarantine and high-confidence phishing is always quarantined. Quarantine is the outcome that hurts most from the sender's side, since the recipient doesn't find the message in any folder unless they go looking. The default policy keeps it there for 15 days, the Standard and Strict presets for 30.

Bulk mail gets its own measure, the bulk complaint level. A BCL of 1 to 3 means a bulk sender with few complaints, 8 or 9 a sender with many. The default policy sends bulk mail to Junk from BCL 7, the Standard preset from 6, Strict from 5. And since July 2026 there's a newer layer: bulk mail that is promotional in nature gets a Promotions tag whatever its BCL, and where an admin has switched on "Bulk moves enabled" it lands in a Promotions folder. That isn't spam, and it isn't the Inbox either. The feature is still rolling out.

The two Microsoft systems aren't sealed off from each other. Microsoft says Microsoft 365 spam filtering "learns from known spam and phishing threats and user feedback from our consumer platform, Outlook.com", so what hotmail.com readers report feeds into the filter that business inboxes use.

Admins can also put a sender on an allowed list, which bypasses most protection except malware and high-confidence phishing. If a partner company keeps receiving your invoices in Junk, their IT team is who can see the actual verdict.

05Reading the verdict in the headers

When you can get hold of the message as a Microsoft 365 mailbox received it, the anti-spam headers state the decision outright. X-Forefront-Antispam-Report carries a few fields worth knowing:

• SFV:SPM means spam filtering marked it as spam, SFV:NSPM as not spam, and SFV:SFE that filtering was skipped because the sender is on the user's Safe Senders list.
• CAT names the category of policy applied: SPM, HSPM (high-confidence spam), BULK, PHSH, SPOOF.
• SCL is a number, -1 or 0 to 9. Older guides treat it as the verdict. Microsoft's current SCL page says the value "doesn't determine whether spam filtering identifies a message as Spam or High confidence spam", so read CAT first.

The headers also carry compauth, Microsoft's composite verdict built from SPF, DKIM, DMARC and other parts of the message. A reason code of 001 means implicit authentication failed, typically because the sending domain had no authentication records published or only a weak policy.

06SNDS and JMRP, now on the Postmaster site

Smart Network Data Services, or SNDS, now lives on the new Postmaster site and replaces the old one at sendersupport.olc.protection.outlook.com. It reports per IP address, so you have to prove you own an IP range before it shows you anything, and the data covers volume, complaint rates and a colour for how much of your traffic the filter judged as spam: green under 10%, yellow between 10% and 90%, red above 90%. Access now expires 10 months after approval or migration and has to be renewed.

For a small sender SNDS may show nothing at all, since it can skip an IP that sent fewer than 100 messages on a given day. And if you send through a platform's shared IPs, you don't own those addresses and can't register them.

JMRP, the Junk Mail Reporting Program, is the feedback loop. Enrol through SNDS and Microsoft sends you selected headers of messages that Outlook.com users marked as junk, typically starting within 72 hours. Add new IPs to it as you add them.

Microsoft calls the junk complaint rate "one of the principal factors" in a sender's reputation, and the SNDS FAQ calls a complaint rate under 0.3% "a good bar to shoot for". New IPs take time; Microsoft says a new one can expect to be fully ramped "within a couple of weeks or sooner depending on volume, list accuracy". And no, there isn't a list to buy your way onto. The troubleshooting page asks itself whether Outlook.com runs an allow list a sender can get on and answers "No."

07What the person on the other end can change

Some of this sits with the recipient, and it's fair to ask a reader to help. In Outlook.com (Settings, then Mail, then Junk email) a user can mark a message as Not junk or add the sender to Safe senders and domains. That list holds up to 10,000 entries, and Microsoft notes that senders on it typically get their links and images enabled by default. A strict user can also switch on "exclusive" mode, which accepts mail only from Contacts and Safe Senders.

The Junk button works the other way. Microsoft uses those reports to decide whether future mail from the same sender should be blocked. Separately, its recommendations for senders ask for an unsubscribe link that is "clearly visible". Microsoft's text doesn't mention the one-click List-Unsubscribe headers that Gmail and Yahoo require, but since the same campaign goes to all three, I'd add them everywhere (the two headers).

The desktop app has its own Junk Email Filter. By default it's set to "No Automatic Filtering", with Low, High and "Safe Lists Only" above that, the last of which treats everything from outside the user's safe lists as junk. Its safe and blocked lists are synced to the server and used there too.

Then there is Focused Inbox, which splits the inbox into Focused and Other and, in Microsoft's words, "filters out noisy sources like automatically generated or bulk email". Other is a tab of the inbox, and my reading is that a newsletter sitting there has already passed spam filtering.

08Testing before the real send

Microsoft's own troubleshooting page says it "strongly recommends that you conduct email testing prior to sending live communications". That's the step Email Spam Tester covers. You send the actual message to an address the page generates, from the server or platform you'd really use, and the report lists 42 checks: SPF, DKIM and DMARC with alignment, reverse DNS, the sending IP on 21 blocklists (why those matter), the unsubscribe headers and the content. Failed checks come with a fix plan and DNS records to copy, and the points each fix is worth come from the scoring table.

Add the inbox placement test and the same message also goes to inboxes at Gmail, Outlook, Yahoo and other providers, and the report shows where it landed at each one, read from the mailbox itself, Focused or Other included where the provider sorts that way. It's free, with no signup. The documentation explains every check and what it costs in points.

If a support ticket is your next step, note that Microsoft's deliverability form only takes cases about @outlook.com, @hotmail.com, @live.com and @msn.com addresses, and the policies page warns that if you're not compliant "it may not be possible for our support team to assist you."