If you're running cold email campaigns and using Microsoft 365 (Outlook), you're either getting decent inbox placement or you're watching your emails disappear into spam. Most people don't realize that Microsoft has become significantly stricter about authentication and sender reputation than Gmail - and most cold email setups completely ignore this.

The problem: Microsoft 365 uses aggressive filtering, and if your infrastructure isn't set up correctly, you'll burn through your warm-up process, tank your sender reputation, and waste weeks of time before realizing the issue. I've seen campaigns that should be hitting 40% open rates stuck at 8% because the person running them never configured SPF, DKIM, and DMARC properly for their sending domain.

Here's what actually works when you're sending cold emails through Microsoft 365.

Microsoft 365 Authentication Requirements (Do This First)

Before you send a single cold email, you need to set up authentication records for your sending domain. Microsoft is strict about this - they won't explicitly block you if you skip it, but your emails will get filtered harder and your reputation will tank faster.

You need three things: SPF, DKIM, and DMARC records. Not optional. Not "nice to have." Required.

SPF (Sender Policy Framework)

SPF tells receiving servers which mail servers are authorized to send emails on behalf of your domain. For Microsoft 365, you need to add Microsoft's SPF string to your domain's DNS records.

The SPF record looks like this:

v=spf1 include:outlook.protecp.mail.microsoft.com ~all

Add this to your domain's TXT records in your DNS provider (GoDaddy, Namecheap, wherever you manage your domain). Wait 24-48 hours for DNS propagation. Check it with an SPF lookup tool to confirm it's live.

DKIM (DomainKeys Identified Mail)

DKIM adds a cryptographic signature to your emails, proving they actually came from your domain. Microsoft 365 automatically generates DKIM keys for you - you just need to enable them.

In Microsoft 365 admin center, go to Settings > Domains > DNS Records. You'll see two DKIM records (selector1 and selector2). Copy both of those CNAME records and add them to your DNS records. This takes 24-48 hours to propagate.

If you don't do this, Microsoft marks your emails as unsigned, which is a massive red flag to spam filters.

DMARC (Domain-based Message Authentication, Reporting & Conformance)

DMARC is the policy that tells the world what to do if SPF or DKIM fails. You want a DMARC record that enforces strict checking.

Your DMARC record should be:

v=DMARC1; p=quarantine; rua=mailto:[email protected]; ruf=mailto:[email protected]

Add this as a TXT record on _dmarc.yourdomain.com. The quarantine policy means if an email fails authentication, it gets sent to spam (not rejected entirely - important distinction). Start here, not with p=reject, because you need to verify your setup is working before going strict.

Warm-Up Strategy for Microsoft 365

Microsoft 365 monitoring is more sophisticated than Gmail. They watch how many people reply, how many people mark you as spam, bounce rates, and how quickly you ramp up sending volume.

If you go from 0 to 500 emails a day, you'll get filtered. If you go from 0 to 50 emails a day over 2 weeks, you'll be fine.

Here's the ramp schedule that actually works:

These emails should go to real accounts that will actually respond (friends, colleagues, warm contacts). You're building a sender history that says "this account sends emails, and people engage with them." Microsoft watches engagement metrics aggressively.

Don't skip warm-up. I know it's tempting. You'll regret it.

Microsoft 365 Sending Limits (Real Numbers)

Microsoft 365 has built-in throttling limits that are different depending on your subscription level and how long your account has been active.

For a standard commercial account, you can send approximately 10,000 emails per day once your reputation is established. But in the first 30 days, you're capped much lower - usually 300-500 emails per day if you try to push it.

More important than the raw limit: Microsoft watches your bounce rate. If more than 5% of your emails bounce, your account gets flagged and sending limits tighten. If it goes above 10%, your account could get throttled for days.

This is why list cleaning is critical - invalid email addresses will destroy your Microsoft 365 account faster than almost anything else. Verify your list before you send. Use a tool like ZeroBounce or NeverBounce. Remove anything with a bounce rate above 2%.

Subject Lines and Copy That Doesn't Trigger Filters

Microsoft 365 filters on content, not just authentication. Certain words, patterns, and structures trigger higher spam scoring.

Avoid these patterns:

Here's what actually works for cold email subject lines with Microsoft 365:

Quick question about [company name]

Or:

One thing we noticed about your [industry] setup

These are lowercase, conversational, and they reference something specific. They score low on spam filters because they sound like one person emailing another person, not a marketing blast.

For the email body, keep it short - under 100 words if possible. One link. No images. Plain text works better than HTML with Microsoft 365 filtering. Sound like a human. Because cold email that works doesn't sound like marketing.

Monitoring Microsoft 365 Deliverability

Set up monitoring in Microsoft 365 admin center. Go to Mail flow > Message trace. Run this report weekly and check for:

If bounce rate creeps above 3%, pause your campaign immediately and clean your list. If delivery rate drops below 90%, check your authentication records and sender reputation. Use a tool like MXToolbox to run diagnostics on your domain.

Track these metrics over 30 days. If you're consistent and following the warm-up schedule, your reputation will stabilize and you'll get consistent inbox placement. If you're not seeing that by day 30, your infrastructure setup has an issue - usually missing DKIM or DMARC records.

When to Use Multiple Sending Domains

If you're planning to scale beyond 1,500-2,000 cold emails per month from a single domain, you should consider multiple sending domains. Not because you need to - your single domain can handle more - but because if one domain gets reputation issues, you don't want all your campaigns paused.

Set up a second domain with the same authentication records. Rotate between them. This takes an extra 2-3 hours of setup but saves you from preventable disasters.

The Gap Between Knowing This and Running It

Setting up Microsoft 365 cold email infrastructure is straightforward once you know what to do. But executing it consistently - managing authentication records, running list cleaning, monitoring metrics, troubleshooting deliverability issues when they pop up - takes discipline and time.

More importantly, infrastructure is only half the problem. You also need the right copy and targeting strategy that actually generates replies, and a system for handling responses without losing deals. Most people set up perfect infrastructure and then send generic garbage that gets ignored.

If you've got the infrastructure figured out but managing list quality, copy testing, and campaign execution is eating your time, that's the problem most service businesses and agencies run into - and it's the exact gap we solve at BEC Growth. We handle the full stack so you're not juggling infrastructure, leads, copy, and replies across five different tools.

Related Guides