How to fix Outlook and Hotmail deliverability

If your mail lands in Gmail inboxes but in Outlook's Junk folder, the usual cause is not your content. Microsoft's consumer stack — outlook.com, hotmail.com, live.com, msn.com — weights the reputation of the sending IP far more heavily than Gmail does, and it gives you almost no self-service visibility. Fixing it means registering for Microsoft's own feedback channels, then changing how you send rather than what you send.

Register for SNDS and JMRP before you need them

Microsoft publishes no blocklist you can look up. There is no equivalent of a Spamhaus query that returns "your IP is listed". If you are blocked, you learn it from an SMTP rejection or from silence. The two tools that give you any data at all are:

• SNDS (Smart Network Data Services) — per-IP volume, complaint rate, spam-trap hits and a colour-coded reputation, for IPs you can prove you control.
• JMRP (Junk Mail Reporting Program) — a feedback loop that forwards you a copy of every message an Outlook user marks as junk, so you can suppress that address.

Both are free and both take days to populate. Register the moment you provision an IP, not when deliverability breaks.

If you send through a shared pool at a provider like SendGrid, Amazon SES, Mailgun or Postmark, you cannot register those IPs — your provider owns them. In that case your lever is choosing a provider that keeps its pools clean and watching your own placement independently.

Decode the rejection before you change anything

Microsoft's SMTP responses are unusually specific. Read the enhanced status code and act on that one, not on general advice:

4.x.x codes are temporary. Treating them as hard bounces and suppressing the recipient is a common and expensive mistake.

The authentication floor is non-negotiable now

Microsoft tightened its requirements for high-volume senders to consumer Outlook domains during 2025: SPF, DKIM and a published DMARC policy, with the visible From domain aligning to at least one of SPF or DKIM. A p=none DMARC record satisfies the requirement, so there is no reason to skip it.

Check alignment, not just passes. A message can show spf=pass on your ESP's bounce domain and still fail DMARC because the From header says something else. The headers tell you plainly:

Authentication-Results: spf=pass (sender IP is 1.2.3.4)
 smtp.mailfrom=bounces.yourdomain.com; dkim=pass header.d=yourdomain.com;
 dmarc=pass action=none header.from=yourdomain.com

Fix the volume shape, not the volume

SmartScreen-era filtering reacts to pattern changes more than to absolute numbers. A domain that sent 40 messages a day for a month and suddenly sends 900 looks compromised, which is exactly what the filter is designed to catch. What works:

1. Ramp in steps that compound slowly. Increasing by roughly a quarter every few days is unremarkable; doubling daily is not.
2. Spread sends across the working day rather than firing a batch at 09:00. Bursts from a thin-reputation IP are the single most reliable way to earn a 451.
3. Keep the per-mailbox daily count modest and add mailboxes instead of pushing one harder. Ten mailboxes at 30 a day is a different risk profile from one at 300.
4. Never pause for a week and resume at full volume. Reputation decays; a cold restart reads as a new sender with an old IP.

Complaints matter more than bounces here

Microsoft's filtering is heavily complaint-weighted. One junk click from an Outlook user carries more signal than several bounces. That makes JMRP data the most actionable feed you have: suppress every address it reports, immediately and permanently, and look at what those recipients had in common.

List hygiene matters for the same reason. Microsoft runs spam traps, and SNDS reports trap hits as a separate column. Trap hits mean your acquisition is dirty — scraped addresses, a purchased list, or a form with no verification — and no amount of warm-up will outrun it.

What not to do

• Do not buy a dedicated IP to escape a bad shared pool while your volume is low. A dedicated IP with thin volume has no reputation at all, and Microsoft treats unknown as suspicious. Dedicated IPs pay off at sustained volume, not before.
• Do not submit the same IP to the delist portal repeatedly. The portal accepts a request and returns a mitigation result; re-submitting without changing your sending behaviour gets you nothing and the eventual reply will say so.
• Do not chase "spam words". Content filtering exists, but an Outlook Junk problem on a domain that Gmail accepts is almost always reputation or authentication.
• Do not test with your own Outlook account only. Mail from a domain you have corresponded with is scored differently than mail to a stranger. Your personal inbox is the least representative test available.
• Do not trust an open rate as a placement measure. Microsoft's image proxying and prefetching make open data unreliable as a delivery signal.

How MailPilot helps

MailPilot warms Outlook and Microsoft 365 mailboxes over OAuth, or any SMTP sender, by generating real conversations at a ramp that does not spike. Its seed-inbox network measures where your mail actually lands on Microsoft specifically — separately from Gmail and Yahoo — and it checks SPF, DKIM and DMARC alignment on the domain you send from, so the 5.7.515 class of rejection is caught before a campaign hits it.