Email authentication standards are used to protect inboxes and preserve trust in the digital ecosystem. They ensure your domain’s emails are delivered, and by the same token protect the domain against spoofing and phishing attacks – emails sent by unauthorised parties on behalf of a domain they do not own.

In February 2024 Google and Yahoo announced that they would be enforcing DMARC policies for large senders of email, ie those sending over 5k emails a day. This move aimed  to enhance email security and reduce spam by ensuring email authentication via DKIM and SPF; in practice to maintain a good sender reputation and improve deliverability.

Microsoft Enforces New Authentication Requirements From May 2025

In 2024 Microsoft was notably absent in providing a stance supporting enhanced email authentication, but in a blog posted earlier this month, the company announced stronger email authentication requirements for bulk senders dispatching emails into: @outlook.com, @live.com and @hotmail.com.

As of 5th of May 2025, any domains that fail SPF, DKIM and DMARC will automatically land in the junk mail folder. At a date yet to be confirmed, Microsoft will then reject any failing emails.

So, how do these authentication tools work? And how do you proceed if you don’t meet the requirements?

Authentication tools 

SPF, DKIM and DMARC are three email authentication methods. Used together they let ISPs decide whether or not a sent email is legitimate. Domains that have not set up SPF, DKIM and DMARC may find that their emails are quarantined as spam or are not delivered. They are also in danger of having spammers impersonate them.

Non-compliance with the latest email authentication protocols could have a huge negative impact on your email deliverability rate.

• SPF – Sender Policy Framework – validates an email, ensuring it comes from an authorised mail server. When the email is sent, it is checked against a list of authorised IP addresses that are allowed to be sent from that domain. Any email with a forged address not coming from an authorised IP address will be denied by the mail server.
• DKIM – Domain Keys Identified Mail – gives the recipient of the email an easy way to validate the authentication through the use of encryption keys and digital signatures. Its main function is detecting and preventing spoofing and phishing. Unlike SPF, DKIM authentication appears within the email itself, helping to prevent a receiver from replying to illegitimate emails. Both SPF and DKIM work together and provide the best way to authenticate your messages and avoid fraudulent emails being sent under your domain.
• DMARC – Domain-based Message Authentication, Reporting and Conformance – adds another layer of authentication to your emails, working alongside DKIM and SPF. It tells mail servicers what to do when DKIM or SPF fail, whether that’s marking the emails as spam, delivering them anyway or simply blocking the emails completely.

A DMARC record can contain instructions to send reports to domain administrators about which emails are passing and failing these checks. These reports can also provide administrators with the information they need on how to adjust DMARC policies, e.g. what action to take if legitimate emails are mistakenly being marked as spam.

Get Prepared

With 1 months’ notice until the new Microsoft rules are enforced, we recommend you prepare now and audit your DNS records (SPF, DKIM, DMARC) to verify you meet all the requirements. Even if your domain sends less that 5k email per day, all senders benefit from these best practices as strong authentication protects your reputation.

You can read much more about Microsoft’s policy changes, next steps, additional email hygiene recommendations and FAQs in their recent blog.

If you need further clarification or advice on enhancing your domain reputation and improving your deliverability rate, we’d be very happy to assist you here at Comprendo.

Whether we set up and manage your business email, or provide you with the software to monitor your mail delivery reporting in-house, we’re here to provide you with the solutions you need.

Book your FREE 2-hour consultation with one of our knowledgeable technicians, or Call us on 0345 527 4394

And if you’d like any other IT assistance, from day to day IT support to 24/7/365 monitoring of your critical systems, we’re waiting for your call.

At Comprendo, we provide customer-focused IT services, solutions and support to businesses throughout North and West Yorkshire, Lancashire and beyond, including Leeds, Bradford, Harrogate, York, Preston and Manchester. Looking to outsource your IT or review your cyber security? We look forward to hearing from you.