How to Fix Microsoft 365 Cold Email Deliverability After Domain Setup
M365 setup for cold email has several non-obvious requirements that catch operators off guard. Here's the complete fix guide.
You set up Microsoft 365 for cold email outreach. DNS records are configured. You start sending and emails are going to Junk on Outlook and sometimes spam on other providers. The setup should be working but something is wrong.
Why M365 setup problems are different from GWS
Microsoft 365 setup for cold email has several pitfalls that differ from Google Workspace. The most common: DKIM setup in M365 is not as straightforward as in GWS. Microsoft requires you to publish two CNAME records for DKIM (selector1 and selector2) and then enable DKIM signing in the Microsoft 365 admin center. If you only published the DNS records but did not enable signing, your emails are not DKIM-signed — and the problem is completely invisible in your ESP.
The complete M365 authentication fix
SPF fix
Your SPF record must include include:spf.protection.outlook.com. If this is missing, add it. If you have the wrong include value from a previous provider, update it. Ensure you have only one SPF record. Verify with the SPF checker.
DKIM fix — the most commonly missed step
DKIM is not enabled by default in M365. You must enable it in Microsoft 365 Defender:
- Go to security.microsoft.com
- Email and Collaboration → Policies and Rules → Threat Policies → DKIM
- Select your domain → Enable
- Publish both CNAME records Microsoft provides to your DNS (selector1 and selector2)
Verify both selectors are published and active with the DKIM checker.
DMARC fix
Add: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. Start with none and monitor. Verify with the DMARC lookup.
M365-specific sending limits
M365 has lower safe sending limits for cold email than GWS. Maximum recommended is 10 sends per inbox per day for cold email. New tenants are particularly restricted. If you exceed these limits, Microsoft may throttle or block your sending. Use the sending limit planner with M365 selected to configure your ramp correctly.
Step-by-step diagnosis
Check if you're using M365 or a third-party tool's infrastructure
If you are also using a third-party outreach tool alongside Microsoft 365, determine which infrastructure is actually sending your cold emails. The outreach tool may bypass Microsoft's SMTP entirely, meaning your Microsoft DNS setup is not being used for those sends and the problem is elsewhere.
Test across providers
Send test emails to accounts across Gmail, Outlook.com, and Yahoo. Use the placement test for the full authentication result. Check each provider separately — if only Microsoft recipients see Junk placement, it is an Outlook-specific issue.
Repair or replace?
If the issues are configuration mistakes, they are straightforward to fix. Correct your DNS, enable DKIM signing in the admin center, and start warmup. Deliverability should improve within a few days to a week.
If you have been sending cold email from a misconfigured M365 setup for weeks and have accumulated reputation damage, recovery takes longer. Reduce volume, fix configuration, and allow 2–4 weeks of low-volume warmup to rebuild.
If you need M365 inboxes performing immediately for B2B campaigns, WarmInboxes can provide properly configured and prewarmed Microsoft 365 accounts ready for production.
Run the checks first
Before replacing anything, run a free inbox placement test. You might find the issue is DNS, not the domain — and save yourself a week of unnecessary work.