New Microsoft e-mail regulations: How to secure your business communication
Strict email rules now also at Microsoft: From today, May 5, 2025, new, mandatory standards will come into force for all email senders who want to reach users on Outlook.com, Hotmail and Live accounts. This change affects more than 500 million user accounts worldwide and follows a clear trend in the industry. Companies with high mail volumes are particularly affected: anyone who sends over 5,000 emails a day to Microsoft addresses and has not implemented the new security protocols must expect their messages to be automatically placed in the spam folder. We explain which three security standards are now mandatory and show you how you can implement them quickly and effectively in your email infrastructure.
Why Microsoft is tightening security standards
The cyber security landscape is constantly evolving. Phishing attacks and email fraud are on the rise, with cybercriminals developing ever more sophisticated methods to steal company and customer data. They are increasingly relying on deceptively genuine forgeries of known email senders. Microsoft is responding with stricter verification procedures in order to:
Improve the security of over 500 million Outlook users,
reduce phishing attacks,
Optimize email deliverability for legitimate senders and
Strengthen trust in digital communication.
The three technical proofs that Microsoft now requires
From May 2025, Microsoft will require the implementation of three key authentication methods to ensure the delivery of emails to Microsoft accounts. These technical standards work together to confirm the authenticity of emails and prevent forgery:
SPF (Sender Policy Framework) SPF works like an authorization list for your email servers. It verifies that messages actually originate from authorized servers and prevents fraudsters from misusing your domain. This is how it works: In your DNS settings, you store an SPF entry that defines exactly which servers are authorized to send e-mails on your behalf. Our tip: Start with a precise SPF entry with your IP address. Include external service providers such as newsletter tools or CRM systems.
DKIM (DomainKeys Identified Mail) DKIM provides every outgoing email with a unique digital signature, comparable to a fingerprint. This confirms the origin of the message and guarantees that the content has not been manipulated during transmission. This is how it works: You generate a key pair and store the public key in your DNS settings. Every outgoing email is signed with the second, private key. Our tip: Rely on strong encryption with a key length of at least 2048 bits for optimum protection. Plan to regularly rotate your DKIM keys every 6-12 months to ensure long-term security.
DMARC (Domain-based Message Authentication, Reporting & Conformance) DMARC defines the handling of emails that do not pass SPF or DKIM. This defines how non-authenticated emails should be handled - whether they are delivered, moved to the spam folder or completely rejected. This is how it works: You create a DMARC record in your DNS settings that specifies how to handle unauthenticated emails. Our tip: Start with a "monitoring" DMARC policy (p=none) to initially collect reports without affecting email delivery. It is important that you switch to stricter policies (p=quarantine) and finally (p=reject) as soon as possible after the evaluation. If the DMARC policy entry remains set to "none", criminals can use the domain name to send emails.
Timetable and consequences of the Microsoft changes
The introduction takes place in two phases:
As of May 5, 2025: Emails from non-compliant senders with more than 5,000 emails per day end up in the spam folder
Later in 2025: Further tightening, possibly no delivery of non-compliant emails at all
The consequences for companies without correct authentication:
Reduced e-mail deliverability
Loss of important business communication
Impairment of brand reputation
Loss of sales due to missed customer communication
What are the consequences of non-compliance?
The consequences for companies that do not implement the new security standards in time are far-reaching:
Dramatically falling delivery rates: Your business-critical communication can disappear in the spam folder or be completely blocked.
Interrupted communication chains: Important messages such as order confirmations, invoices or appointments can no longer reach your customers reliably.
Damaged brand perception: If your emails are classified as potentially dangerous, trust in your brand will suffer.
Measurable loss of business: Missed customer communication leads directly to lost business opportunities and lost sales.
Implementing Microsoft's authentication requirements is therefore not just a technical necessity, but a business-critical step towards future-proofing your digital communication.
How to prepare your company
We recommend the following steps to secure your e-mail communication:
Carry out an inventory: Check your email infrastructure and identify all sender domains. Take subdomains and automated email systems into account.
Implement authentication: Set up SPF, DKIM and DMARC for all domains. Ensure that external service providers for email marketing are also compliant.
Testing and monitoring: Check your authentication settings regularly.
Avoid common pitfalls
The following problems often occur when implementing e-mail authentication:
SPF records with too many DNS lookups: SPF is limited to 10 DNS lookups. If you exceed this limit, your SPF entry will become invalid.
Lack of coordination with external service providers: Include all service providers who send emails on your behalf.
DMARC implementation too fast: Switching to strict DMARC policies too quickly can block legitimate emails.
Neglected reports: DMARC reports contain valuable information. Evaluate them regularly to identify problems at an early stage.
Check email security: How LocateRisk helps
SPF, DKIM and DMARC are used for IT security and should be an integral part of your security concept. The LocateRisk analysis automatically checks in the "DNS" category whether the required SPF and DMARC entries are available for your domains and whether your mail dispatch is well protected.
Particularly importantOur tool not only evaluates the mere existence of DNS entries, but also analyzes their configuration. We check whether your DMARC policy is set to the security-relevant settings "quarantine" or "reject" - this is the only way to guarantee real protection.
The nine test categories of LocateRIsk.
If you are not sure whether your organization has correctly implemented the necessary email security standards, you should have this checked immediately. LocateRisk gives you a quick and reliable overview of potential vulnerabilities in your email configuration before they lead to delivery problems or security risks.
Conclusion: Email security as a strategic advantage
The new Microsoft requirements offer the opportunity to comprehensively improve your cyber security. From May 2025, anyone who sends a lot of emails to Microsoft addresses will have to provide three technical proofs - SPF, DKIM and DMARC - to ensure that the messages actually arrive and do not end up in spam. These standards help to minimize potential threats and improve preventive protection. This makes email safer for everyone. Recipients receive fewer fraudulent messages, while legitimate senders benefit from better delivery rates and increased trust. Companies that act now and adapt their email infrastructure will secure their business communication and, not least, their economic success.
Request your personal Live-Demo now
Identify and reduce your cyber risks through a comparable and understandable overview of your IT security. Let our experts advise you and find out how LocateRisk can help you solve your cyber risks.
Learn more, book a demo, or just have a quick chat? Alex is happy to help!
Your personal consultant AlexanderFeldmann Consulting
We use cookies to optimize our website and our service.
Functional
Always active
Technical storage or access is strictly necessary for the lawful purpose of enabling the use of a particular service expressly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a message over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that have not been requested by the subscriber or user.
Statistics
The technical storage or access, which is carried out exclusively for statistical purposes.Technical storage or access used solely for anonymous statistical purposes. Without a subpoena, the voluntary consent of your Internet service provider, or additional records from third parties, information stored or accessed for this purpose alone generally cannot be used to identify you.
Marketing
Technical storage or access is necessary to create user profiles, to send advertisements, or to track the user on a website or across multiple websites for similar marketing purposes.
English 
Deutsch 
Français