Troubleshooting cPanel / WHM DirectAdmin Microsoft 365 Email

Emails Going to Junk in Outlook and Hotmail: Sender-Side Fix

Why your mail lands in Outlook.com or Hotmail junk and how to fix it from the sending side: authentication, IP checks, SNDS reputation, JMRP complaints and content.

Published 6 Oct 2026 8 min read By srvScripts team

Short answer: When your mail lands in the Junk folder at Outlook.com, Hotmail or Live, check four things from the sending side: authentication (SPF, DKIM and DMARC passing and aligned), the sending IP (valid reverse DNS, not dynamic, not on Spamhaus), reputation (complaint rate and filter verdicts in Microsoft SNDS, complaints via JMRP) and sending practices (opt-in lists, easy unsubscribe, steady volume, clean links). Outlook.com has no allow list you can join, so the fix is always on your side, plus Microsoft sender support once everything is clean.

We ran the reverse DNS and Exim routing checks below on our lab servers (AlmaLinux 9.8 with cPanel & WHM 11.138 and DirectAdmin 1.712) on 6 October 2026. Microsoft’s rules and header fields were checked against the Outlook.com postmaster pages and Microsoft Learn (linked below) on the same day.

Outlook.com or Microsoft 365?

“Outlook” covers two different systems, and the fix depends on which one junked the message:

Outlook.com: Microsoft’s consumer service for @outlook.com, @hotmail.com, @live.com and @msn.com addresses. Your reputation with Outlook.com is what SNDS and JMRP show.
Microsoft 365 (Exchange Online): business mailboxes such as bob@contoso.com. The recipient’s organization has its own anti-spam policies, and its admin can see why a message was junked and allow it.

Everything in this guide helps with both, but for Microsoft 365 recipients the fastest answer often comes from their admin.

Step 1: read the headers of a junked message

Ask the recipient to forward the message as an attachment, or send a test to an Outlook.com mailbox you own and view the message source. Paste it into our Email Header Analyzer and look at Authentication-Results:

spf=pass with smtp.mailfrom in your domain.
dkim=pass with header.d= your domain.
dmarc=pass with header.from= your domain.
For Microsoft 365 recipients, compauth=pass. Microsoft documents compauth as a composite result that combines SPF, DKIM, DMARC and other signals, based on the From domain.

Microsoft 365 also adds X-Forefront-Antispam-Report. Microsoft Learn documents SFV:SPM as “marked as spam by spam filtering”, SFV:NSPM as not spam, and SRV:BULK as identified as bulk mail by the bulk complaint level (BCL) threshold. A BCL verdict means recipients complain about mail like yours, which is a list and content problem rather than a DNS one.

Step 2: fix authentication and alignment

If any check above failed, fix it first. Nothing else matters while authentication fails.

SPF: one record for the envelope domain, listing every sender, within 10 DNS lookups. Check with our SPF Record Checker.
DKIM: sign with your own domain, 2048-bit key. cPanel uses selector default, DirectAdmin uses x (confirmed in Exim’s configuration on our labs). Check with our DKIM Checker.
DMARC: publish at least p=none with a rua address and aligned SPF or DKIM. Use the DMARC Checker.

Domains sending over 5,000 messages a day to Outlook.com must pass all three, or they get 550 5.7.515 bounces instead of Junk placement.

Step 3: check the sending IP

Find the IP your mail actually leaves from (it is in the first Received header Microsoft added). Then check reverse and forward DNS:

dig +short -x 203.0.113.10
dig +short A mail.example.com

The PTR should be a hostname in a domain you control, and that hostname should resolve back to the same IP. On our cPanel lab both matched. Microsoft’s policies say servers must have valid reverse DNS and that connections from dynamic IP space may not be accepted. Then check blocklists with our IP Blacklist Check. Outlook.com’s error table links its 550 OU-001 block to Spamhaus, and its 550 DY-001 to dynamic IP space.

Shared hosting adds a twist: your domain shares the IP with every other customer on the server. One compromised mailbox elsewhere on the box can push the IP’s filter verdict towards Junk for everyone.

Step 4: check reputation in SNDS and act on complaints

Microsoft’s Smart Network Data Services (SNDS) shows, per IP and per day, how many recipients you sent to, the filter verdict and the complaint rate. You need to prove you control the IP range to see it; the SNDS FAQ linked below explains the sign-up. How to read it:

SNDS field	What it tells you
Filter result: Green	Spam verdict on less than 10% of messages
Filter result: Yellow	Between 10% and 90%: this is where “some mail goes to Junk” usually sits
Filter result: Red	Spam verdict on more than 90%
Complaint rate	Junk reports divided by recipients. Microsoft says more than 30% of IPs keep it under 0.3%, which is a good bar to aim for
IP status: Junked / Blocked / Bot	Microsoft is junking or refusing mail from the IP, or has seen bot-like behaviour

SNDS shows no traffic data for IPs that sent fewer than 100 messages that day, so a low-volume server may have nothing to see. Enrol the same IPs in the Junk Mail Reporting Program (JMRP) to receive a report every time an Outlook.com user marks your mail as junk, then remove those recipients from your lists.

Step 5: sending practices and content

Microsoft’s troubleshooting page names the junk complaint rate as one of the main drivers of reputation. The practical list:

Send only to people who opted in. Confirm sign-ups, and never use bought lists.
Make unsubscribing easy with a visible link and List-Unsubscribe headers, and process requests quickly.
Remove bounces. Microsoft’s policy says that after a permanent (5xx) error the sender must not retry that recipient, and must stop after repeated failures.
Warm up new IPs. Microsoft says new IPs have no reputation and typically take a couple of weeks to ramp up, faster if they are covered by an SPF record of a domain with good reputation. See our IP and domain warm-up guide.
Avoid address verification tricks. Checking addresses with RCPT TO without sending (“namespace mining”) gets IPs blocked with 550 SC-002.
Links: use reputable domains, make it clear where each link goes, and do not put raw IP addresses in URLs.
Connections: do not open more than 500 simultaneous connections to Outlook.com without prior arrangement.
Separate streams: send marketing from a different subdomain (and ideally IP) than invoices and password resets.

There is no paid or free allow list at Outlook.com. Microsoft partners with Validity’s Sender Certification, which it describes as a third-party accreditation it uses for certified senders in good standing. Contacts and safe-sender entries help individual recipients, but they do not fix reputation.

Step 6: ask Microsoft sender support

When authentication passes, the IP is not listed, and SNDS shows no block, but mail still goes to Junk, open a ticket through the Support link on the Outlook.com postmaster troubleshooting page. Microsoft asks that the person most familiar with the issue and the mail infrastructure submits it. Include the sending IPs, a sample of full headers and what you have already fixed. Microsoft notes that a ticket does not guarantee delivery.

Check that it worked

Send to two or three Outlook.com and Hotmail test mailboxes that have never interacted with you, and check Inbox vs Junk.
Confirm spf=pass, dkim=pass and dmarc=pass in the headers.
Watch SNDS daily for a week: the filter result should move from Yellow towards Green and complaint rates should stay low.
Read JMRP reports and confirm complainers are removed automatically.

Common problems

Only one recipient gets Junk. That user may have marked earlier mail as junk or set their own rules. Check with a fresh mailbox before changing anything.
Everything passes but SNDS is Yellow. Reputation, not DNS. Look at complaint rate, list sources and recent volume spikes.
Mail forwarded into Outlook.com fails. Forwarding breaks SPF; make sure DKIM is signing so DMARC can still pass.
A website form “from” the visitor’s address. Contact forms that put the visitor’s Hotmail address in From fail DMARC. Send from your own domain and use Reply-To for the visitor.

Official documentation: Outlook.com postmaster: troubleshooting and error codes · Outlook.com postmaster: policies and guidelines · SNDS FAQ · Microsoft Learn: anti-spam message headers

Frequently asked questions

Why do my emails go to junk in Outlook but not Gmail?

Each provider keeps its own reputation data. Outlook.com weighs junk complaints from its own users heavily, so check SNDS complaint rates and JMRP reports even if Gmail delivers fine.

Can I get whitelisted by Outlook.com?

No. Microsoft says Outlook.com does not operate an allow list. It works with Validity’s Sender Certification, a third-party accreditation programme.

Does adding a safe sender fix junk placement?

Only for that one recipient. It does not change your reputation, and Microsoft says safe senders do not bypass its high-volume authentication rule.

Why does SNDS show no data for my IP?

SNDS may not show traffic data for IPs that sent fewer than 100 messages on a given day, and data appears after a daily processing run.

What do SFV:SPM and BCL mean in the headers?

In Microsoft 365, SFV:SPM means spam filtering marked the message as spam. BCL is the bulk complaint level; a high value means mail like yours draws complaints.