Why cold email lands in Outlook junk (and how to fix it)

Most cold emailers tune for Gmail and then wonder why their enterprise prospects never reply. In B2B, a large share of decision-makers sit on Microsoft 365, and Microsoft filters differently. There is no Postmaster-style spam rate for your domain, the admin of each tenant can change the rules, and a campaign can land in the inbox at one company and in Junk at the next.

Here is how Microsoft's filtering works, as far as Microsoft documents it, and what you can do about it.

Outlook.com and Microsoft 365 are different filters

Outlook.com is Microsoft's consumer service, covering hotmail.com, live.com and outlook.com addresses. It applies one set of rules to everyone. Microsoft has long described its consumer filter as SmartScreen, a machine-learning filter trained on known spam and user feedback, on the Outlook.com postmaster site. The 2025 high-volume sender rules apply here.

Microsoft 365 business tenants use Exchange Online Protection (EOP), and many also use Microsoft Defender for Office 365. The baseline is Microsoft's, but each organization's admin sets anti-spam policies, bulk thresholds, allow and block lists, and quarantine rules. Two prospects can receive the same email and get different results.

For cold email, the business tenant matters most. That's where your prospects are.

How Microsoft 365 decides Junk vs Inbox

Microsoft gives every inbound message a bulk complaint level (BCL) from 0 to 9. A high BCL means "a bulk sender that generates a high number of complaints." According to Microsoft Learn, the default thresholds are:

• Default anti-spam policy: BCL 7, then deliver to Junk.
• Standard preset policy: BCL 6, then deliver to Junk.
• Strict preset policy: BCL 5, then quarantine.

Quarantine is worse than Junk because the prospect never sees the message unless they go looking for it. Tenants with security-conscious admins are more likely to run Strict.

There's a newer wrinkle. As of July 2026, Microsoft tags bulk mail that's "promotional in nature" with a Promotions label, and admins can turn on a setting that moves it to a Promotions folder in supported Outlook versions (Microsoft Learn). A cold email that reads like a newsletter is more likely to be tagged that way.

Separately, the spam verdict depends on content, reputation and authentication. The old spam confidence level (SCL) number no longer decides it in the cloud. Microsoft says to read the CAT value instead (Microsoft Learn).

Read the headers before you change anything

Send a test to a Microsoft 365 mailbox you control, open the message source and find these headers (Microsoft Learn):

X-Forefront-Antispam-Report: ...CAT:BULK;...SFV:SPM;...
X-Microsoft-Antispam: BCL:7;...
Authentication-Results: spf=pass ... dkim=pass header.d=yourdomain.com;
  dmarc=pass action=none header.from=yourdomain.com; compauth=pass reason=100

Safe senders won't save a cold campaign

Telling prospects to "add us to safe senders" doesn't work for cold email. They don't know you yet. Even when it's done, it has limits. Microsoft documents that Safe Senders entries are honored when the policy action is "move to Junk," but domain entries aren't honored when the action is quarantine, and malware and high-confidence phishing are always quarantined (Microsoft Learn). For consumer Outlook.com, Microsoft's high-volume sender post says plainly: "Safe Sender list won't be honored" to bypass the authentication rules (Microsoft Tech Community).

Admin-level allow entries do work, but those are for vendors a company already trusts, not for you.

Sending from Microsoft vs Google inboxes to Microsoft recipients

A common belief among cold emailers is that Microsoft 365 inboxes land better at Microsoft recipients and Google Workspace inboxes land better at Gmail. Microsoft doesn't publish anything that confirms or denies this, and we won't give you a percentage we can't back up.

What we do: ESP-match. In our operating data across four inbox types, Outlook inboxes go to Outlook recipients, always. Split your list by recipient provider and route Microsoft-hosted prospects through Outlook inboxes. A mixed fleet is what makes that possible. Still run the same copy from a Workspace inbox and an Outlook inbox to Outlook seed addresses on your own list and compare. Whatever you choose, authentication has to be aligned on both. A Microsoft 365 domain with DKIM never enabled is a common reason Microsoft-to-Microsoft mail still lands in Junk. Setup is in our SPF, DKIM and DMARC guide.

Links, tracking and content Microsoft punishes

These are the Outlook operating rules from our 2026 Q3 inbox-types data, not Microsoft policy:

• Never use open tracking. Turn it off on every Outlook inbox, and use your own tracking domain for anything else you track.
• No links in the body copy. URL shorteners, redirect chains and links to a domain that doesn't match your From domain all look like phishing. Ask a question and let the reply carry the conversation.
• Keep it under 50 words, casual, with no financial language. Short, plain text reads like a person wrote it. No attachments or images.
• Don't format it like a newsletter. Banners, footers and HTML templates push you toward bulk and Promotions.
• Use heavy spintax. Vary the wording every 2–3 words, especially in the signature, and personalize beyond {first_name}. Near-identical bodies across thousands of sends are what bulk detection is built to find.

Do SNDS and JMRP still exist?

Yes, with changes. Microsoft relaunched SNDS (Smart Network Data Services) in June 2026 at a new portal that replaces the old sendersupport.olc.protection.outlook.com/snds/ address. Network access now expires 10 months after approval or migration, so you have to re-attest periodically. SNDS shows per-IP data for mail to Outlook.com and "includes our Junk Email Reporting Program" (JMRP), which sends you reports when users mark your mail as junk.

Two caveats for cold emailers. First, SNDS is registered by IP address. If you send through Google Workspace or Microsoft 365 inboxes, you don't own those IPs and can't register them. SNDS is useful only if you run dedicated sending IPs. Second, deliverability practitioners report that JMRP reports now carry less identifying data than before, and that the return-path can no longer be relied on to identify the recipient (Spam Resource). Microsoft hasn't documented this change in detail.

So for most cold emailers, the practical way to monitor Outlook is placement testing. Zylar runs placement tests per domain at Gmail and Outlook and gives each inbox a daily health score. When placement drops below your threshold, the domain pauses automatically, its volume moves to healthy domains, and it goes back on warm-up.

Know where you land before you hit sendPlacement tests per domain, daily health scores and auto-pause.How it works

The fix list, in order

1. Authenticate and align. SPF passes, DKIM is signed with your own domain, and DMARC is at least p=none and passing. Confirm compauth=pass in the headers.
2. Check placement at Outlook specifically, not just Gmail. Test business tenant addresses as well as outlook.com.
3. ESP-match. Send to Outlook recipients from Outlook inboxes.
4. Cut per-inbox volume on domains that are landing in Junk. In our 2026 Q3 inbox-types data, Outlook inboxes run 8–10 cold sends a day on a Premium tenant and 3–5 on a Normal tenant. Volume comes from the 100 inboxes per domain, not from pushing each one harder.
5. Strip the email back: plain text, under 50 words, no links, no open tracking, no images, heavy spintax.
6. Stop sending to segments that complain and remove bounces right away. Microsoft recommends removing invalid addresses regularly.
7. Keep warm-up running while you fix things. New Outlook inboxes need 3–5 days minimum before cold sends, ideally 10–14 (warm-up guide).
8. If placement doesn't recover in a couple of weeks, follow the burned domain recovery playbook.

For the full rule set, see the Gmail, Yahoo and Microsoft sender rules and our deliverability page.

FAQ

Why does my cold email reach Gmail inboxes but go to junk in Outlook?

Gmail and Microsoft use different filters and weigh different signals. In Microsoft 365, each tenant's admin also sets their own bulk thresholds and policies. Test placement at Outlook separately, and read the anti-spam headers to see whether you're being filed as bulk, spam or an authentication failure.

What is a good BCL score?

Lower is better. Microsoft's default policy sends bulk mail to Junk at BCL 7, the Standard preset at 6 and the Strict preset at 5. If your test messages show BCL 5 or higher, some business tenants will junk or quarantine them.

Can I register for SNDS if I send through Google Workspace or Microsoft 365?

Not usefully. SNDS registers IP addresses you control, and shared provider IPs aren't yours. SNDS and its JMRP feedback loop are mainly for senders with dedicated IPs.

Does asking prospects to add me to safe senders help?

Rarely. Prospects who don't know you won't do it. Microsoft also doesn't honor domain safe sender entries when the action is quarantine, and Outlook.com ignores Safe Senders for mail that fails its high-volume authentication rules.

What does 550 5.7.515 mean?

It's Microsoft's rejection code for high-volume senders to Outlook.com whose domain fails the SPF, DKIM or DMARC requirements. Fix the failing record and confirm that DMARC passes with alignment.