What are Microsoft's Compliant P2 (Primary) Sender Address requirements for email deliverability?
Updated on 14 Oct 2026: We clarified Microsoft's P2 sender guidance and the authentication checks behind Outlook.com rejections.
The short answer: Microsoft does not require the visible sender address to use only the root domain. A campaign can use a branded subdomain such as patrick@email.xyzcompany.com, as long as the address is syntactically valid, the domain genuinely belongs to the sending organization, DNS and authentication are correct, and the message provides a working reply path.
Microsoft recommends valid, accurate visible sender addresses. P2 specifically means the 5322.From address shown in the message header. Reply-To is a separate message header that tells mail clients where responses should go. Both are separate from the SMTP envelope sender (5321.MailFrom, or P1) used for bounces. Microsoft's announcement lists SPF, DKIM, and DMARC as mandatory authentication checks for high-volume Outlook.com senders, and P2 sender compliance as an additional email hygiene recommendation.
- Root domain: Using xyzcompany.com is acceptable, but it is not the only acceptable pattern.
- Subdomain: Using email.xyzcompany.com is acceptable when it has the right DNS, authentication, and routing.
- No-reply: If a no-reply From address cannot receive mail, provide a working Reply-To address.
- Mismatch: A sender domain or display name that misleads recipients about who sent the message needs correction.
What Microsoft means by P2 sender address compliance
Microsoft's P2 guidance calls for a valid address that reflects the true sending domain and can receive replies through From or Reply-To. A separate Reply-To is optional when From already accepts replies.
Valid means the address parses under normal email header rules and its domain exists. It should not contain broken punctuation, hidden characters, an invalid domain, or a display name that disguises a different brand. Microsoft can reject malformed From headers before reputation signals affect placement.
Reflects the true sending domain means the recipient and mailbox provider should be able to connect the visible sender to the organization that controls the mail stream. A subdomain of your brand is fine. An unrelated domain that recipients do not recognize creates avoidable risk.
P2 hygiene and authentication are separate
Branded subdomains are permitted. Valid From headers and a working reply path address P2 hygiene; passing SPF, DKIM, and DMARC addresses the mandatory authentication checks. Error 5.7.515 identifies an authentication failure, rather than proving that a no-reply address or subdomain is prohibited.
Illustration of Outlook.com authentication and P2 sender guidance in Microsoft 365 admin center.
Who Microsoft's high-volume rule covers
Microsoft's high-volume sender announcement describes a daily threshold of 5,000 messages; its support guidance defines a high-volume sender as one sending 5,000 or more messages to Microsoft consumer services with the same 5322.From domain. The consumer scope includes Outlook.com and related Hotmail, Live.com, and MSN addresses. Once a domain reaches that threshold, Microsoft expects all messages using that From domain to meet the authentication requirements. This consumer rule does not automatically extend the same volume threshold to Microsoft 365 business mailboxes.
- Threshold: Count 5,000 or more messages per day to Microsoft consumer services under the same 5322.From domain, across all sending systems.
- SPF and DKIM: Publish the required SPF and DKIM records and make sure both checks pass on each message. SPF is checked against the SMTP MAIL FROM domain.
- DMARC: Publish at least p=none and pass DMARC through SPF or DKIM domain alignment.
- Enforcement: Authentication enforcement began on May 5, 2025. Messages that fail the required checks are rejected with 550 5.7.515.
Microsoft rejection responsetext
550 5.7.515 Access denied, sending domain [SendingDomain] does not meet the required authentication level.
A safe-sender entry does not replace these checks. Treat 5.7.515 as an authentication failure for the 5322.From domain, then inspect SPF, DKIM, DMARC, and alignment in the rejected message stream.
Does the From address need to use the root domain?
No. Here, root domain means xyzcompany.com, and subdomain means email.xyzcompany.com. The .com part is the top-level domain (TLD). Microsoft has not stated that every visible sender address must use only xyzcompany.com.
A branded subdomain lets a company organize high-volume campaigns separately. It lets a company separate message streams by purpose while keeping the domain under the same organizational control. The From domain should have valid DNS and pass DMARC through SPF or DKIM domain alignment. The address designated for replies should also have working mail routing.
Compliant subdomain pattern
- Domain: email.xyzcompany.com is controlled by xyzcompany.com.
- Mailbox: Replies reach a monitored inbox, queue, or ticketing workflow.
- Auth: SPF and DKIM pass, and at least one authenticated domain has DMARC alignment with the From domain.
- Identity: Recipients can recognize who sent the message.
Risky visible sender pattern
- Domain: The sender domain or display name misleads recipients about the responsible organization.
- Mailbox: Replies bounce, disappear, or hit an unmonitored box.
- Auth: SPF or DKIM fails, or neither authenticated domain has DMARC alignment with the From domain.
- Identity: Recipients cannot tell who is responsible for the message.
|
|
|
|---|---|---|
Personal sender on brand subdomain | Good | The domain belongs to the brand and replies can route correctly. |
Team mailbox on root domain | Good | The address is recognizable and can receive responses. |
No-reply From with working Reply-To | Good | The From address is valid and replies have a clear route. |
No-reply From without working Reply-To | Risky | The message provides no usable response path. |
Unexplained vendor From domain | Needs review | Authentication can pass, but recipients still need a clear connection to the sender. |
Sender identity and reply-routing examples; every pattern also needs passing authentication.
What counts as a valid From or Reply-To address
A valid P2 address is more than a string that looks like an email address. Check syntax, DNS, reply handling, and message authentication together because a failure in any one of them can break the sending setup.
Header exampletext
From: "Patrick" <patrick@email.xyzcompany.com> Reply-To: "Support" <support@xyzcompany.com> Return-Path: <bounce-123@bounces.email.xyzcompany.com> Message-ID: <abc123@email.xyzcompany.com>
That example separates visible identity, reply handling, and bounce processing. The From address uses a branded campaign subdomain. Reply-To routes to the support mailbox on the root domain. Return-Path handles bounces and does not need to match the visible address exactly, though it should still be part of the authenticated sending setup.
- Syntax: Use one mailbox in From, put a space before the address in angle brackets, and avoid trailing text. Quote display names, especially those containing commas. Although RFC 5322 permits multiple authors with a Sender field, Microsoft recommends one From address.
- DNS: The From domain must exist, and the reply destination needs working inbound mail routing. A null MX declares that an entire domain accepts no mail; do not publish it on the domain designated to receive replies.
- Replies: From or Reply-To should route legitimate responses into a monitored inbox, queue, or automation.
- Authentication: For high-volume Outlook.com senders, SPF and DKIM must both pass, and at least one must have DMARC domain alignment with 5322.From.
Illustrative authentication records, replace placeholdersdns
bounces.email.xyzcompany.com. IN TXT "v=spf1 include:send.example -all" selector1._domainkey.email.xyzcompany.com. IN TXT "v=DKIM1; k=rsa; p=REPLACE_WITH_PUBLIC_KEY" _dmarc.email.xyzcompany.com. IN TXT "v=DMARC1; p=none; rua=mailto:dmarc-reports@xyzcompany.com"
SPF belongs on the envelope sender domain, here bounces.email.xyzcompany.com. Replace send.example with your platform's supplied SPF include, use its supplied DKIM record, and configure a working reporting mailbox. DMARC policy discovery starts at the exact From domain, here _dmarc.email.xyzcompany.com. RFC 9989 specifies a DNS tree walk for parent-domain policy discovery when no policy is found there. An explicit record at the From subdomain avoids relying on receiver-specific fallback behavior. Suped's DMARC monitoring workflow helps catch cases where a sender looks compliant in DNS but fails in actual traffic.
Why Reply-To does not fix DMARC alignment
DMARC evaluates the RFC5322.From domain, not Reply-To. Changing Reply-To to support@xyzcompany.com cannot authenticate a From domain that fails DMARC. Compare the visible sender with the domains authenticated by SPF and DKIM.
|
|
|
|---|---|---|
P2 sender | RFC5322.From | The visible sender domain that DMARC evaluates. |
P1 sender | SMTP MAIL FROM, usually recorded in Return-Path | The SPF-authenticated domain must have alignment with From for SPF to satisfy DMARC. |
DKIM signing domain | The d= value in DKIM-Signature | A passing signature with domain alignment can satisfy DMARC. |
Reply destination | Reply-To, or From when Reply-To is absent | Routes replies and is not a DMARC authentication identifier. |
P1 and P2 sender identities have different roles in authentication.
Relaxed alignment is the default and requires the authenticated domain and From domain to share an organizational domain. Strict alignment, selected with aspf=s or adkim=s, requires an exact domain match for the respective mechanism. For patrick@email.xyzcompany.com, DKIM d=xyzcompany.com has relaxed alignment when both share the same organizational domain, but fails strict DKIM alignment. DKIM d=email.xyzcompany.com satisfies either mode when its signature passes.
Microsoft's authentication requirements require both SPF and DKIM to pass. DMARC needs domain alignment through at least one of them; a recognizable display name or working Reply-To does not replace that check.
How to test P2 sender address compliance
The fastest test is to send a real message and inspect the headers, authentication results, and reply path. Do not stop at a DNS lookup. A DNS lookup tells you whether records exist. A message test tells you whether the email that left your platform actually used the expected From, Reply-To, DKIM domain, SPF domain, and Return-Path. Send a seed message to an Outlook.com account you control using the production configuration, then inspect Microsoft's Authentication-Results header.
Use this order when reviewing a new Microsoft-bound stream: confirm the visible sender address, send a seed message, inspect the received headers, reply to the message, and check aggregate DMARC results once real traffic appears. Suped's email tester inspects the message delivered to its test address. Test Outlook.com delivery and the reply mailbox separately, because different delivery routes can produce different authentication results.
Email tester
Send a real email to this address. Suped shows a results button when the test is ready.
?/43tests passed
After the message-level check, review the sending setup as a whole. A valid From address does not guarantee inbox placement; authentication, reverse DNS (rDNS), and sender reputation still affect delivery. Suped's domain health check helps identify DNS and authentication issues in that setup.
Microsoft P2 compliance workflow: check sender DNS, test email and replies, then monitor DMARC.
Can a no-reply address comply?
A no-reply address is not automatically non-compliant because of the local part alone. The words before the at sign matter less than the address's technical behavior. A no-reply From address can use a separate Reply-To that accepts responses.
Microsoft's From-address guidance documents a null MX for a dedicated custom domain when a sender intentionally suppresses direct auto-replies. A null MX disables inbound mail for the whole domain, not only a no-reply mailbox, and does not authenticate outgoing mail. For high-volume campaigns, pair that setup with a valid Reply-To that routes responses into a reviewed queue. Marketing and relationship mail usually work better with a team or named sender that has an obvious response path.
Make the response path explicit
If the From address does not accept mail, add a working Reply-To and test it. An auto-response that discards every message gives recipients no useful route for support, privacy requests, abuse reports, or unsubscribe problems.
- Best: Use a monitored From mailbox or Reply-To queue.
- Acceptable: Use automation that accepts mail and routes useful replies.
- Risky: Reject replies without providing a working Reply-To.
- Invalid: Use a malformed From address that fails header validation.
How Suped fits the workflow
P2 sender compliance is partly policy and partly evidence. Teams need a standard for which From and Reply-To addresses they can use, plus proof that the real mail stream matches that standard.
Suped is our DMARC and email authentication platform. Suped's product collects aggregate reports, identifies sending sources using each 5322.From domain, and surfaces SPF, DKIM, or DMARC failures reported by participating receivers. Teams can compare those results with an approved sender inventory and assign specific remediation work when a new source appears. Aggregate reports do not verify full From or Reply-To addresses, reply delivery, or inbox placement; use message and reply tests for those checks.
Issue steps to fix dialog showing the issue overview, tailored fix steps, and verification action
If a campaign subdomain starts failing authentication and crosses a configured alert threshold, Suped can notify the responsible team and show remediation steps. MSPs can also manage multiple client domains in one dashboard when clients have different sender naming rules.
P2 sender address risk levels
Internal review categories for sender identity, reply routing, and authentication; these are not Microsoft scoring thresholds.
Low risk
Ready
Brand domain, working mailbox, passing SPF, DKIM, and DMARC.
Needs review
Review
Valid subdomain, but reply routing or DKIM domain alignment is unverified.
High risk
Fix
Missing reply path, misleading identity, malformed address, or DMARC failure.
Monitor
Watch
Compliant today, but new senders or templates can change the header set.
Checklist for Microsoft-bound campaigns
Use this checklist before a domain sends at volume to Outlook.com, Hotmail.com, Live.com, and MSN consumer addresses. It also helps with broader Outlook delivery work because visible identity and authentication failures tend to show up together.
- Inventory: List every From and Reply-To address used by marketing, product, sales, support, and transactional systems.
- Ownership: Confirm each From domain is controlled by your organization or authorized for that mail stream, and approve the Reply-To destination.
- Routing: Send a reply to the address designated for responses and verify it reaches a monitored workflow.
- Headers: Send a real message and inspect From, Reply-To, Return-Path, DKIM, SPF, and DMARC results.
- Policy: Document which sender patterns are approved and block unapproved templates before launch.
- Unsubscribe: Provide a visible, functional unsubscribe link in marketing or bulk mail and test that opt-outs stop further sends.
- List hygiene: Send only to recipients who consented, remove invalid addresses, and suppress hard bounces promptly.
- Monitoring: Watch DMARC results, complaints, bounces, and blocklist (blacklist) events after launch.
Microsoft's published hygiene recommendations call for visible, functional unsubscribe links. That announcement does not specify mandatory RFC 8058 one-click unsubscribe headers or a 48-hour processing deadline. Treat one-click unsubscribe as a useful implementation choice without attributing those specific rules to this Microsoft announcement.
The simplest internal rule
Approve only visible sender addresses that belong to the brand, provide a reply path, and pass authentication in an actual test message. Everything else needs a fix before volume ramps.
Practical checks for sender address changes
Best practices
Test the visible From header and the actual reply destination before approving campaigns.
Use a branded subdomain when its authentication records and reply routing are verified.
Document sender address exceptions so support teams can explain reply routing decisions.
Common pitfalls
Using a no-reply address without a working reply path conflicts with Microsoft's guidance.
Treating branded subdomains as invalid by default causes avoidable rebuilds and delays.
Changing From domains without checking authentication creates preventable DMARC failures.
Expert tips
Require approval for new From and Reply-To addresses before templates reach production.
Keep an approved reply address inventory when multiple teams send through the same domain.
Review reply delivery and spam complaints together after changing a sender's visible address.
Choosing a sender address for each message type
If the choice is noreply@email.xyzcompany.com or patrick@email.xyzcompany.com, use the address that fits the message type and provides a clear response path. Marketing or relationship mail usually benefits from a person or team mailbox. Transactional mail can use a no-reply local part when a working Reply-To routes responses somewhere useful.
