Yeah, seen this pattern a lot. SPF/DKIM/DMARC green just clears the front-door check at Outlook - the consumer-side (@live, @hotmail, @outlook.com) runs a second filter that's. meaningfully stricter than the enterprise M365 tenant filter.
A few things that aren't always on the checklist:
- 1.
RFC 8058 one-click List-Unsubscribe. Not just any List-Unsubscribe header - the mailto + POST-URL pair with List-Unsubscribe-Post: List-Unsubscribe=One-Click. Missing it = major trust penalty even with everything else green.
- 2.
JMRP feedback loop. SNDS is useless for shared-IP setups, but JMRP still works. Note: Microsoft recently blinded JMRP. They no longer pass the complainant's raw email address in the headers. You now have to inject custom X-headers or map the returned Message-ID to your own send logs to figure out who hit the spam button.
- 3.
IP warmth to Outlook consumer specifically. Your IP might be warm to Gmail/Yahoo but cold to Outlook consumer. Microsoft tracks reputation to consumer separately. A small-volume, highly engaged warmup targeting live/hotmail/outlook addresses over 2-4 weeks tends to move the needle more than any DNS change.
- 4.
The 0.1% Complaint Ceiling. While Google allows up to 0.3%, Microsoft's machine-learning filters flag sending domains when complaints cross just 0.1%. Above that, aggressive junk-folder routing kicks in fast.
- 5.
Content Triggers. Consumer Outlook's SmartScreen is incredibly aggressive on cold-email patterns. Reduce URL density, cut tracking-domain redirects, and avoid obvious sales/outreach jargon.
- 6.
Delisting check. If your IP or domain got flagged recently, sender.office.com has a delisting request form. Worth submitting - it's free and occasionally works fast.
What's the IP model - dedicated or shared through the sequencer? Fix priority order changes based on that.
