Planning a Cold Email Campaign? Don't Send It from Outlook.

The Scenario Every IT Team Recognises

Marketing has compiled a list of 3,000 prospects. Someone in the meeting says: "We already have Microsoft 365. Just send them from sales@company.co.uk."

It sounds efficient. One tool, no extra cost, done by Thursday.

But company.co.uk is also the address on every invoice, quote, customer reply, supplier order, password reset, support ticket and director communication your business sends. Ask yourself a different question: do you really want the reputation of all that email tied to the performance of one marketing campaign?

The email address on your invoices is more valuable than the address on your next prospecting campaign.

This article is not a guide to cold-email law or GDPR. It is a guide to sending bulk or outbound email without putting your normal business email at unnecessary risk. The central message is simple: your business mailbox and your marketing platform solve different problems.

What Microsoft Actually Says

This is not simply Altitude's preference. Microsoft itself provides guidance on bulk email from Exchange Online, and it is worth quoting directly.

Microsoft's current documentation on outbound spam protection describes bulk email sent through Microsoft 365 as supported on a best-effort basis. Microsoft advises that sending too much email can cause senders to be restricted. Microsoft also specifically recommends that organisations avoid using their primary email domain for bulk email and instead consider a custom subdomain exclusively for bulk sending — for example m.contoso.com for marketing or t.contoso.com for transactional email.

Microsoft also recommends that bulk senders configure SPF, DKIM and DMARC, include proper unsubscribe handling, and remove invalid or non-existent addresses from bulk databases.

This isn't simply Altitude's preference. Microsoft itself recommends separating bulk-email traffic from your primary email domain.

Verify the current wording in Microsoft's Defender for Office 365 and Exchange Online outbound-spam documentation before making decisions. Microsoft's guidance can be updated.

Service Limits Are Not Recommended Campaign Volumes

Microsoft 365 has published sending limits for Exchange Online — including limits on recipients per day, messages per minute, and recipients per message. These figures are subject to change and depend on the specific plan and tenant configuration; verify the current limits in Microsoft's official documentation before relying on any number.

What matters here is how to interpret them. These are service-control limits — the point at which Microsoft may restrict traffic to protect the wider service. They do not represent Microsoft's endorsement of bulk sending up to that threshold.

A service limit tells you when Microsoft may stop the traffic. It does not tell you when the campaign becomes a good idea.

Outbound Spam Protection and Restricted Entities

Microsoft monitors outbound email from Exchange Online for suspicious sending patterns, potential spam and excessive sending volume. A sender that triggers these controls may be throttled, restricted, or blocked from sending until the issue is investigated and resolved.

Microsoft Defender for Office 365 uses the term Restricted Entities for senders that have been blocked due to suspected compromise or policy violation. Microsoft generates alerts when this occurs. The correct response is to investigate the cause — not simply to remove the restriction and resume sending.

Microsoft would rather stop one mailbox from sending than let one customer's bulk campaign damage the reputation of the wider service.

The High-Risk Delivery Pool

Microsoft operates a separate outbound delivery pool for messages classified as lower quality or potential spam. Microsoft's documentation states that delivery from this pool is not guaranteed because some recipient organisations will reject mail from those IP addresses.

Not all bulk mail is automatically routed there. Mail that Microsoft's filters classify as likely spam may be sent via this pool rather than the standard outbound infrastructure. Once that happens, you have less control over whether recipients receive it.

Once a campaign is being treated as low-quality mail, deliverability is no longer entirely under your control.

Domain Reputation: What It Is and Why It Matters

Recipient email systems assess inbound mail using a range of signals. These may include authentication results, sending patterns, bounce rates, complaint rates, engagement history, IP reputation and domain-level behaviour. The exact signals and their weighting vary between providers — there is no single universal "domain score."

What matters is that your domain develops a reputation based on everything sent from or associated with it. If bulk campaign traffic generates high bounce rates, spam complaints or authentication failures under your primary business domain, that history may affect how recipient systems treat your normal business correspondence.

Your domain has a reputation even if nobody in your business has ever thought about it.

The Case for a Separate Marketing Subdomain

The architecture Microsoft recommends — and that dedicated campaign platforms are built to support — separates traffic by subdomain:

The subdomain remains clearly associated with the business. A recipient seeing hello@m.company.co.uk knows who sent it. But the sending reputation of m.company.co.uk can be managed separately from the reputation of company.co.uk — protecting the domain your business depends on every day.

Separate the reputation of campaign traffic from the email your business depends on every day.

Your password-reset emails should not have to compete with the reputation of your marketing campaign.

Does a Subdomain Guarantee Deliverability?

No. This point is worth stating plainly because it is sometimes misunderstood. A marketing subdomain separates risk. It does not turn bad email into good email.

A separate subdomain does not make spam acceptable. It does not excuse poor data, high complaint rates, missing authentication, or deliberate evasion. Recipient systems assess the quality of your sending on that subdomain based on the same signals as your primary domain. If you use m.company.co.uk to send low-quality campaigns to stale data with no unsubscribe mechanism, the sending reputation of that subdomain will reflect it.

A subdomain separates risk. It does not turn bad email into good email.

Why Not Just Buy Another Domain?

Some outreach advice suggests using disposable domains, rotating domains, or lookalike domains to protect the primary business domain. Altitude does not recommend this approach.

If a business uses another domain for outreach, the connection to the business should be clear, authentication should be correct, and the domain should not impersonate another brand. Domain reputation still accumulates on any domain you use. Burning domains and moving on is not a sustainable infrastructure strategy.

If your sending strategy depends on burning domains and moving on, you have an outreach problem rather than a DNS solution.

Email Authentication: SPF, DKIM and DMARC

Correct email authentication is essential for any legitimate bulk or outbound campaign. It tells recipient systems that you authorised the message and that it has not been tampered with in transit.

SPF — Who May Send?

SPF allows a domain owner to publish which mail-sending systems are authorised to send email on behalf of that domain. When you add a marketing platform or campaign tool, you may need to include its sending infrastructure in your SPF record.

Two common SPF mistakes: publishing multiple separate SPF records for the same hostname (only one is valid), and adding so many included services that the record exceeds DNS lookup limits. Every sending platform claiming to send as your domain needs to fit into a deliberate, maintained authentication design.

Every platform claiming to send as your domain needs to fit into a deliberate authentication design.

DKIM — Was It Signed?

DKIM adds a cryptographic signature to outgoing email. Recipient systems can verify that the authorised sending system signed the message and that the signed portions of the message were not altered in transit. Use the provider's supported DKIM setup process. Never expose private DKIM keys — they should remain in the signing infrastructure, not in public DNS or documentation.

SPF identifies authorised infrastructure. DKIM adds proof from the sending domain.

DMARC — Does It Align With Our Policy?

DMARC allows a domain owner to specify how recipients should handle mail that fails SPF or DKIM alignment, what policy to apply (monitor, quarantine, or reject), and where to send aggregate reports. A sensible progression is to monitor first, understand what is legitimately sending as your domain, fix authentication gaps, then move toward enforcement.

Do not jump directly to p=reject without first using DMARC aggregate reports to identify all legitimate senders. A business that enforces DMARC before configuring authentication for its CRM, accounting platform, ticketing system or campaign tool may inadvertently block legitimate email.

DMARC enforcement should follow visibility, not confidence based on guesswork.

If you want to understand DMARC in more depth, the Altitude IT article Protect Your Business Email with DMARC covers it in full.

Use a Platform Designed for Campaign Traffic

A purpose-built bulk-email or outreach platform provides infrastructure that Microsoft 365 is not designed to replicate: managed sending infrastructure and IP pools, rate management, unsubscribe and suppression handling, bounce processing, campaign analytics, custom domain authentication, delivery monitoring, and list management.

Categories of platform include email marketing platforms (Mailchimp, Campaign Monitor, Brevo and similar), specialist cold-outreach platforms designed for B2B sequences, and transactional email providers for application-generated email. The right choice depends on your campaign type, volume and technical requirements.

Use a platform designed to manage campaign traffic rather than asking Outlook to imitate one.

What About Azure Communication Services Email?

Microsoft provides Azure Communication Services (ACS) Email as a dedicated high-volume sending service supporting transactional, bulk and marketing email with custom domains and high throughput. Microsoft's documentation describes throughput that can reach into millions of messages per hour with appropriate configuration and approval.

ACS Email is particularly suited to application-to-person scenarios — systems or applications that generate email programmatically. It is not a self-service marketing tool out of the box; it may require technical integration, campaign management, domain configuration and monitoring. It is worth knowing it exists, especially for organisations building applications or platforms that send at volume.

Microsoft has technology designed for high-volume sending. Exchange Online isn't that technology.

Microsoft 365 vs a Dedicated Campaign Platform

Common Workarounds That Don't Solve the Problem

Mail Merge

Word and Outlook Mail Merge can personalise email and send individual messages — it looks cleaner than a visible BCC list. But the underlying emails still travel through Exchange Online. Mail Merge does not remove Exchange Online sending limits, outbound-spam controls, or the reputation considerations associated with your domain.

Mail merge changes how the campaign looks. It doesn't change what is sending it.

BCC Lists

Microsoft specifically warns against high-volume messages to large BCC lists. Beyond the sending infrastructure concerns, BCC campaigns create other problems: no proper unsubscribe handling, no personalisation, no suppression, poor complaint management, and no campaign analytics.

BCC is a privacy field, not a bulk-marketing platform.

Shared Mailboxes

Using marketing@company.co.uk as a shared mailbox does not change the sending architecture. It is still Exchange Online. It is still your primary business domain. The sending reputation implications are the same.

Changing the From address does not change the sending infrastructure.

SMTP Relay and Direct Send

Microsoft 365 provides SMTP options for devices, applications, scanners and line-of-business systems. These are legitimate configurations for their intended purpose. They are not a workaround to turn Microsoft 365 into unrestricted bulk marketing infrastructure.

A relay changes how mail enters the system. It does not remove service limits or reputation concerns.

Bounce Handling and Suppression

If an email address does not exist, stop sending to it. Microsoft itself recommends removing invalid and non-existent addresses from bulk databases before sending. Continuing to send to dead addresses increases bounce rates, signals poor data quality to recipient systems, and wastes campaign budget.

A dead address is not a prospect that needs another follow-up.

Campaign platforms should maintain suppression lists: unsubscribes, previous objections, hard bounces and complaints. Do not simply delete unsubscribed contacts and then accidentally re-import them from a CRM export.

Suppression is the mechanism that turns "don't email me again" into a permanent system instruction.

List Quality

Bad data creates bounces, complaints, poor engagement and wasted sending. Marketing owns the question of who should be contacted. Email infrastructure needs a list clean enough not to damage delivery. A campaign with a 20% bounce rate has a data problem as much as a DNS problem.

Deliverability starts before DNS. It starts with sending mail people are reasonably likely to receive and recognise.

Volume Warm-Up

New sending infrastructure should not immediately jump from zero to tens of thousands of emails. Microsoft's Azure Communication Services documentation recommends gradually increasing sending volume while monitoring delivery and reputation data. A new sender that suddenly behaves like a high-volume source looks indistinguishable from a compromised account to recipient filtering systems.

A new sender should establish legitimate sending history rather than suddenly behaving like a compromised account.

The DNS Sprawl Problem

Over years, businesses accumulate email-sending services: a CRM, a newsletter platform, an old marketing agency, an accounting system, a ticketing system, and various one-off tools. Each may have added SPF includes, DKIM records, CNAMEs or return-path configuration to your DNS.

Years later, nobody knows what remains active, what the company still uses, or whether those services are still authorised to send as your domain.

Email authentication often fails because nobody removed yesterday's sending platform before adding tomorrow's.

SPF may contain authorisations for services the company no longer uses. Those entries create unnecessary attack surface, contribute to DNS lookup limits, and add management confusion. Inventory first; remove cautiously; verify nothing breaks.

An SPF record should describe today's approved senders, not the history of every marketing platform the company has ever tried.

DMARC Reporting as a Discovery Tool

DMARC aggregate reports are delivered to the address specified in your DMARC record and describe what systems are actually sending email using your domain. This is useful not only for enforcement — it can help you discover forgotten platforms, unauthorised senders, and authentication gaps you did not know existed.

DMARC isn't only an enforcement tool. It can also help answer "who is actually sending email as us?"

When Staff Report That Customers Aren't Receiving Your Email

If a bulk campaign has affected delivery of normal business email, a sensible first response is:

1. Stop the bulk campaign immediately.
2. Check Microsoft 365 Service Health for any platform-wide issues.
3. Check the Restricted Entities page in Microsoft Defender for Office 365.
4. Review outbound-spam alerts and protection reports.
5. Run a Message Trace in Exchange Online to confirm whether Microsoft is accepting and routing messages.
6. Check SPF, DKIM and DMARC configuration and alignment.
7. Review bounce rates and complaint levels from the campaign sender.
8. Check the campaign platform's own delivery and block reporting.
9. Fix the root cause before resuming any sending.
10. Resume only when the cause is understood and corrected.

Microsoft 365 Message Trace, available to administrators in Exchange Online, shows whether Microsoft accepted a message, how it was routed, and the delivery status or failure reason. It is a useful first-stop diagnostic when email is reported missing.

Do Not Simply Unblock a Restricted Sender

If Microsoft has placed a mailbox in Restricted Entities, the correct response is to investigate, not to remove the block and resume. A restricted sender may indicate a compromised account, an intentional bulk campaign, malicious forwarding rules, an application sending unexpectedly, or campaign activity that triggered filters.

Unblocking a sender without finding out why Microsoft blocked it is not remediation.

Campaign or Compromised Account?

This is an important distinction that bulk email from a standard mailbox makes harder to identify. Thousands of outbound emails from a single account could mean a marketing campaign or a compromised mailbox sending phishing or spam. Without proper separation, it is harder to tell the difference quickly — and the response to a compromised account is very different from pausing a campaign.

The same symptom — thousands of outbound emails — can mean a campaign or a cyber incident.

A properly secured Microsoft 365 environment — with MFA, Conditional Access, Defender for Office 365, and monitored outbound alerts — makes this easier to detect and respond to. See the Altitude IT article Is Your Microsoft 365 Tenant Actually Secure? for detail on the security baseline.

A marketing project should not weaken the Microsoft 365 security controls protecting normal email.

The Altitude IT Email Sending Architecture

When Altitude reviews email infrastructure before a campaign, we look at seven components:

1. Primary domain — identify what lives on company.co.uk and protect it.
2. Campaign subdomain — establish m.company.co.uk (or equivalent) for marketing traffic.
3. Purpose-built sender — a campaign or outreach platform, not Outlook.
4. Authentication — SPF, DKIM and DMARC configured correctly on each sending domain.
5. List control — suppression, bounce handling and unsubscribe in place.
6. Monitoring — delivery, complaints, authentication alignment and Microsoft alerts.
7. Review — remove old sending services, stale DNS records and obsolete authorisations.

Separate. Authenticate. Suppress. Monitor.

Where Marketing and IT Meet

Altitude Marketing and Altitude IT address different parts of a bulk or cold-outreach project. Altitude Marketing can assist with target audience, data strategy, campaign messaging and outbound approach. Altitude IT addresses the sending architecture: domains, DNS, Microsoft 365 configuration, SPF, DKIM, DMARC and deliverability investigation.

Marketing decides who to contact and what to say. IT makes sure the infrastructure can send it without putting normal business email at unnecessary risk.

Operational Heartbeat: Email Infrastructure Needs Ongoing Review

Email sending infrastructure does not stay in one place. Authorised senders are added and forgotten. DNS records accumulate. Campaign platforms change. Microsoft 365 security alerts appear and are missed. Forwarding rules are created and never removed.

Business email needs an Operational Heartbeat: domains, authentication, sending platforms, DNS records and delivery issues should be reviewed before a marketing campaign affects normal correspondence.

An Operational Heartbeat review of email infrastructure covers authorised sending services, SPF and DKIM configuration, DMARC policy and reporting, campaign subdomains, Microsoft 365 outbound alerts, restricted users, old marketing platforms, stale DNS records, bounce issues, delivery incidents, forwarding rules and connector configuration. It is the difference between finding a problem in a planned review and discovering it when a customer emails to say your invoice didn't arrive.

Bulk Email Readiness Checklist

Email Infrastructure Scorecard

A qualitative assessment across eight areas indicates where your business currently sits:

If any area scores Action required or Unknown, that is the starting point — not the campaign launch date. Altitude can review each area and advise on the quickest wins and the highest risks.

Common Mistakes

• Sending a campaign from the CEO's personal mailbox
• Using a sales@ shared mailbox to send thousands of messages
• Large BCC lists from Outlook
• Mail merge from a normal business mailbox
• No unsubscribe mechanism in the campaign
• No suppression list — re-mailing people who have opted out
• Stale or purchased prospect data with high bounce rates
• Primary business domain used for every campaign without subdomain separation
• New sending platform added without a DNS and authentication review
• Multiple SPF records published for the same hostname
• DKIM not configured on the campaign sending domain
• DMARC set to p=reject before legitimate senders are identified
• Old sending services still authorised in SPF but no longer in use
• A bulk campaign mistaken for a compromised account — or vice versa
• A Restricted Entity simply unblocked without investigation
• Nobody monitoring bounces or delivery rates during the campaign

Most bulk-email infrastructure problems begin with "we thought it would be easier just to use Outlook".

The Altitude IT Position

Microsoft 365 is excellent business email. That does not make it a bulk marketing platform. The objective is not to build complicated infrastructure for every newsletter. It is to make sure normal business email and campaign email do not unnecessarily share the same reputation and controls.

A good bulk-email setup should let marketing run campaigns without IT worrying that the next invoice, quote or support response will disappear into somebody's junk folder. That requires the right sending platform, deliberate domain design, correct authentication and ongoing monitoring.

Protect the domain your business depends on before using email to find the next customer.

Altitude IT provides Microsoft 365 support in Manchester and across Greater Manchester and the North West, including email deliverability reviews, domain authentication configuration, SPF, DKIM and DMARC setup, Microsoft 365 security baseline reviews, and DNS audits for businesses planning bulk or outbound campaigns. If you want Altitude to review your sending architecture before a campaign, see the Email Authentication & Sending Architecture Review service page. Contact us at ask-IT@altitude-it.co.uk.

Frequently Asked Questions

Can Microsoft 365 send bulk email?

Microsoft 365 can send email in volume, but Microsoft describes bulk sending as supported on a best-effort basis and advises against using the service as a bulk marketing platform. Sending too much can cause accounts to be restricted.

Is Outlook suitable for email marketing?

Outlook is designed for business correspondence, not for managing marketing campaigns. It lacks the unsubscribe handling, bounce management, suppression lists, campaign analytics and deliverability infrastructure that campaign platforms provide.

Does Microsoft support bulk email from Exchange Online?

Microsoft permits it on a best-effort basis and provides guidance to reduce the risk, including using custom subdomains and dedicated platforms. It does not actively support Exchange Online as a bulk marketing service.

What are Microsoft 365 email sending limits?

Microsoft 365 publishes sending limits for Exchange Online including recipients per day, messages per minute and recipients per message. These figures can change and depend on plan and configuration — check Microsoft's current documentation. They are service-control limits, not recommended campaign volumes.

Can Microsoft block a user for sending too much email?

Yes. Microsoft monitors outbound email for excessive sending and suspicious patterns. A sender that triggers these controls may be throttled or restricted from sending.

What are Restricted Entities?

Restricted Entities is the Microsoft Defender for Office 365 term for mailboxes or senders that have been blocked due to suspicious sending activity or policy violation. Microsoft generates alerts when an entity is restricted. The cause should be investigated before the restriction is removed.

What is the Microsoft high-risk delivery pool?

Microsoft operates a separate outbound IP pool for messages it classifies as lower quality or potential spam. Delivery from this pool is not guaranteed because some recipient organisations reject mail from those IP addresses. Not all bulk email is sent via this pool — it is used for messages that fail Microsoft's outbound quality assessment.

Can bulk email damage domain reputation?

It can affect the sending reputation associated with your domain. High bounce rates, complaint rates, or authentication failures on your primary business domain may influence how recipient systems treat your normal correspondence.

Should marketing email use a subdomain?

Microsoft recommends it, and it is standard practice for businesses with significant sending volume. A marketing subdomain separates campaign reputation from the domain used for normal business email.

Why use a separate marketing subdomain?

So that campaign sending behaviour — bounce rates, complaint rates, sending patterns — does not affect the reputation of the primary domain your business relies on for customer, supplier and operational email.

Should transactional email use another subdomain?

Potentially yes. Microsoft cites t.example.com for transactional email. Separating transactional and marketing sending means a marketing campaign cannot affect the delivery of password resets, order confirmations or invoices.

Does a separate subdomain guarantee deliverability?

No. A subdomain separates risk; it does not guarantee anything. Recipient systems assess the quality of sending on each domain or subdomain based on authentication, bounce rates, complaints, engagement and other signals.

What is SPF?

Sender Policy Framework (SPF) allows a domain owner to publish in DNS which mail-sending systems are authorised to send email on behalf of that domain. Recipient servers can check whether the sending server is authorised by the domain owner.

What is DKIM?

DomainKeys Identified Mail (DKIM) adds a cryptographic signature to outbound email. Recipients can verify that the signature came from the authorised sending system and that the signed portions of the message were not altered in transit.

What is DMARC?

Domain-based Message Authentication, Reporting and Conformance (DMARC) builds on SPF and DKIM to allow domain owners to specify a policy for messages that fail alignment, request reporting on sending activity, and enforce increasingly strict policies as understanding improves.

Should DMARC be set to reject immediately?

No. Setting p=reject without first using DMARC aggregate reports to identify all legitimate senders may block legitimate email. Monitor first, understand what is genuinely sending as your domain, fix authentication, then move toward enforcement gradually.

Can Word Mail Merge avoid Microsoft sending limits?

No. Mail merge sends individual messages through Exchange Online, which means Microsoft 365 sending limits, outbound-spam controls and domain reputation considerations all still apply.

Can I send bulk mail from a shared mailbox?

The sending infrastructure is still Exchange Online and the domain is still your primary business domain. A shared mailbox does not change the underlying architecture or the associated risks.

Can I BCC hundreds of people?

Microsoft warns against high-volume messages to large BCC lists. Beyond the Exchange Online infrastructure concerns, BCC does not provide unsubscribe handling, suppression, personalisation or campaign analytics.

Is SMTP relay suitable for bulk marketing?

Microsoft provides SMTP relay for devices and applications. It is not designed as a workaround for bulk marketing. A relay changes how mail enters Exchange Online, but it does not remove service limits or reputation considerations.

What is Azure Communication Services Email?

Azure Communication Services (ACS) Email is a Microsoft service designed for transactional, bulk and marketing email at high volume, using custom domains. It is primarily suited to application-to-person sending and may require technical integration and domain configuration.

Can Azure Communication Services send marketing email?

Microsoft's documentation describes ACS Email as supporting marketing email. It requires appropriate setup, domain configuration and monitoring, and is distinct from Exchange Online.

What is a suppression list?

A suppression list is a record of contacts who should not receive further email — unsubscribes, previous objections, hard bounces and complaints. It is the mechanism that ensures "do not contact" instructions are honoured permanently, even if that contact reappears in a new data import.

Why do email bounces matter?

High bounce rates signal to recipient systems that you are sending to addresses that do not exist or are invalid — a characteristic of poor data quality or spam. Microsoft specifically recommends removing invalid addresses from bulk databases before sending.

What should I do if Microsoft restricts a mailbox?

Investigate the cause before removing the restriction. A restricted mailbox may indicate a compromised account, an intentional bulk campaign, malicious forwarding, or application activity. Find the root cause, fix it, then remove the restriction.

How can I tell if bulk mail is causing delivery problems?

Use Microsoft 365 Message Trace to check whether messages are being accepted and routed. Review the Restricted Entities page. Check outbound-spam alerts and protection reports. Review bounce and complaint rates from the campaign platform. Monitor DMARC aggregate reports for authentication failures.

Can Altitude configure SPF, DKIM and DMARC?

Yes. Altitude IT can review and configure email authentication for Microsoft 365 tenants and associated domains, including SPF, DKIM and DMARC, across Manchester and the North West.

Can Altitude review our bulk-email infrastructure?

Yes. Altitude can review your Microsoft 365 tenant, domains, DNS, authentication configuration and sending architecture before a campaign and recommend how to separate campaign traffic from normal business email.

Can Altitude work with our marketing agency?

Yes. Altitude IT handles the technical infrastructure — domains, DNS, Microsoft 365 configuration, authentication — while marketing teams and agencies manage campaign strategy, content and platform. The two roles are complementary.