Warming up a new Microsoft 365 account for cold email has four steps that are different from warming up a Google Workspace inbox — and getting any one of them wrong adds weeks to the warmup timeline or produces a permanently Medium Postmaster reputation rather than Good. The DKIM configuration for MS365 uses CNAME records (not TXT records as in GWS). SNDS monitoring replaces Postmaster as the primary health signal for Outlook delivery. And the token expiry behaviour means warmup tool connections can silently drop without you noticing. This guide covers the MS365-specific warmup process step by step.
MS365 Warmup — Quick Reference
Phase | Days | Warmup Sends/Day | Campaign Sends | SNDS Target |
|---|---|---|---|---|
Phase 1 — DNS and Setup | 1–7 | 10–20 | None | Green (confirm before warmup starts) |
Phase 2 — Reputation Build | 8–28 | 20–40 | None until Day 21 check | Green — sustained |
Phase 3 — Ramp | 29–42 | 20–30 | 15–35 (after Day 28 gate check) | Green — sustained |
Phase 4 — Full Operation | 43+ | 15–20 ongoing | 40–50 | Green — monitored weekly |
💡 Skip All of This
Pre-warmed MS365 inboxes from Litemail arrive at Phase 4 equivalent — Green SNDS, Good or High Postmaster within 48 hours, DKIM both selectors verified, $4.99/inbox. If you need MS365 cold email running this week, skip to the bottom. If you have 6 weeks, this schedule works.
MS365 Warmup Prerequisites — Before Day 1
These four items must be complete and verified before any warmup activity starts. Starting warmup with any one of these incomplete wastes the entire warmup period.
☐SPF — Add TXT Record to DNS
At your domain registrar, add: v=spf1 include:spf.protection.outlook.com -all. One SPF TXT record per domain only. Verify via mxtoolbox.com SPF Lookup — must show Pass before proceeding. See SPF record not working fix guide if verification fails.
☐DKIM — Add Both CNAME Records
Go to Microsoft 365 Defender → Email authentication → DKIM → select your domain → Enable. Microsoft shows you two CNAME records (selector1 and selector2) to add at your registrar. Add both. Verify both pass via mxtoolbox.com DKIM Lookup with selector1 and selector2. DKIM for MS365 uses CNAME records — not TXT. This is the most common MS365 DKIM error.
☐DMARC — Add TXT Record
Add: v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@yourdomain.com. Verify via mxtoolbox.com DMARC Lookup. p=quarantine minimum before campaigns. rua address receives daily aggregate reports showing any authentication failures or spoofing attempts. See SPF, DKIM, DMARC complete setup guide.
☐SNDS — Register Sending IPs
Go to postmaster.live.com → SNDS. Register the IPs your MS365 inboxes send from. For Litemail pre-warmed inboxes, dedicated IP addresses are provided on delivery. Confirm Green status before starting warmup. Also register for JMRP at postmaster.live.com/snds/JMRP.aspx for individual complaint notifications.
Phase 1 — DNS Verification and First Sends (Days 1–7)
Days | Warmup Sends | Action |
|---|---|---|
1–2 | 10/day | Confirm warmup tool connected. Send a test email to Gmail — check SPF, DKIM, DMARC all show PASS in Show Original headers. |
3–5 | 15/day | Check SNDS daily — confirm Green. Check postmaster.google.com — data may not appear until Day 5–7 (normal for new MS365 domain). |
6–7 | 20/day | Day 7 check: SNDS Green, mxtoolbox.com all three records passing. If any check fails — fix DNS before proceeding to Phase 2. |
MS365 differs from GWS here: Postmaster Tools data appears more slowly for MS365 inboxes than for GWS, because Postmaster tracks Google-ecosystem sends specifically. SNDS is the primary early health indicator for MS365 warmup — not Postmaster. Check SNDS daily in Phase 1.
Phase 2 — Reputation Build (Days 8–28)
Days | Warmup Sends/Day | Campaign Sends | Key Checks |
|---|---|---|---|
8–14 | 25 | None | SNDS daily — must stay Green. Postmaster checking every 3 days — watching for Medium to Good transition. |
15–21 | 35 | None until Day 21 gate check | Day 21 gate check: Postmaster showing Good or High? SNDS Green? Both required before Phase 3. |
22–28 | 40 | 10–15 (if gate check passed) | Monitor bounce rate on campaign sends — must stay under 2%. |
✅ Day 21 Gate Check
Postmaster must show Good or High. SNDS must show Green. Both required to proceed. If Postmaster is still Medium or Unknown at Day 21 — check DKIM is passing for both selectors. DKIM failure is the most common cause of delayed Postmaster reputation appearance for MS365 inboxes. See DKIM configuration guide if troubleshooting.
Warmup Tools for MS365
MS365 accounts connect to warmup tools via Modern Authentication (OAuth). Legacy Authentication (SMTP/IMAP with username/password) is deprecated by Microsoft — warmup tools that require Legacy Authentication will not work reliably with new MS365 accounts in 2026.
Warmup Tool | MS365 Connection Method | Cost | Notes |
|---|---|---|---|
Instantly (built-in warmup) | Modern Auth / OAuth | Included with Instantly plan | Best option if using Instantly for campaigns — same platform, no extra cost |
Smartlead (built-in warmup) | Modern Auth / OAuth | Included with Smartlead plan | Per-inbox warmup stats visible — good for monitoring |
Mailreach | Modern Auth / OAuth | $25–$69/month | Standalone warmup tool; good network quality |
Lemwarm | Modern Auth / OAuth | $29–$49/month | Integrated with Lemlist; works standalone too |
MS365-Specific Issue — OAuth Token Expiry
MS365 OAuth tokens expire more frequently than GWS tokens, particularly when Azure AD conditional access policies are active. An expired warmup tool token means warmup sends stop silently. After 7–14 days of no warmup activity, Postmaster reputation can drift from Good to Medium without any campaign sends generating complaints — purely from the shift to outbound-only pattern.
Check weekly: open your warmup tool or sending platform, confirm the MS365 inbox shows Connected rather than Disconnected or Reconnect Required. Reconnecting via OAuth takes under 2 minutes. Build this check into your weekly SOP so token expiry is caught before it becomes a 7-day warmup gap that affects reputation. All Litemail MS365 inboxes are delivered with Modern Authentication enabled and no conflicting admin policies that cause frequent token expiry.
Phase 3 and Phase 4 — Ramp to Full Operation
Days | Warmup/Day | Campaign Sends/Day | Total per Inbox |
|---|---|---|---|
29–35 | 25 | 20 | 45 |
36–42 | 20 | 30 | 50 |
43+ (ongoing) | 15–20 | 40–50 | 55–70 — monitor SNDS weekly for any Yellow movement |
Keep warmup running at 15–20 sends per day indefinitely alongside campaigns. This maintains the mixed send/receive pattern that sustains SNDS Green and Postmaster Good during active campaign periods. Stopping warmup at Phase 4 is the most common cause of gradual MS365 deliverability degradation starting 4–8 weeks after launch.
MS365 vs GWS Warmup — Key Differences
Warmup Aspect | MS365 | GWS |
|---|---|---|
DKIM record type | CNAME (selector1 + selector2) | TXT (google._domainkey) |
Primary health monitor | SNDS (IP-level) + Postmaster | Postmaster (domain-level) |
OAuth token stability | More frequent expiry — check weekly | More stable — less frequent disconnections |
Postmaster data appearance | Slower — less Gmail-ecosystem sends in warmup network | Faster — warmup sends mostly Gmail-addressed |
Delivery advantage for Outlook | 8–12% better primary Outlook placement | 8–12% worse primary Outlook placement |
Why Pre-Warmed MS365 Inboxes Skip This Entire Process
Every step in this guide exists to build the sending history and reputation that Litemail pre-warmed MS365 inboxes already have when they arrive. DKIM both selectors are configured as CNAME records and verified passing. SNDS is Green on dedicated IPs. Postmaster shows Good or High within 48 hours. SPF and DMARC are pre-configured. The 4–6 week warmup schedule is a solved problem.
At $4.99/inbox from litemail.ai, the pre-warmed inbox is cheaper than the warmup tool subscription for a self-managed warmup, faster than 6 weeks of waiting, and has zero failure rate at the Day 21 gate check. For MS365 cold email that needs to start this week rather than next month, the choice is straightforward.
Complete MS365 Warmup Checklist
☐SPF TXT record added and verified passing — mxtoolbox.com☐DKIM enabled in MS365 Defender — both selector1 and selector2 CNAME records added and verified PASS☐DMARC TXT record added at p=quarantine with rua address☐SNDS IPs registered and showing Green before warmup Day 1☐Warmup tool connected via Modern Auth (OAuth) — not SMTP☐SNDS checked daily through Phase 1 and 2☐Day 21 gate check: Postmaster Good or High + SNDS Green — both required before campaign sends☐OAuth connection status checked weekly — confirm Connected not Disconnected☐Warmup kept running at 15–20/day indefinitely after campaign launch
Frequently Asked Questions
How do I warm up a new Microsoft 365 account for cold email?
Four MS365-specific prerequisites before warmup starts: add SPF TXT record (v=spf1 include:spf.protection.outlook.com -all), enable DKIM in Microsoft 365 Defender and add both selector1 and selector2 CNAME records (not TXT — MS365 DKIM uses CNAME), add DMARC TXT record at p=quarantine, and register your sending IPs in Microsoft SNDS. Then connect a warmup tool via Modern Auth (OAuth) and follow the 6-week phase schedule. Or order a Litemail pre-warmed MS365 inbox at $4.99 — all of this is pre-configured on delivery, campaign-ready in 24 hours.
How long does Microsoft 365 email warmup take?
4–6 weeks for a new MS365 account with correct DNS, a real-engagement warmup tool connected via Modern Auth, and a domain over 30 days old. The Day 21 gate check (Postmaster Good + SNDS Green) gates campaign send start — failing this check extends the warmup another 7–14 days. Pre-warmed MS365 inboxes from Litemail skip the warmup entirely — Good or High Postmaster and Green SNDS on delivery, campaign-ready in 24 hours at $4.99/inbox.
What is the correct DKIM setup for Microsoft 365 cold email?
MS365 DKIM uses CNAME records — not TXT records. Enable DKIM in Microsoft 365 Defender → Email authentication → DKIM → select your domain → Enable. Microsoft generates two CNAME records (selector1._domainkey.yourdomain.com and selector2._domainkey.yourdomain.com) to add at your DNS registrar. Add both. Verify both pass via mxtoolbox.com DKIM Lookup using selector1 and selector2 as the selector values. Both must show PASS before warmup begins — and must remain passing indefinitely during campaign sends.
Why is my Microsoft 365 Postmaster reputation still Unknown after 2 weeks of warmup?
Two most common causes: DKIM is broken (verify both selector1 and selector2 via mxtoolbox.com — any failure means warmup sends are not being attributed to your domain correctly in Google's systems), or the warmup tool has insufficient Gmail-addressed sends in its network (Postmaster needs Gmail recipients to show data). Check DKIM first — it's the cause in the majority of Unknown Postmaster cases after 14+ days of warmup. Also check that the warmup tool is connecting via Modern Auth rather than SMTP.
What warmup tool works best with Microsoft 365?
Any warmup tool that connects via Modern Authentication (OAuth) — not Legacy Authentication (SMTP/IMAP with username/password). Instantly and Smartlead include built-in warmup for connected MS365 inboxes at no extra cost. Mailreach and Lemwarm are standalone options connecting via Modern Auth. SMTP-based warmup tools are increasingly unreliable with new MS365 accounts as Microsoft continues deprecating Legacy Authentication. All of these work correctly with Litemail pre-warmed MS365 inboxes.
Why does my Microsoft 365 warmup tool keep disconnecting?
MS365 OAuth tokens expire more frequently than GWS — particularly when Azure AD conditional access policies are active. A disconnected warmup tool means warmup sends stop silently. Check warmup tool and platform connection status weekly — confirm every MS365 inbox shows Connected rather than Reconnect Required. Reconnecting takes under 2 minutes via OAuth. If disconnections are frequent (weekly), check Azure AD for conditional access policies revoking tokens on a short cycle and extend the token lifetime.
Should I use Microsoft 365 or Google Workspace for cold email warmup?
Use both in a 60/40 GWS/MS365 split for most B2B cold email. MS365 delivers 8–12% better to Outlook and Microsoft 365 corporate recipients. GWS delivers 8–12% better to Gmail and Google Workspace recipients. A mixed pool outperforms either platform alone on mixed B2B lists. Litemail provides both GWS and MS365 pre-warmed inboxes at $4.99/inbox — litemail.ai/pre-warmup — no minimum order, 24-hour delivery.
Do pre-warmed Microsoft 365 inboxes need warming up?
No — pre-warmed MS365 inboxes from Litemail arrive with warmup history already built. Good or High Postmaster within 48 hours, Green SNDS on dedicated IPs, both DKIM selectors verified, SPF and DMARC pre-configured. Start campaign sends from day one of delivery. Enable the sending platform's built-in warmup at 15–20 sends per day per inbox for ongoing reputation maintenance — not initial warmup. This maintains Good Postmaster and Green SNDS throughout the active campaign period. $4.99/inbox at litemail.ai.
Skip MS365 Warmup — Pre-Warmed Inboxes from $4.99
Litemail pre-warmed MS365 inboxes arrive with DKIM both selectors configured as CNAME records and verified, Green SNDS on dedicated IPs, Good or High Postmaster within 48 hours, SPF and DMARC pre-configured. No 6-week warmup. No token disconnection troubleshooting. No Day 21 gate check failures. $4.99/inbox, no minimum order.
Get Pre-Warmed MS365 Inboxes from $4.99 →Both DKIM selectors verified · Green SNDS · Good/High Postmaster · Dedicated US and EU IPs · 24hr delivery
About Litemail — Pre-warmed GWS and MS365 inboxes from $4.99/inbox. Automated DNS, dedicated US and EU IPs, full admin access. litemail.ai · View plans →
Related reading: MS365 Inbox Rotation for Cold Email 2026 · Cold Email Inbox Warmup Schedule: 60 Days · SPF, DKIM, DMARC Auto-Setup 2026 · Email Warm-Up vs Pre-Warmed Inboxes 2026 · Best Pre-Warmed Inbox Providers 2026 · Litemail Pre-Warmed Inboxes — Plans and Pricing
