Most MS365 cold email campaign failures are preventable. They trace back to something that wasn't checked before the first send: a DKIM CNAME record that was configured incorrectly and never verified, a bounce rate that wasn't capped at the platform level, or a list that wasn't verified and pushed the sending domain to Low Postmaster reputation on day one. This checklist covers every item to verify before launching any MS365 cold email campaign — for new inboxes on new sending domains, and for re-launches from established infrastructure.
The MS365 Campaign Launch Checklist
💡 TL;DR
Before any MS365 cold email campaign sends: confirm DKIM CNAME records published and DKIM signing enabled in Microsoft 365 Defender, SPF record published with correct include for MS365, DMARC record published at minimum p=none, test email headers show spf=pass dkim=pass dmarc=pass, Postmaster domain reputation Good/High (or wait), Microsoft SNDS IP status Green, sending platform per-inbox volume cap set to 40–50 emails/day, bounce rate pause trigger configured at 1.8%, list verified (NeverBounce/ZeroBounce), and List-Unsubscribe header injection confirmed active. Litemail pre-warmed MS365 inboxes ($4.99/inbox) pass the DNS and reputation items automatically.
Here's every item expanded — what to check, how to check it, and what to do if it fails.
DNS Authentication Checklist — 4 Items
✓ Item 1: DKIM CNAME Records Published
MS365 DKIM uses CNAME records — not TXT records. Check your DNS registrar for CNAME records at selector1._domainkey.yourdomain and selector2._domainkey.yourdomain. Both must exist. Verify: MXToolbox DKIM check at mxtoolbox.com/dkim — enter sending domain and selector1. Result must show DKIM: PASS. If fails: Generate CNAME values in Microsoft 365 Defender → Email Authentication Settings → DKIM → select domain. Publish both CNAMEs in DNS. Wait 15–60 minutes for propagation.
✓ Item 2: DKIM Signing Enabled in MS365 Defender
Publishing the CNAME records is step one. Enabling DKIM signing in Microsoft 365 Defender is step two — and it's commonly skipped. Verify: Log into security.microsoft.com → Email Authentication Settings → DKIM → confirm your sending domain shows Enabled. If shows Disabled: Click the domain, toggle to Enabled. If the toggle is greyed out, CNAME propagation is incomplete — wait and retry.
✓ Item 3: SPF Record Published and Passing
Verify: MXToolbox SPF check for sending domain. Must show SPF: PASS (not SOFTFAIL or PERMERROR). Check that only one SPF TXT record exists on the domain. Correct MS365 SPF record: v=spf1 include:spf.protection.outlook.com -all. If PERMERROR: Multiple SPF records exist — merge into one. If SOFTFAIL: Change ~all to -all.
✓ Item 4: DMARC Record Published
Verify: MXToolbox DMARC check for sending domain. A DMARC record must exist. Minimum acceptable: v=DMARC1; p=none. If missing: Add TXT record at root of sending domain: v=DMARC1; p=none; rua=mailto:postmaster@yoursendingdomain.com.
Inbox Reputation Checklist — 3 Items
✓ Item 5: Test Email Headers Show All Three Passing
Send a test email from each sending inbox to a Gmail address you control. Open → three dots → Show Original. Find the Authentication-Results header. Must read: spf=pass dkim=pass dmarc=pass. Any FAIL: Identify which record is failing (SPF, DKIM, or DMARC) and return to the DNS checklist items above. Do not launch campaigns with any authentication failure.
✓ Item 6: Google Postmaster Domain Reputation Good or High
Add all sending domains to postmaster.google.com. After 24–48 hours of sending history (or immediately for pre-warmed inboxes), check domain reputation. Must show Good or High. If Unknown: For pre-warmed Litemail inboxes, recheck after 48 hours — Good/High appears within this window. For fresh inboxes, Unknown is the starting state — warm-up is required before campaigns. If Medium or Low: Do not launch campaigns. Investigate bounce rate and complaint data.
✓ Item 7: Microsoft SNDS IP Status Green
For MS365 inboxes specifically: request access for your sending IP addresses at sendersupport.microsoft.com/snds. Check IP status before launch. Must show Green. If Yellow: Reduce warm-up or pre-campaign send volume, wait 7 days, recheck. If Red: Do not launch — contact Litemail support (IP reputation is covered under delivery guarantee for Litemail inboxes).
Sending Platform Checklist — 4 Items
✓ Item 8: Per-Inbox Daily Volume Cap Set
In Instantly or Smartlead, confirm each inbox has a per-inbox daily send limit set at the account level. Target: 40 emails/inbox/day for MS365 inboxes. Do not rely on campaign-level limits only — inbox-level limits enforce an absolute ceiling regardless of campaign configuration changes.
✓ Item 9: Bounce Rate Pause Trigger Configured
Confirm an automated pause trigger is configured in your sending platform for any inbox exceeding 1.8% bounce rate per day. In Instantly: Settings → Campaigns → Bounce Protection. In Smartlead: per-inbox settings → bounce threshold. If not configured: Set it before launch. This is the single most important automated protection for sending reputation.
✓ Item 10: Send Delay Randomisation Enabled
Confirm 3–7 minute randomised delay between sends from each inbox. Batch sending (40 emails in 30 minutes) looks automated. Distributed sending across business hours looks like normal human activity. Check platform inbox settings — randomised delay should be enabled on every inbox in the campaign pool.
✓ Item 11: List-Unsubscribe Header Injection Active
For bulk senders (5,000+ emails/day to Gmail), Google requires one-click List-Unsubscribe headers. Check your platform settings for List-Unsubscribe or one-click unsubscribe toggle — confirm it's enabled. This should be enabled regardless of volume; it reduces spam complaints by making opt-out frictionless.
List and Compliance Checklist — 2 Items
✓ Item 12: List Verified Before Upload
Run the prospect list through NeverBounce or ZeroBounce before uploading to your sending platform. Remove all invalid addresses, role-based addresses (info@, admin@, support@), and previous opt-outs. Target: under 1% estimated invalid rate after verification. If the list is over 3% estimated invalid: Consider the data source quality — this level of invalid rate will push bounce rate into the danger zone within the first campaign day.
✓ Item 13: Suppression List Applied
Check every new list against your permanent suppression file before upload. Suppression file should include: all previous opt-outs, all previous hard bounces, and any contacts who have indicated they don't want contact. Sending to a previous opt-out is a CAN-SPAM violation and generates immediate spam complaints.
MS365 Inboxes That Pass This Checklist on Delivery
Litemail pre-warmed MS365 inboxes — DKIM, SPF, DMARC configured automatically, Good/High Postmaster within 48 hours, Green SNDS status. DNS and reputation items on this checklist handled before delivery.
Get Pre-Warmed MS365 Inboxes from $4.99 →
Automated DNS · Green SNDS · Good/High Postmaster · No minimum order · Delivered in 24 hours
About Litemail — Litemail provides pre-warmed Google Workspace and Microsoft 365 inboxes for cold email outreach. From $4.99/inbox with automated DNS, dedicated US and EU IPs, and full admin access. View pre-warmed inbox plans →
Related reading:
DKIM Setup for MS365 Cold Email 2026 · Troubleshooting MS365 Cold Email · MS365 Cold Email Suspension: How to Avoid It · Cold Email Compliance Audit 2026 · Best Pre-Warmed Inbox Providers 2026 (Ranked)
Key Takeaways
The 13-item MS365 campaign launch checklist covers: DKIM CNAME published, DKIM signing enabled in Defender, SPF PASS, DMARC published, test email headers all passing, Postmaster Good/High, Microsoft SNDS Green, per-inbox volume cap set (40/day), bounce rate pause trigger at 1.8%, send delay randomisation active, List-Unsubscribe injection enabled, list verified, and suppression list applied.
MS365 DKIM requires two separate steps: publishing CNAME records in DNS and enabling DKIM signing in Microsoft 365 Defender. Completing one without the other results in DKIM FAIL. Both must be done.
The test email header verification (spf=pass dkim=pass dmarc=pass in Gmail Show Original) is the single fastest way to confirm the first four checklist items simultaneously — if all three pass in headers, DNS is configured correctly.
Configure bounce rate pause triggers at 1.8% per inbox in your sending platform before launch. This automated protection prevents a bad list segment from degrading a good domain reputation before you notice it manually.
Litemail pre-warmed MS365 inboxes pass the DNS and reputation items (Items 1–7) on delivery — automated DKIM, SPF, DMARC configuration plus Good/High Postmaster and Green SNDS from genuine pre-warming history.
Frequently Asked Questions
What should I check before launching a Microsoft 365 cold email campaign?
13 items across four categories: DNS authentication (DKIM CNAME published, DKIM signing enabled in MS365 Defender, SPF PASS, DMARC published), inbox reputation (test email headers all passing, Postmaster Good/High, SNDS Green), sending platform configuration (per-inbox volume cap, bounce rate pause trigger, send delay randomisation, List-Unsubscribe injection), and list preparation (verification completed, suppression list applied). All 13 must pass before sending the first campaign email.
Why is Microsoft SNDS part of the campaign launch checklist?
Microsoft SNDS shows the reputation of your sending IP addresses for Outlook and Exchange recipients — the segment where MS365 inboxes have their specific advantage. A Yellow or Red SNDS status means Microsoft is treating your sending IP with suspicion or actively filtering email from it, regardless of what Postmaster Tools shows. SNDS check is specifically relevant for MS365 inboxes and the Exchange-heavy recipient populations they're optimised for.
What's the fastest way to verify MS365 DKIM is configured correctly?
Send a test email from the inbox to a Gmail address and view the headers (Show Original). Find the Authentication-Results line. If it shows dkim=pass — DKIM is correctly configured and working. If it shows dkim=fail or no DKIM result — check that both CNAME records are published in DNS and that DKIM signing is enabled in Microsoft 365 Defender for the sending domain.
MS365 Inboxes That Pass 7 of 13 Checklist Items on Delivery
Litemail pre-warmed MS365 inboxes — $4.99/inbox, automated DKIM/SPF/DMARC, Good/High Postmaster within 48 hours, Green SNDS status, dedicated US and EU IPs. The DNS and reputation items handled before delivery — you configure the platform settings and list preparation. No minimum order. Delivered in 24 hours.
Get Pre-Warmed MS365 Inboxes from $4.99 →
No minimum order · Automated DKIM/SPF/DMARC · Good/High Postmaster · Green SNDS · US and EU IPs included
About Litemail — Litemail provides pre-warmed Google Workspace and Microsoft 365 inboxes for cold email outreach. From $4.99/inbox with automated DNS setup, dedicated US and EU IPs, 4 to 12 weeks of genuine warm-up history, and full admin access. View pre-warmed inbox plans →
Related reading: DKIM Setup for MS365 2026 · MS365 Cold Email Suspension: How to Avoid It · Best Pre-Warmed Inbox Providers 2026 (Ranked)
