BLOG
What we have learned provisioning Microsoft 365 inboxes for outbound teams: authentication that actually passes, sending volume that holds up, and the setup mistakes that quietly cost you replies.
Most people pay for a sequencer before they have sent a single campaign. The first month teaches you what you need from one, and it can be done without paying.
The mailbox signs in fine, then Microsoft asks for an administrator. One sign-in as the Global Admin fixes it for every mailbox in the tenant.
The CNAMEs are published and resolve everywhere you check. Exchange still says they do not exist. Usually it is only behind, and it catches up in minutes.
The password is right and Microsoft accepts it. Then it refuses the sign-in anyway. That is Security Defaults, and since July 2026 it blocks device code sign-in too.
Microsoft publishes a tenant limit that starts near 10,000 external recipients a day. The tenant we measured started refusing at about 1,000.
Gmail put it in the primary inbox. Outlook.com put the same message in Junk, with every authentication check passing. That is not a contradiction, and it is not a DNS problem.
The password is right and every mailbox still fails. When a whole tenant refuses SMTP sign-in, it is almost never the passwords.
You can register a domain and point a sequencer at it in an afternoon. Three separate clocks decide whether anything it sends that afternoon arrives.
Google publishes a daily ceiling and it is far larger than anything you should send. The ceiling is where Google stops accepting mail, not where recipients stop trusting it.
Google will happily create a tenth sending account on your domain. The domain is what carries the reputation, and that is the reason to stop at three.
Buying tenants is easy. Buying tenants that can actually send, from someone who hands you the admin credentials, is the part worth getting right.
Twelve steps stand between a bare tenant and a mailbox that can send. Skipping any one of them produces mailboxes that exist and cannot deliver.
Microsoft lets you add hundreds of domains to one tenant. For cold email the right number is one, and the reason is what happens when a domain burns.
The error says the sending IP is restricted. It is not your IP, it is not your configuration, and checking either is a waste of an afternoon.
Most first campaigns fail at a step that was skipped, not at the writing. Here is the order the steps go in, how long each one takes, and the numbers that tell you whether the first month worked.
The addresses come from three places, and none of them is a file someone sells you. How each source works, what it costs in time and money, how to verify what you found, and how many contacts a domain actually needs.
Warm-up is the part of cold email infrastructure everyone agrees on and almost nobody measures. Here is the schedule that works on Microsoft 365, what reputation is actually made of, and a week of our own bounce data that shows the one failure warm-up does not touch.
Everyone checks the domain. Almost nobody asks which Microsoft 365 tenant their mailboxes sit in, and that is where a ceiling and a reputation are quietly shared with strangers.
Both platforms send mail. They do not behave the same way when the mail is cold, the recipient is on Outlook, and you need a hundred mailboxes rather than five.
People switch sending platforms hoping to fix deliverability and are surprised when nothing changes. The sequencer was never the part that decided placement.
Deliverability is not one setting. It is roughly thirty small things, and the campaigns that fail usually have twenty-eight of them right.
Most replies arrive after the first message. That fact is used to justify sequences that are far too long, sent by people who have confused persistence with volume.
The single most expensive mistake in outbound is sending cold mail from the domain your invoices and contracts go out on. Reputation damage there is not recoverable on a useful timescale.
Inserting a first name is not personalization. Every tool has done it for a decade and every recipient knows. What works costs more and scales worse.
The platform will let you send thousands. That number tells you nothing about what is safe. The real limit is the point at which a mailbox stops behaving like a person.
Three DNS records decide whether your mail is trusted. Most cold email problems are one of them being absent, malformed, or quietly not doing what the sender assumes.
The subject line decides whether the message is read, but only after something else has decided whether it arrives. Both facts shape what you should write.
The hard part of running a cold email agency is not copy or lists. It is that every new client needs a hundred authenticated mailboxes before a single message goes out.
A template is a structure, not a script. The ones circulating unedited stopped working the month they went viral. What survives is the reasoning underneath.
A cold email is a business message sent to someone who has never heard from you. The word people reach for next is usually spam. The difference is real, and it is not about tone.
One order is 100 Microsoft 365 inboxes on one domain for $30 a month, with SPF, DKIM and DMARC configured and verified before handover. Live in 24 to 48 hours.
Get inboxes