Outlook.com SMTP at a glance
Outlook.com — the consumer mail service at @outlook.com, @hotmail.com, and @live.com — uses smtp-mail.outlook.com on port 587 with STARTTLS. The hostname is different from Microsoft 365 business mailboxes (which use smtp.office365.com) even though both run on the Microsoft cloud backend.
The other thing to know up front: POP and IMAP are disabled by default on Outlook.com accounts. SMTP works without any toggle, but if you want a client to also read the inbox, you have to flip POP/IMAP on inside Outlook.com web settings before any client will connect. Most people running into "Outlook.com isn't working" issues with a third-party client have hit exactly this — the client connects fine for sending and silently fails for receiving.
Outlook.com vs Microsoft Outlook vs Microsoft 365
The naming is confusing on purpose. Three different things share the Outlook brand:
- Outlook.com — the free webmail service. This page is about Outlook.com.
- Microsoft Outlook — the desktop email client (the application you install on Windows or Mac). The desktop client can connect to Outlook.com, Microsoft 365, Gmail, or any other IMAP/SMTP server.
- Microsoft 365 — the business cloud service that includes Exchange Online mailboxes. Different SMTP host (
smtp.office365.com), different limits, different auth posture.
If your email address ends in @yourcompany.com and the company uses Microsoft 365, you want the Microsoft 365 SMTP settings. If your email ends in @outlook.com, @hotmail.com, @live.com, or @msn.com, this is the page.
Step-by-step Outlook.com SMTP setup
1. Enable POP/IMAP if you need to read mail in the client
SMTP submission works without any setting changes — Outlook.com accepts authenticated SMTP from third-party clients out of the box. But IMAP and POP are off by default. To enable them:
- Sign in at outlook.com
- Settings (gear icon) → Mail → Sync email
- Toggle POP or IMAP on
If you only want to send through Outlook.com from a client and don't care about reading, skip this. SMTP-only configurations are valid.
2. Generate an app password if 2FA is on
If two-step verification is enabled on your Microsoft account (and it should be), your normal account password won't work for third-party clients connecting via SMTP. You need an app password.
- Go to account.live.com → Security
- Advanced security options → App passwords
- Create a new app password, copy it
That 12-character password is what you'll paste into the client's SMTP password field, not your real Microsoft account password. If you don't have 2FA on, you can use the regular password — but you should turn 2FA on.
3. Configure outgoing SMTP
- SMTP server:
smtp-mail.outlook.com - Port:
587 - Encryption: STARTTLS
- Authentication: required
- Username: full Outlook.com email address (yourname@outlook.com)
- Password: app password from step 2 (or the account password if 2FA is off)
4. Configure incoming IMAP
- IMAP server:
outlook.office365.com - Port:
993 - Encryption: SSL/TLS
- Username and password: same as SMTP
Note the IMAP hostname is outlook.office365.com, not imap-mail.outlook.com. Outlook.com migrated its consumer mailboxes onto the Microsoft 365 backend years ago, so the IMAP and POP3 hostnames point at the M365 infrastructure even though the SMTP submission server is still on a consumer-facing hostname.
5. Send a test message
Send a test email from the client to a different address you control. Confirm it arrives. If it fails on the SMTP step, the issue is almost always the password (you used the account password instead of an app password, or vice versa). If it succeeds for sending but the inbox shows nothing, IMAP or POP isn't enabled in Outlook.com web settings.
Why some old guides say smtp.live.com or smtp.office365.com
Outlook.com's SMTP host has shifted over the past decade as Microsoft consolidated the consumer mail backends. Some legacy accounts still authenticate against smtp.live.com, and a small fraction of accounts that started on enterprise mail and got migrated to Outlook.com authenticate against smtp.office365.com.
The current canonical host for new accounts is smtp-mail.outlook.com. If that hostname rejects authentication for a specific account, sign in at outlook.com → Settings → Mail → Sync email and look at "POP and IMAP" — Microsoft displays the actual hostnames the account is using. Use whatever shows there. Trying every Microsoft SMTP hostname in sequence is faster than searching forums.
Common Outlook.com SMTP errors
Authentication failed even with the right password. 2FA is on and you're using the account password instead of an app password. Generate an app password at account.live.com.
Mail sends but inbox is empty in the client. POP/IMAP is disabled in Outlook.com web settings. Enable it under Settings → Mail → Sync email.
"Mailbox is locked." Microsoft sometimes locks accounts after too many failed authentication attempts from new clients. Sign in to outlook.com via the web, complete any security challenges, then try the client again. The lock usually clears within a few minutes once the account confirms it's actually you.
Hostname not found / DNS error. You're trying smtp.outlook.com. The correct hostname is smtp-mail.outlook.com with the hyphen and "mail" prefix.
Sending limits — the consumer cap nobody talks about
Outlook.com consumer accounts cap outbound SMTP submission at roughly 300 messages per 24 hours. Microsoft doesn't publish this number prominently, and the cap moves around — accounts with longer history and clean reputation get more headroom, brand-new accounts get less.
Three hundred messages per day is fine for personal use. It's catastrophic for any business outbound. There is no path to raise the cap on a consumer Outlook.com account. Microsoft's answer if you need higher volume is "buy a Microsoft 365 plan," which gives you a real Exchange Online mailbox with a 10,000-recipient daily cap.
Outlook.com SMTP for cold outreach — the very honest answer
Don't. Outlook.com is a consumer mail service. The 300-message daily cap, the shared reputation across the entire @outlook.com / @hotmail.com / @live.com space, and the lack of any reputation isolation make it actively dangerous for cold outbound.
The reputation point matters most. When Outlook.com filters evaluate sender reputation, they look at the domain. There is one outlook.com domain, shared by every consumer Outlook.com account in the world. Whatever the worst sender on outlook.com is doing this week affects how filters at Gmail, Yahoo, and other providers treat your messages. You don't get to opt out of that shared reputation by being a careful sender — you inherit it.
Cold email at scale needs reputation isolation: dedicated sending domains you own, dedicated inboxes you control, separated from any other tenant's behavior. The standard pattern is many sending domains × two to three inboxes per domain × 15-25 cold messages per day per inbox after warmup × 2:1 warmup-to-cold ratio enforced inside your sequencer.
If you're configuring Outlook.com for personal mail, this page tells you exactly what to enter. If you're configuring it because someone suggested it for cold outreach, find a different infrastructure. ScaledMail provisions real Google Workspace and Microsoft 365 mailboxes on dedicated cold-email domains — purpose-built for outbound, isolated from your production identity, monitored as a managed service.