Your setup sounds pristine on paper-and that's exactly why this hurts so much. The email equivalent of a perfectly wrapped gift that never arrives. SPF, DKIM, DMARC all green? Microsoft isn't rejecting you, it's swallowing your messages at the gateway before they even sniff a junk folder. The silence is the giveaway.
On domain age: yes, that's the core culprit. Microsoft Defender's machine learning basically sees a baby domain-four to six weeks old-suddenly blasting cold sequences into corporate tenants. Zero historical web traffic, zero inbound volume. To its algorithms, that's a burner domain built for phishing, so it silently drops the packets. The 90-day threshold is real, and it's ruthless.
Does M365-to-M365 help? Ironically, it makes it worse when your domain is fresh. Sending from Outlook to Outlook usually skates past basic filters, but here you're hitting Defender on both ends. It has a unified view of tenant health-so it sees a brand-new tenant with zero internal business chatter suddenly firing cold emails to other enterprises. Domain age and lack of history override any internal trust benefit.
Recovery options: either play the long game or buy time. The slow burn means killing all cold sequences, leaving those accounts strictly in a warmup pool for another four to six weeks. Let the domain clear that 60-90-day aging barrier while building natural, threaded conversations in the warmup. If your client needs pipeline now, you'll need aged domains-minimum six months old with clean history. Ramp those up over two weeks and restart.
GlockApps is useful, but you have to read the right data. It tells you if you're hitting inbox or junk on consumer Hotmail/Outlook. Enterprise M365 Defender (Plan 1 or 2) is a whole different beast-way more aggressive. If your Outlook seeds show 100% missing/undelivered, you're sitting in the silent gateway quarantine. Stop the sequences now, before you permanently burn the IP and domain rep. Let them age, or swap to aged domains. No way around it.
