Microsoft Blacklist

Last change on 2021-05-14 • Created on 2020-01-20

Microsoft maintains their own internal blacklists, which are used to reject emails coming from specific IP addresses. Any IPs listed on the Spamhaus blacklist are also blacklisted by Microsoft. As far as we know, this is the only external (DNS-based) blacklist that Microsoft uses. The rest of the blacklisted IPs are based on Microsoft's own criteria. These listings are not very transparent, and unfortunately include a large amount of false positives, as Microsoft will often list larger ranges.

There are two distinct blacklists that Microsoft uses, each for different platforms. One is used by outlook.com, hotmail.com, live.com, and msn.com. The other is used by Office365.

If you receive an error message from Microsoft when sending emails from a server you have with us, please check the error message to find out which blacklist the IP is on. Please make sure your server isn’t sending any spam, and that your IP isn’t listed on any DNS-based blacklists. Please also ensure your emails comply with the Microsoft policies, practices and guidelines found on their website: http://mail.live.com/mail/policies.aspx

Once you have done that, you can follow the instructions below to get your IP delisted.

Outlook

If an IP is listed on the Outlook blacklist, then emails from that IP will be rejected with the following error message:

550 5.7.1 Unfortunately, messages from [x.x.x.x] weren't sent. Please contact your Internet service provider since part of their network is on our block list (S3140). You can also refer your provider to http://mail.live.com/mail/troubleshooting.aspx#errors.

To delist IPs from this blacklist, please fill out the following form: http://go.microsoft.com/fwlink/?LinkID=614866&clcid

Once you have filled the form out, you should get an auto-reply confirming your request. Sometimes it takes just a few minutes to get this auto-reply, but it can also take some hours.

After that, and usually within 12 hours, you will get another reply. This time, you will be informed if the IP has been delisted, which Microsoft calls "mitigated" or "conditionally mitigated". If the email says "not qualified for mitigation," then it means the IP was not delisted.

This email is the result of an automated process at Microsoft. This initial decision was made by a bot, so if the IP doesn’t get delisted, please respond and ask for additional information. When you do so, the ticket will be escalated, and an actual staff member at Microsoft will take a look at your IP. In most cases, they will then manually delist the IP.

If they still refuse to delist the IP, and you’ve only recently been allocated the IP, you should tell them this. They will then require an email or PDF confirmation from us, the ISP, with information on when the IP was allocated. To request this confirmation from us, please contact our support team by opening a support request via your administration interface, and let us know exactly what Microsoft needs.

In those rare cases where all of the above fails, we can fill out the delisting form for your IP. We don't have any special contacts at Microsoft, but their support will sometimes respond differently to a new delisting request. If that doesn’t work for us either, the only solution is to change the IP.

Office365

If an IP is listed on the Office365 blacklist, then emails from that IP will be rejected with the following error message:

550 5.7.606 Access denied, banned sending IP [x.x.x.x]. To request removal from this list please visit https://sender.office.com/ and follow the directions. For more information please go to http://go.microsoft.com/fwlink/?LinkID=526655 (AS16012609)

To delist IPs from this blacklist, please fill out the form linked to in the error message: https://sender.office.com/

The error message also contains a link to the workflow to get the IP delisted: http://go.microsoft.com/fwlink/?LinkID=526655

If you follow the instructions, the IP should be automatically delisted.

Recently, a second type of error message has also been observed for Office365 acounts:

550 5.7.511 Access denied, banned sender[x.x.x.x]. To request removal from this list please forward this message to delist@messaging.microsoft.com. For more information please go to http://go.microsoft.com/fwlink/?LinkId=526653. AS(1410) [VE1EUR01FT060.eop-EUR01.prod.protection.outlook.com]

When you contact the email address mentioned in this message, a reply will tell you to either fill out the Office365 delisting form, or to forward a recent error message:

Please ensure that you have resolved any issues generating malicious or abusive traffic from the IP in question and utilize the portal found at https://sender.office.com/ <https://sender.office.com/> to complete the process of IP removal.

Then please wait for 1-2-hour delay before this change propagates through our entire system. After waiting of 1-2 hour try to send email again.

If you continue to receive Non-Delivery Receipts (NDRs), or "bounce messages," that indicate that the IP address is still blocked by our spam filtering system, please forward one of the most recent and complete error message to us and we will investigate further.

If the Office365 delist form states that your IP isn’t on the blacklist, please forward a recent error message to delist@messaging.microsoft.com. Since we don’t have access to your server, we cannot do this for you.

In those rare cases where Microsoft still won’t delist the IP, please contact our support team by sending a request via the Robot administration interface. We don’t have any special contacts at Microsoft, and we can only fill out the delisting form as well. If that doesn’t work for us either, the only solution is to change the IP.

Microsoft Programs

For advanced users, it can be helpful to join two free programs that Microsoft offers for Outlook (not Office365): the Smart Network Data Services (SNDS) and the Junk Email Reporting program (JMRP).

Neither the SNDS nor the JMRP allow you to delist your IP; they simply provide detailed information about the traffic on your sending IP, the sending IP reputation with Microsoft, and the user complaint rates.

As Microsoft says, there is no silver bullet to maintaining or improving good IP reputation, but these programs help you proactively manage your email eco-system to help ensure better deliverability to Microsoft users.

SNDS

This program allows you to monitor the "health" and reputation of your registered IPs by providing data about traffic such as mail volume and complaint rates seen originating from your IPs. This data is only provided for IPs which send more than 100 emails per day to Microsoft accounts.

To register, please visit: https://sendersupport.olc.protection.outlook.com/snds/

You will need to request authorization for the IPs you would like access to. Microsoft uses a combination of WHOIS and rDNS to check who the owner of a particular IP is. In some cases, you will be able to send an email to your own domain to verify ownership. If that is not the case, you can select one of our email addresses to send the verification email to: info@hetzner.com, abuse@hetzner.com, or postmaster@hetzner.com.

Important note: We will only verify ownership if the name you have signed up for in the SNDS matches the name we have on file for your account.

JMRP

This is similar to a feedback loop (FBL), in that it will send you a copy of an email marked as "junk" by the recipient. However, to prevent listwashing, the JMRP will only send a copy of about 1 out of every 1000 emails marked as junk. This limits the usefulness of the JMRP, and means many senders get little to no complaints via JMRP, even though recipients are in fact marking their emails as junk.

You will first need to be authorized for the IP in the SNDS (see above), before you can create a feed for it in the JMRP.

To join, please visit: https://sendersupport.olc.protection.outlook.com/snds/JMRP.aspx

Please also note that since we have access to all of our IPs in the SNDS, we can create, change and delete any JMRP feeds for our IPs. At this point in time we don’t have any feeds for IPs belonging to unmanaged servers.

Table of Contents