Outlook rejecting your emails? Microsoft sender rules, NDRs and delisting

Two Microsoft mail systems, two sets of errors

"Outlook" can mean two different receivers, and they bounce mail differently:

• Outlook.com - Microsoft's consumer service behind @outlook.com, @hotmail.com, @live.com, @msn.com and similar addresses. This is where the 2025 high-volume sender rules, the S3150-style block-list messages and the SNDS/JMRP tools apply.
• Microsoft 365 (Exchange Online) - business mailboxes on companies' own domains. These use Exchange Online Protection, whose blocks look like 550 5.7.606-649 Access denied, banned sending IP and have a different delisting portal.

Check the recipient's domain and the bounce text before you pick a fix: delisting through the wrong channel does nothing.

The 2025 rules for high-volume senders

In April 2025 Microsoft announced that domains sending more than 5,000 messages a day to Outlook.com consumer addresses must comply with SPF, DKIM and DMARC. The original announcement said non-compliant mail would be rejected; Microsoft then revised it so that, from 5 May 2025, such mail is routed to the Junk folder first, with rejection to follow. The requirements:

• SPF must pass for the sending domain, with a record that lists your sending IPs.
• DKIM must pass - the message must carry a valid DKIM signature.
• DMARC must be published with at least p=none, and the message must pass it - SPF or DKIM aligned with the domain in the From: header (ideally both).

Microsoft counts messages per From: domain, so a domain with several sending services adds them all up. Alongside the mandatory items, Microsoft recommends a From: or Reply-To address that can actually receive replies, a working and easy-to-find unsubscribe link, regular removal of invalid addresses (list hygiene and bounce management), and honest subject lines and headers. It also says it may filter or block senders that violate these practices even when authentication passes.

When Microsoft rejects mail for failing the rules, the bounce reads:

550 5.7.515 Access denied, sending domain example.com does not meet the required authentication level.

The fix is the same as for Gmail's 550 5.7.26: make sure every service sending as your domain is in SPF and signs DKIM with your domain, and publish DMARC. You can check all three records with the email authentication checker. If you send through a third-party platform, its "domain authentication" setup is usually what's missing.

Reading Outlook.com bounces

Microsoft's Outlook.com Postmaster site documents a set of short codes that appear in its SMTP responses. They are mostly about the reputation of the connecting IP, not about a single message:

The "S3150" block-list message

The most common Outlook.com block in practice isn't in that table. It looks like this:

550 5.7.1 Unfortunately, messages from [192.0.2.10] weren't sent. Please contact your Internet service provider since part of their network is on our block list (S3150).

The variants (S3150, S3140 and others) all mean the same thing: Microsoft has blocked the sending IP or part of its network, based on reputation. It isn't about authentication or one message's content, and it often appears after a burst of complaints, spam trap hits or a compromised account sending spam. If the IP belongs to your mail provider, the provider has to handle it; if it is your own server's IP, follow the steps below.

SNDS and JMRP: seeing what Microsoft sees

Microsoft offers two free tools for people who run sending IPs. Both need a Microsoft account and a short authorization process that proves you're responsible for the IPs.

• SNDS (Smart Network Data Services) shows per-IP data about mail reaching Outlook.com: how much was sent, a colour-coded filter result, the complaint rate and spam trap hits. It's the closest thing Microsoft has to Google Postmaster Tools - and it works per IP, not per domain.
• JMRP (Junk Email Reporting Program) is Microsoft's feedback loop: when an Outlook.com user marks your message as junk, you get a report. Unsubscribe or suppress those recipients immediately - continuing to mail people who complain is how a temporary block becomes a permanent one.

Neither tool is useful on a shared IP you don't control - then it's your provider who should watch them.

How to get delisted

1. Stop the cause first. Look for compromised accounts or scripts, purchased or old lists, sudden volume spikes and missing unsubscribe handling. A delisting request made while the problem continues is usually refused, and the block returns.
2. Check the basics. SPF, DKIM and DMARC pass, the sending IP has reverse DNS that resolves back to it, and the IP isn't on public blocklists (see the guide to email blacklists).
3. For Outlook.com (consumer) blocks, submit Microsoft's sender support form for Outlook.com delivery (linked from the Outlook.com Postmaster site) with the blocked IP and the full bounce text. Read the Postmaster site's troubleshooting FAQ first - support may decline to help senders that don't follow Microsoft's policies.
4. For Microsoft 365 (business) blocks with 5.7.606-649, use the Office 365 Anti-Spam IP Delist Portal at sender.office.com: enter the address that received the bounce and the IP, confirm by email, then select "Delist IP". It can take up to 24 hours or longer. For 5.7.511 Access denied, banned sender, the portal doesn't work - forward the bounce to delist@microsoft.com as the message instructs.
5. Ramp back up slowly. After delisting, don't resume full volume at once; send to your most engaged recipients first, as you would when warming up a new IP.

Messages land in Junk, not rejected

Junk placement without a bounce is the more common Outlook.com problem, and since May 2025 it's also the first consequence of failing the high-volume rules. Work through the same list: authentication and alignment, reputation (SNDS, JMRP complaints), list quality and content. Recipients moving your messages out of Junk and adding you to their contacts helps, but it doesn't outweigh complaints. The guide to why mail goes to spam covers the general causes.

How AnyMail handles this

On AnyMail, mail is DKIM-signed with your own domain, the SPF, DKIM and DMARC records are generated for you and checked automatically, and the sending IP - its reverse DNS and its reputation - is managed on our side, not in your domain. Each mail server's hourly sending limit, which starts lower and rises over its first two weeks, and the one-click unsubscribe on every external message help keep complaints, and with them Outlook.com blocks, away.