Outlook Blocking Your Emails? Complete Fix Guide

Short answer: Outlook blocks mail in three different ways, and the bounce - or the absence of one - tells you which. A 550 5.7.x rejection is a real block. Silence usually means filtering or something inside the recipient mailbox.

• If you got a bounce with a 550 5.7.x code: you were refused at the door. Check blocklists, fix authentication, then request delisting from Microsoft.
• If there is no bounce and nothing arrives: the message was accepted. Look in Junk first, then at inbox rules, blocked senders, and mailbox storage.
• If some messages land and others do not: you are almost certainly hitting rate limits or content filtering. Slow the sending pattern down before changing anything else.
• If you are the recipient seeing a Microsoft 365 delivery notice: the problem sits on your side of the mailbox, not on the sender's server. Start with storage and inbox rules.

What Outlook Blocking Actually Means

Microsoft runs one of the largest mail systems in the world. Outlook.com, Hotmail.com, Live.com and MSN.com cover an enormous share of consumer inboxes, and Microsoft 365 sits behind a large share of corporate ones. When Microsoft decides not to deliver your mail, the practical effect is that a big slice of your list simply stops hearing from you.

The word blocking gets used for three very different outcomes, and confusing them is the most common reason people spend days fixing the wrong thing. A message can be refused during the SMTP conversation, which produces a bounce. It can be accepted and then filed into Junk, which produces no bounce. Or it can be accepted and then end up somewhere nobody expected, which also produces no bounce and is usually caused by something inside the recipient's own mailbox.

So the first question is never why is Microsoft blocking me. It is: did a bounce come back, and what did it say? That one answer splits the problem in half. If you are not yet sure the issue is Microsoft-specific at all, work through the broader email delivery diagnostic guide first, then come back here.

This guide is organized around the exact text you are looking at, whether that is a bounce code, a notice inside your own mailbox, or an unsettling silence. The rest of the deliverability troubleshooting library sits in all guides.

Find Your Exact Error Message

Start here. Match what you are actually looking at to a row below, then jump to the section that covers it.

What you see	What it means	First thing to do
Microsoft 365 has prevented the delivery of new emails from one of your contacts to your inbox due to an unknown server error	A notice shown to the person receiving the mail, inside their own mailbox. It is not a bounce, and the sender never sees it.	If you are the recipient, check mailbox storage and inbox rules. If you are the sender, check whether you got a bounce at all.
550 5.7.1 Service unavailable, client host [IP] blocked	Permanent refusal. The connecting IP address or the sending domain is blocked.	Check public blocklists, verify authentication, then file a delisting request.
550 5.7.606 Access denied, banned sending IP	Your sending IP is on Microsoft's own internal blocklist. The whole 5.7.6xx family means roughly this.	Fix the underlying cause, then use Microsoft's sender support portal to request delisting.
550 5.4.1 Recipient address rejected: Access denied	Usually a bad address rather than a block on you. The mailbox does not exist or no longer accepts mail.	Verify the address and remove it from your list. Repeated hits damage your reputation.
421 4.7.0 Try again later or 451 4.7.500 Server busy	Temporary. You are being throttled, usually because of how fast you are sending.	Slow down and let normal retries run. Do not retry harder.
No bounce at all, and the message is in neither Inbox nor Junk	Microsoft accepted the message. Something after acceptance decided where it went.	Ask the recipient about rules, blocked senders and storage before touching your own setup.

How to read any Microsoft error code

Every rejection carries two numbers. The first is the SMTP reply code (550, 421, 451). The second is the enhanced status code with three parts (5.7.1, 4.7.500), and that one carries the real meaning.

• A leading 4 means temporary. The receiving server is saying not now. A well-behaved sending server retries automatically over the following hours.
• A leading 5 means permanent. Retrying changes nothing. Something has to be fixed first.
• A 7 in the middle means security or policy. That segment is what tells you the decision was about reputation, authentication or filtering rather than a bad address.
• A 1 in the middle means addressing. The mailbox does not exist or cannot be reached.
• The final part is Microsoft's own detail code. This is the number you quote in a delisting request.

So 550 5.7.1 is permanent and policy-based, while 451 4.7.500 is temporary and policy-based. Same subject, completely different response required from you. Microsoft does not always follow the textbook meaning either - 550 5.4.1 Recipient address rejected is Microsoft telling you the address is not accepted, even though the middle digit suggests a routing problem.

The Microsoft 365 Prevented Delivery Notice

If you searched for something like Microsoft 365 has prevented the delivery of 2 new emails from one of your contacts to your inbox due to an unknown server error, one thing is worth knowing before anything else.

That notice appears to the person receiving the mail, in their own mailbox. It is not a bounce, and the sender never sees it. People paste it into a search engine assuming their own sending is broken. It is the opposite: Microsoft accepted the message and then could not put it where it belongs.

Microsoft's wording here is generic on purpose. Unknown server error is a catch-all, and Microsoft does not publish a breakdown of what causes it in each case. So rather than guessing, work an ordered checklist from most common cause to least.

If you are the recipient

1. Mailbox storage. Check how full the mailbox is. A mailbox at or near its storage limit cannot accept new mail cleanly, and this is the most common cause. Empty Deleted Items and Junk, then look again.
2. Inbox rules and forwarding. Open your rules list and read every entry. A rule that moves, deletes or forwards mail from a specific sender - especially one written years ago and forgotten - will make mail vanish. Forwarding loops are a particular offender.
3. Connected or synced accounts. If this mailbox pulls mail from another account, or another account pulls from it, a failing sync shows up as missing mail. Check the connected accounts list and re-authenticate anything showing an error.
4. Blocked senders. Look at your blocked senders list. Addresses land there by accident more often than people expect, usually from a stray junk-reporting click.
5. Then, and only then, the sender. If the first four are clean, ask the sender whether they received a bounce. That single question tells you which side of the connection the problem sits on.

If you are the sender

The test is simple. If you did not receive a bounce, your server handed the message over successfully. Every check that happens before acceptance - IP reputation, SPF, DKIM, DMARC - passed well enough for Microsoft to take the message. Rebuilding your DNS records will not change this notice.

That is not proof your reputation is perfect. It is proof that this particular message was not refused. Send the recipient the checklist above instead of tearing up your sending setup.

Blocked, Junked, or Simply Not There

A question people ask constantly: why does Hotmail sometimes block an email outright instead of putting it in the Junk folder? The answer is about timing.

A block happens during the SMTP conversation, while your server is still connected to Microsoft's. The message is refused before it is ever accepted. At that moment no mailbox has taken ownership of it, so there is no folder to file it into. Junk is the opposite: a decision made after acceptance, when the message already belongs to a specific mailbox and Microsoft has somewhere to put it.

That is the whole difference, and it is why the two outcomes feel so different from the sending side.

Outcome	Do you get a bounce?	Where the message is	Who can fix it
Blocked at the door	Yes, with a 5.7.x code	Nowhere - it never entered a mailbox	The sender: authentication, reputation, delisting
Filtered to Junk	No	The recipient's Junk Email folder	Recipient marks it not junk; sender improves reputation and content
Temporarily deferred	Only once repeated retries keep failing	Still queued on your side	The sender: slow down and let retries run
Accepted, then not visible	No	Not in Inbox, not in Junk	The recipient first, then the sender

The accepted-then-not-visible case

This is the outcome that sends people searching for things like I think Microsoft is blocking emails to my Hotmail account. From the sending side the signature is distinctive: your logs show the message was accepted, no bounce came back, and the recipient cannot find it in Inbox or Junk.

Resist the urge to invent an explanation for it. What you can do is narrow it down with three checks.

1. Have the recipient work the mailbox-side causes. Rules, blocked senders, storage, connected accounts - the same ordered list from the previous section.
2. Check other recipients at the same domain. If everyone at that domain is affected, the cause is organization-wide policy or your standing with Microsoft. If it is one person, it is that mailbox.
3. Check your own reputation. Look at Microsoft SNDS and the public blocklists covered later in this guide. Borderline reputation makes Microsoft handle your mail less predictably, and unpredictable handling is exactly what intermittent disappearance looks like.

Rate Limits and Rapid-Succession Sending

Yes, messages sent in rapid succession can be throttled or blocked, and the pattern matters more than the daily total. A hundred messages spread across a working day and a hundred fired in ninety seconds are not the same event to Microsoft, even though the number is identical.

Microsoft applies limits at several levels: per mailbox, per connection, and per recipient. Bursts trip them even when your daily volume is modest, which is why senders who never come close to a daily cap still see mail blocked by hour.

What Microsoft actually publishes

• Authenticated SMTP client submission for Exchange Online mailboxes has a published message rate limit of 30 messages per minute per mailbox. Anything sending through a Microsoft 365 mailbox over SMTP is subject to it.
• Microsoft has also been phasing in an external recipient rate limit for Exchange Online mailboxes. Which figure applies depends on where your tenant sits in that rollout, so check Microsoft's current published Exchange Online service limits rather than trusting a number from a forum post.
• For consumer Outlook.com and Hotmail accounts, Microsoft does not publish exact numbers. There is no official figure to design around. Treat consumer mailboxes as unsuitable for volume sending and move that traffic to a properly configured domain.

What to do about it

1. Spread sends across the working day instead of releasing a batch at once. Randomized gaps between messages beat a fixed interval, because a fixed interval is itself a machine signature.
2. Add a delay between messages rather than opening as many parallel connections as your tooling allows.
3. Split volume across several mailboxes and rotate between them, instead of pushing a single mailbox toward its ceiling.
4. Never retry hard into a 4xx. A temporary rejection is Microsoft asking for less traffic. Retrying faster is the one response guaranteed to make it worse, and sustained hammering can turn a temporary defer into a lasting block.
5. Reuse connections sensibly. Opening a fresh connection for every message looks like burst behavior even at low volume.

If your volume has been climbing quickly, the way providers react to volume spikes is covered in more detail in the Gmail account suspension guide. The triggers differ in detail, but the shape of the failure is identical across providers.

Microsoft Bulk Sender Requirements Explained

Microsoft did not change how SPF works. What changed is that Microsoft started requiring it, along with DKIM and DMARC, from high-volume senders to its consumer domains.

Microsoft announced requirements for high-volume senders to Outlook.com, Hotmail.com, Live.com and MSN.com, with enforcement beginning in May 2025. The threshold Microsoft published is roughly 5,000 messages per day sent to those consumer domains.

Requirement	What it means	How to check it
SPF	A published SPF record for the sending domain that passes for the server actually sending.	Look for spf=pass in the Authentication-Results header of a delivered message.
DKIM	A valid signature that aligns with the domain in your From address.	Look for dkim=pass, then confirm the signing domain matches your From domain.
DMARC	A DMARC record on the From domain with a policy of at least p=none, plus SPF or DKIM alignment.	Query the DMARC TXT record for your domain and look for dmarc=pass in headers.
Valid From address	A real, functional address that accepts replies.	Reply to it from an outside account and confirm the reply arrives.
Easy unsubscribe	Honest one-click unsubscribe on bulk mail, honored promptly.	Click your own unsubscribe link and confirm you stop receiving mail.
List hygiene	Low complaint rates and no continued sending to addresses that bounce.	Track complaints and bounces for Microsoft domains, and suppress failures immediately.

How Microsoft enforces it

Microsoft's stated path started with routing non-compliant bulk mail to the Junk folder, with a stated intention to move toward outright rejection over time. Because it has rolled out in stages, treat Microsoft's current published sender guidance as the authority on where enforcement stands today rather than any single announcement.

What if you send far less than 5,000 a day

This is the part most people get wrong. The threshold is counted per receiving provider, and most cold-email senders are nowhere near it. So the bulk-sender rules, strictly speaking, do not apply to you.

Implement every one of them anyway. Failing SPF, DKIM or DMARC is one of the most common reasons Microsoft filters low-volume senders, and it was true long before the bulk-sender announcement existed. A small sender with broken authentication is not exempt - they are filtered quietly instead of being told why.

The same work satisfies Google and Yahoo

Google and Yahoo introduced comparable bulk-sender requirements in February 2024: SPF, DKIM, DMARC, one-click unsubscribe for bulk mail, and keeping spam complaint rates low. The overlap with Microsoft is close to total, so the authentication work you do once covers all three. If you send to Google Workspace recipients as well, the Google Workspace suspension guide covers what happens when those same signals go wrong on the Google side.

How to Check if a Mailbox Is Auto-Rejecting

If you own the mailbox and mail seems to disappear, work this list in order. Every item is something you can check yourself in a few minutes.

1. Read every inbox rule. Rules can move mail to a folder, mark it read, forward it, or delete it outright. Delete rules are the dangerous ones because they leave nothing behind. Pay particular attention to rules with conditions you do not remember writing.
2. Separate automatic replies from rejection. An out-of-office reply means the message was delivered successfully. It is not a rejection, and a sender who receives one has proof your mailbox is accepting mail.
3. Check blocked senders and safe senders. Anything on the blocked list is discarded or sent straight to Junk. Adding an important sender to the safe list is also the quickest way to stop repeat filtering.
4. Check mailbox storage. A full mailbox stops accepting new mail, and the rejection the sender gets back can read like a policy block rather than a capacity problem.
5. Check whether junk filtering is set to a strict mode. Some settings accept mail only from addresses on your safe list and reject or junk essentially everything else. That option is easy to turn on by accident.
6. If this is a Microsoft 365 mailbox, ask your IT administrator. Organizations can configure mail flow rules that reject or redirect messages before they ever reach your mailbox, and nothing in your personal settings will reveal them. An administrator can also run a message trace to see exactly what happened to a specific message, which ends the guesswork faster than any other step.

The last point is worth pushing on. When mail from one particular sender or domain never arrives for anyone in the company, an organization-level rule is the most likely explanation, and only an administrator can see it.

One Filtering System, Many Microsoft Domains

Outlook.com, Hotmail.com, Live.com and MSN.com are different domain names in front of the same consumer mail platform. There is no separate Hotmail filter to appease. Microsoft 365, previously called Office 365 and running on Exchange Online, is a distinct product, but it draws on the same reputation data and much of the same filtering technology.

Two practical consequences follow.

• Fixing one fixes all of them. Repairing authentication or reputation for Outlook.com improves your standing with Hotmail and Live addresses at the same moment, because they are the same system.
• Consumer trouble predicts business trouble. If Outlook.com is refusing you, expect Microsoft 365 corporate recipients to filter you too. Given how much of the business world runs on Microsoft 365, that is the expensive half of the problem.

The exception is organization-level configuration. A Microsoft 365 tenant can layer its own rules, allow lists and filtering strictness on top of Microsoft's defaults, which is why one company receives your mail while another rejects it with identical reputation on your side.

Fixing SPF, DKIM, and DMARC Alignment

The bulk-sender section covered what Microsoft requires. This one covers getting it genuinely working, because passing each check individually is not the same as passing alignment.

SPF

1. List every system that sends mail using your domain - mail provider, outreach tool, CRM, invoicing system, help desk.
2. Publish a single SPF TXT record. A domain must have exactly one; two records is a permanent error and both fail.
3. Stay inside the ten DNS lookup limit. Each include counts toward it, and exceeding ten causes SPF to fail permanently no matter how correct the record looks.
4. End with -all rather than ~all once you are confident every legitimate source is listed.

A working record looks like this:

v=spf1 include:spf.protection.outlook.com include:_spf.google.com -all

DKIM

1. Enable DKIM signing in your sending platform and publish the public key it gives you as a DNS record.
2. Confirm the signing domain matches your From domain. A signature from your provider's own domain passes DKIM but fails alignment, and Microsoft cares about alignment.
3. Rotate keys when your provider tells you to, and remove keys belonging to platforms you no longer use.

DMARC

1. Publish a record on the DMARC hostname for your domain, starting at p=none with a reporting address.
2. Read the reports for a few weeks and confirm every legitimate mail stream passes SPF or DKIM with alignment.
3. Move to p=quarantine, then to p=reject, once the reports are clean.

A safe starting record:

v=DMARC1; p=none; rua=mailto:[email protected]

Verify from the receiving end

Send a message to an Outlook.com address you control, open the message source, and read the Authentication-Results header. You want spf=pass, dkim=pass and dmarc=pass, and you want the domains in those results to match the domain in your From address. That header is the ground truth. A checker tool telling you the record is valid is not the same as Microsoft accepting it.

Reputation, Blocklists, and Microsoft SNDS

If authentication is clean and mail is still refused, you are looking at a reputation problem. Microsoft keeps its own reputation data, which is why you can be clear on every public list and still be blocked.

Microsoft SNDS

Smart Network Data Services is the only window Microsoft gives senders into how it sees their sending IPs. Register at sendersupport.olc.protection.outlook.com/snds, add the IP addresses or ranges you send from, and complete the ownership verification. Data takes a day or two to appear.

What to read once it populates:

• Filter result - the share of your mail Microsoft classified as spam.
• Complaint rate - recipients marking you as junk. Microsoft does not publish a threshold here, so treat any measurable and rising rate as a targeting problem to solve rather than a number to stay just under.
• Trap hits - you are mailing addresses that exist only to catch senders with bad list sources. This is serious, and it calls for cleaning the list rather than appealing.
• Sample messages - real filtered mail, which is the most useful single diagnostic Microsoft offers.

SNDS covers IP addresses you send from. If you send through a shared platform you do not own those IPs, and the data belongs to your provider - ask them what they can see.

Public blocklists

Microsoft also consults external reputation sources. Check Spamhaus and Barracuda for both your sending IP and your domain, since a domain listing follows you even after you change IPs. Delisting from each is a separate process with its own rules, and the blacklist removal guide walks through them.

Fix the cause before requesting removal anywhere. A delisting granted while the underlying behavior continues is usually reversed, and repeat listings are treated far less generously than first ones.

Content and Link Hygiene

When reputation is borderline, content decides individual messages. That is the mechanism behind the common complaint that some emails get through and others do not, from the same mailbox, on the same day.

• Links. Keep them few, and point only at domains you control or well-established sites. Link shorteners and redirect chains hide the destination, which is precisely what filters are built to distrust. A newly registered domain in a link is treated as suspicious on its own.
• Tracking domains. If you use open or click tracking, the tracking domain carries reputation too. A shared tracking domain that someone else has damaged will drag your mail down with it.
• Attachments. Executables are refused outright, and password-protected archives are frequently blocked because they cannot be scanned. Link to a file rather than attaching it.
• Formatting. Keep a real balance of text to markup, include a plain text alternative, and avoid image-only messages. Heavy styling inside what claims to be a personal message is itself a signal.
• Subject lines. Skip all caps, stacked punctuation, and fake RE: or FWD: prefixes. A fake reply prefix is one of the fastest ways to be classified as deceptive.

None of this rescues a damaged reputation. It stops content from casting the deciding vote when your reputation is merely average, which is where most senders actually sit.

Submitting a Microsoft Delisting Request

If you are seeing a 5.7.x rejection that names your IP address, and you have fixed the cause, Microsoft runs a delisting process.

1. Fix the cause first. Correct authentication, clean the list, stop whatever produced the complaints or trap hits, and reduce volume. Submitting before this is done wastes the attempt.
2. Open a request at Microsoft's sender support portal, sender.office.com.
3. Enter the exact IP address named in the bounce message, not a range you assume covers it.
4. Quote the full bounce including the enhanced status code. The detail code tells Microsoft's team which system listed you.
5. Describe what you send, what went wrong, and what you changed. Specific remediation reads very differently from a general promise to behave.
6. Submit once and wait. Responses typically arrive within a day or two. Duplicate requests slow the process rather than speeding it up.

If the request is denied

A denial means Microsoft believes the underlying problem is still present. Read the response for anything specific, address it, and leave a clear gap of about a week before trying again with evidence of improvement. Resubmitting immediately with the same information almost never works.

Two limits are worth stating plainly. Delisting restores acceptance, not reputation, so expect a period of cautious treatment afterward while a clean record rebuilds trust. And nobody can file this request on your behalf or escalate it inside Microsoft - it has to come from whoever controls the sending IP.

Preventing This With WarmySender

Most Microsoft blocks trace back to two things: an unknown sender arriving with no history, and volume showing up in bursts. Both are sending-pattern problems.

WarmySender runs cold email campaigns, peer-to-peer email warmup, LinkedIn outreach, and multichannel sequences that combine email and LinkedIn in one flow. For the failures in this guide, the mechanics that matter are the gradual warmup ramp that gives a new mailbox a history before it ever sends a campaign, per-mailbox daily sending caps, paced sending instead of bursts, inbox rotation across several mailboxes so no single one carries the load, mailbox health monitoring that surfaces a problem while it is still small, and list verification before sending so bad addresses never generate the bounces that damage your standing with Microsoft.

To be clear about what this does not do: warmup and pacing lower the odds of being blocked in the first place. They will not lift a block that already exists - that still means fixing the cause and asking Microsoft to remove it. Setup guidance lives on the documentation pages. Start at warmysender.com.