Emails not reaching Outlook or Hotmail: the complete fix

A customer signed up with an @outlook.com address, your app sent the confirmation email, and it never showed up. Gmail gets it; Outlook drops it in Junk or bounces it back with a code nobody on the team recognizes. This guide covers what Microsoft requires today, how to read each rejection and how to measure delivery to Microsoft mailboxes, with the official source for every rule.

Short answer: check this first#

1. Read the server's response. If the email bounced, the code tells you why. 550 5.7.515 is missing authentication; S3150 is an IP block; 421 RP-00x is a rate limit. The full table is below.
2. SPF, DKIM and DMARC on the From domain. All three passing, with DKIM signed by your domain (d=yourdomain.com) and a DMARC record published, even if it is p=none.
3. A real sender. The From or Reply-To must be an address on your domain that can receive replies.
4. A clean list. Remove addresses that bounced as "does not exist" right away, and anyone who reported you as junk.
5. Measure per provider. Track Microsoft's accept, defer and reject rates separately from Gmail's. A problem that only shows up at Microsoft has its own cause.

Outlook.com or Microsoft 365: two different destinations#

Microsoft runs two email services, each with its own filters, codes and support forms:

If you sell to businesses, a large share of your "Outlook" recipients are probably on Microsoft 365, not Outlook.com. Check a company's MX to know which one you are dealing with:

dig +short MX company.com
# 0 company-com.mail.protection.outlook.com.   <- Microsoft 365

On Windows, nslookup -type=MX company.com shows the same.

The May 5, 2025 rule#

In April 2025, Microsoft announced requirements for high-volume senders to Outlook.com, effective May 5, 2025, for domains sending more than 5,000 emails per day:

The rejection reads:

550 5.7.515 Access denied, sending domain [YourDomain] does not meet the required authentication level.

One confusing detail: the announcement's April 29, 2025 update says non-compliant messages are rejected with 550 5.7.515, while the same post and the Outlook.com Postmaster site still describe routing to Junk first (verified on 10/20/2026). In practice, plan for either outcome.

Two more points from the announcement's FAQ that most people miss:

• Safe Senders lists don't help. Microsoft states the Safe Senders list is not honored for this enforcement.
• It matters below 5,000 a day too. Enforcement targets large senders first, but Microsoft recommends the same authentication for everyone.

The announcement also lists hygiene practices that affect reputation: a valid sender address that accepts replies, a visible unsubscribe link, regular removal of invalid addresses and honest subject lines.

Authentication checklist for Microsoft#

For every service that sends with your domain (app, store, CRM, help desk, company mailboxes):

• SPF passes on the envelope domain (the "return path"), and that domain is yours or a subdomain of it.
• DKIM passes with d= set to your domain or a subdomain. A signature with only the vendor's domain does not align.
• One DMARC record at _dmarc.yourdomain.com, with rua= so you get reports.
• SPF within 10 DNS lookups. Microsoft's own FAQ warns that going over 10 can make SPF fail.
• A real From that receives replies.

If you still need the records, see How to set up SPF, DKIM and DMARC.

To see what Microsoft saw, send a message to an @outlook.com account, open it and view the message source (in the message's three-dot menu). Look for Authentication-Results:

Authentication-Results: spf=pass (sender IP is 203.0.113.10) smtp.mailfrom=bounces.yourdomain.com;
 dkim=pass (signature was verified) header.d=yourdomain.com;
 dmarc=pass action=none header.from=yourdomain.com; compauth=pass reason=100

compauth is Microsoft's composite authentication, which combines SPF, DKIM, DMARC and other signals. If you see dmarc=fail or compauth=fail, fix authentication before anything else.

Microsoft's codes and what to do about each#

Outlook.com codes are listed on the Postmaster troubleshooting page; Microsoft 365 codes in the Exchange Online NDR reference.

The S codes (such as S3140 and S3150) are not in the official Postmaster table, but they show up in Outlook.com rejections and in removal requests to Microsoft. For other codes, see SMTP error codes explained.

SNDS and JMRP: what they are and when they help#

These are Microsoft's two free tools for senders to Outlook.com. They now live on the new SNDS portal, which replaces the old sendersupport.olc.protection.outlook.com/snds address, according to the portal's notice updated September 22, 2026.

SNDS (Smart Network Data Services) shows data per IP: volume, filter verdicts and complaint rate. According to the SNDS FAQ:

• filter results are color coded: green when under 10% of messages get a spam verdict, yellow between 10% and 90%, red above 90%;
• the complaint rate is complaints divided by recipients, and Microsoft points to under 0.3% as a good bar;
• IPs that sent fewer than 100 messages that day may show no data;
• access requires proving you control the IP (through reverse DNS, the IP's registry record or the ASN), and it expires 10 months after approval, when you must re-attest.

JMRP (Junk Mail Reporting Program) sends you a copy of every message an Outlook.com user marks as junk. The Postmaster services page says reports typically start within 72 hours of enrolling. Use them to remove complainers immediately.

When you can't use them: both work per IP. If you send through a service on shared IPs, those IPs aren't yours, and the service is the one that enrolls. Ask your provider whether it receives Microsoft's complaint feedback and suppresses those addresses automatically.

Support forms and delisting#

Asking for a delist before fixing the cause usually ends in another block. The right order:

1. Fix the cause: authentication, list, sending rate or content, depending on the code.
2. Pick the right channel:
   • Outlook.com (consumer): the sender support form Microsoft points to. It requires signing in with a Microsoft account. Include the sending IP, the full bounce, the date and what you fixed.
   • Microsoft 365 with 5.7.606 to 5.7.649: the delist portal. Per the documentation, it takes one email and one IP per visit, sends a confirmation link, and removal can take 24 hours or longer.
   • Microsoft 365 with 5.7.511: email delist@microsoft.com with the full NDR and the IP. Microsoft says it replies within 48 hours.
3. Ramp back slowly. After the block lifts, start with your most engaged recipients and grow volume gradually.

If the IP belongs to your sending service, the service files the request. Send its support team the full bounce.

How to measure delivery per provider#

"Sent" is not "delivered". To know how Microsoft is treating you, split your numbers by destination:

• Group by MX, not only by address domain. @outlook.com and @hotmail.com are easy to spot; Microsoft 365 business recipients only show up when you look at the MX.
• Track three numbers per provider: accepted (250), deferred (4xx) and rejected (5xx). High deferrals at Microsoft but not at Gmail point to rate or reputation; 5.7.515 rejections point to authentication.
• Inbox versus Junk is never reported. The server only says it accepted. To know where mail lands, send the same content to test mailboxes you own at Outlook.com and check the folder.
• Read your DMARC reports. Microsoft confirms in the announcement that it sends aggregate (rua) reports to the address in your DMARC record. They show which servers sent with your domain and whether they passed.

Authentication passes, still in Junk?#

When the header shows spf=pass, dkim=pass and dmarc=pass and mail still lands in Junk, the weight is on reputation and content:

• Complaints. The troubleshooting page names the junk complaint rate as one of the main factors that drive reputation down.
• New IP or domain. The same page explains that new IPs have no reputation yet and typically ramp up within a couple of weeks, as long as the list is accurate and complaints stay low.
• SMTP address verification. Tools that "check" addresses by connecting to Microsoft's servers without sending can earn you an SC-002 block.
• Content. URL shorteners, links to raw IPs, image-only emails and misleading subjects work against you. See Why your emails go to spam.
• Transactional mixed with marketing. A campaign with many complaints drags the password reset down with it. Separate the streams.

Where Couryo fits#

With Couryo, your domain is verified with DKIM signed by your own domain (selectors couryo1 and couryo2), a return path on your subdomain and DMARC, the three things Microsoft requires; with Cloudflare connected, the records are created for you. Every email has a timeline with the raw response from Microsoft's server and a plain-language explanation of what to do. Delivery is broken down by destination provider, and policy blocks (5.7.x) neither suppress the recipient nor count toward your bounce rate. The deliverability agent tracks bounces and complaints per provider and flags when Microsoft stands out; on paid plans, the inbox placement test shows whether a message landed in the Outlook inbox or in Junk. See Deliverability agent and Events and timeline.

FAQ#

Why does my email reach Gmail but not Outlook?#

Each provider runs its own filters. The most common cause is a missing DMARC record or DKIM signed with the vendor's domain instead of yours: Gmail may still accept it, while Microsoft rejects it with 550 5.7.515 (above 5,000 a day) or files it in Junk. The second most common cause is IP reputation, which shows up as S3150 or RP-00x.

I send fewer than 5,000 emails a day. Does Microsoft's rule apply to me?#

The formal requirement starts at 5,000 a day, but Microsoft recommends SPF, DKIM and DMARC for every sender. Below the threshold you won't see 5.7.515, but missing authentication still weighs on the filter and raises the odds of landing in Junk.

Does asking customers to add me to their contacts fix it?#

It helps that one customer, not the problem. Microsoft says Safe Senders lists are not honored for the authentication requirement, and the next customer will hit the same issue. Fix authentication and the list.

How long does it take to get unblocked by Microsoft?#

It depends on the channel. For the Microsoft 365 delist portal, the documentation says 24 hours or longer after confirmation; for 5.7.511, a reply within 48 hours. The Outlook.com support form has no published timeline. Either way, if the cause isn't fixed, the block comes back.

Do I need to sign up for SNDS and JMRP?#

If you own your sending IPs, yes: both are free and show your Outlook.com reputation and complaints. If you send through a service on shared IPs, the service enrolls; confirm with them that Microsoft complaints reach them and suppress the recipient.