# Emails not reaching Outlook or Hotmail: the complete fix

> Why your emails are not reaching Outlook and Hotmail, Microsoft's May 2025 sender rules (550 5.7.515), every common 5.7.x code and how to get unblocked.

Source: https://couryo.com/en/blog/emails-not-reaching-outlook-hotmail · Published 2026-10-20

A customer signed up with an `@outlook.com` address, your app sent the confirmation email, and it never showed up. Gmail gets it; Outlook drops it in Junk or bounces it back with a code nobody on the team recognizes. This guide covers what Microsoft requires today, how to read each rejection and how to measure delivery to Microsoft mailboxes, with the official source for every rule.

## Short answer: check this first

1. **Read the server's response.** If the email bounced, the code tells you why. `550 5.7.515` is missing authentication; `S3150` is an IP block; `421 RP-00x` is a rate limit. The full table is below.
2. **SPF, DKIM and DMARC on the `From` domain.** All three passing, with DKIM signed by **your** domain (`d=yourdomain.com`) and a DMARC record published, even if it is `p=none`.
3. **A real sender.** The `From` or `Reply-To` must be an address on your domain that can receive replies.
4. **A clean list.** Remove addresses that bounced as "does not exist" right away, and anyone who reported you as junk.
5. **Measure per provider.** Track Microsoft's accept, defer and reject rates separately from Gmail's. A problem that only shows up at Microsoft has its own cause.

## Outlook.com or Microsoft 365: two different destinations

Microsoft runs two email services, each with its own filters, codes and support forms:

| Destination | Who uses it | Address examples |
|---|---|---|
| **Outlook.com** (consumer) | individuals | `@outlook.com`, `@hotmail.com`, `@live.com`, `@msn.com` and country variants |
| **Microsoft 365** (Exchange Online) | businesses with their own domain on Microsoft | `@company.com`, with MX at `*.mail.protection.outlook.com` |

If you sell to businesses, a large share of your "Outlook" recipients are probably on Microsoft 365, not Outlook.com. Check a company's MX to know which one you are dealing with:

```bash title="Terminal"
dig +short MX company.com
# 0 company-com.mail.protection.outlook.com.   <- Microsoft 365
```

On Windows, `nslookup -type=MX company.com` shows the same.

## The May 5, 2025 rule

In April 2025, Microsoft [announced requirements for high-volume senders to Outlook.com](https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/strengthening-email-ecosystem-outlook%E2%80%99s-new-requirements-for-high%E2%80%90volume-senders/4399730), effective May 5, 2025, for domains sending **more than 5,000 emails per day**:

| Requirement | What Microsoft asks for |
|---|---|
| **SPF** | must pass for the sending domain, with the record listing the authorized IPs and hosts |
| **DKIM** | must pass, validating message integrity and origin |
| **DMARC** | published with at least `p=none` and aligned with SPF or DKIM (preferably both) |

The rejection reads:

```text title="Server response"
550 5.7.515 Access denied, sending domain [YourDomain] does not meet the required authentication level.
```

One confusing detail: the announcement's April 29, 2025 update says non-compliant messages are **rejected** with `550 5.7.515`, while the same post and the [Outlook.com Postmaster site](https://substrate.office.com/ip-domain-management-snds/Postmaster) still describe routing to **Junk** first (verified on 10/20/2026). In practice, plan for either outcome.

Two more points from the announcement's FAQ that most people miss:

- **Safe Senders lists don't help.** Microsoft states the Safe Senders list is not honored for this enforcement.
- **It matters below 5,000 a day too.** Enforcement targets large senders first, but Microsoft recommends the same authentication for everyone.

The announcement also lists hygiene practices that affect reputation: a valid sender address that accepts replies, a visible unsubscribe link, regular removal of invalid addresses and honest subject lines.

## Authentication checklist for Microsoft

For every service that sends with your domain (app, store, CRM, help desk, company mailboxes):

- [ ] **SPF passes** on the envelope domain (the "return path"), and that domain is yours or a subdomain of it.
- [ ] **DKIM passes** with `d=` set to your domain or a subdomain. A signature with only the vendor's domain does not align.
- [ ] **One DMARC record** at `_dmarc.yourdomain.com`, with `rua=` so you get reports.
- [ ] **SPF within 10 DNS lookups.** Microsoft's own FAQ warns that going over 10 can make SPF fail.
- [ ] **A real `From`** that receives replies.

If you still need the records, see [How to set up SPF, DKIM and DMARC](https://couryo.com/en/guides/spf-dkim-dmarc.md).

To see what Microsoft saw, send a message to an `@outlook.com` account, open it and view the message source (in the message's three-dot menu). Look for `Authentication-Results`:

```text title="Message header"
Authentication-Results: spf=pass (sender IP is 203.0.113.10) smtp.mailfrom=bounces.yourdomain.com;
 dkim=pass (signature was verified) header.d=yourdomain.com;
 dmarc=pass action=none header.from=yourdomain.com; compauth=pass reason=100
```

`compauth` is Microsoft's [composite authentication](https://learn.microsoft.com/en-us/defender-office-365/email-authentication-about#composite-authentication), which combines SPF, DKIM, DMARC and other signals. If you see `dmarc=fail` or `compauth=fail`, fix authentication before anything else.

## Microsoft's codes and what to do about each

Outlook.com codes are listed on the [Postmaster troubleshooting page](https://substrate.office.com/ip-domain-management-snds/Postmaster/Troubleshooting); Microsoft 365 codes in the [Exchange Online NDR reference](https://learn.microsoft.com/en-us/troubleshoot/exchange/email-delivery/ndr/non-delivery-reports-in-exchange-online).

| Code | Destination | Meaning | What to do |
|---|---|---|---|
| `550 5.7.515` | Outlook.com | high-volume domain without aligned SPF, DKIM and DMARC | fix authentication, then resend |
| `550 5.7.509` | Microsoft 365 | the `From` fails DMARC and the domain publishes `p=reject` | align SPF or DKIM for the service that sent it |
| `550 5.7.23` | Microsoft 365 | SPF violation | check SPF on the envelope domain |
| `421 RP-001`, `RP-002`, `RP-003` | Outlook.com | rate or connection limit due to IP or domain reputation | temporary: slow down and let the server retry |
| `550 SC-001`, `OU-002` | Outlook.com | spam-like content or IP/domain reputation | review list and content before asking for review |
| `550 SC-002` | Outlook.com | the IP did "namespace mining" (probing addresses without sending) | stop SMTP-based address verification tools |
| `550 SC-004` | Outlook.com | block due to complaints | join JMRP and remove complainers |
| `550 5.7.1 ... (S3150)` | Outlook.com | IP or IP range on Microsoft's block list | fix the cause, then use the support form |
| `550 5.7.606` to `5.7.649` | Microsoft 365 | banned sending IP | request removal at the [delist portal](https://sender.office.com) |
| `550 5.7.511` | Microsoft 365 | banned sender, no self-service | email `delist@microsoft.com` with the full NDR |

The `S` codes (such as `S3140` and `S3150`) are not in the official Postmaster table, but they show up in Outlook.com rejections and in [removal requests to Microsoft](https://learn.microsoft.com/en-sg/answers/questions/5777377/how-can-i-remove-from-s3150-block-list). For other codes, see [SMTP error codes explained](https://couryo.com/en/guides/smtp-error-codes.md).

## SNDS and JMRP: what they are and when they help

These are Microsoft's two free tools for senders to Outlook.com. They now live on the [new SNDS portal](https://substrate.office.com/ip-domain-management-snds/snds), which replaces the old `sendersupport.olc.protection.outlook.com/snds` address, according to the portal's notice updated September 22, 2026.

**SNDS (Smart Network Data Services)** shows data **per IP**: volume, filter verdicts and complaint rate. According to the [SNDS FAQ](https://substrate.office.com/ip-domain-management-snds/SNDS/FAQ):

- filter results are color coded: **green** when under 10% of messages get a spam verdict, **yellow** between 10% and 90%, **red** above 90%;
- the complaint rate is complaints divided by recipients, and Microsoft points to under 0.3% as a good bar;
- IPs that sent fewer than 100 messages that day may show no data;
- access requires proving you control the IP (through reverse DNS, the IP's registry record or the ASN), and it expires 10 months after approval, when you must re-attest.

**JMRP (Junk Mail Reporting Program)** sends you a copy of every message an Outlook.com user marks as junk. The [Postmaster services page](https://substrate.office.com/ip-domain-management-snds/Postmaster/Services) says reports typically start within 72 hours of enrolling. Use them to remove complainers immediately.

**When you can't use them:** both work per IP. If you send through a service on shared IPs, those IPs aren't yours, and the service is the one that enrolls. Ask your provider whether it receives Microsoft's complaint feedback and suppresses those addresses automatically.

## Support forms and delisting

Asking for a delist before fixing the cause usually ends in another block. The right order:

1. **Fix the cause:** authentication, list, sending rate or content, depending on the code.
2. **Pick the right channel:**
   - **Outlook.com (consumer):** the [sender support form](https://support.microsoft.com/supportrequestform/8ad563e3-288e-2a61-8122-3ba03d6b8d75) Microsoft points to. It requires signing in with a Microsoft account. Include the sending IP, the full bounce, the date and what you fixed.
   - **Microsoft 365 with `5.7.606` to `5.7.649`:** the [delist portal](https://sender.office.com). Per the [documentation](https://learn.microsoft.com/en-us/defender-office-365/external-senders-use-the-delist-portal-to-unblock-yourself), it takes one email and one IP per visit, sends a confirmation link, and removal can take 24 hours or longer.
   - **Microsoft 365 with `5.7.511`:** email `delist@microsoft.com` with the full NDR and the IP. Microsoft says it replies within 48 hours.
3. **Ramp back slowly.** After the block lifts, start with your most engaged recipients and grow volume gradually.

If the IP belongs to your sending service, the service files the request. Send its support team the full bounce.

## How to measure delivery per provider

"Sent" is not "delivered". To know how Microsoft is treating you, split your numbers by destination:

- **Group by MX, not only by address domain.** `@outlook.com` and `@hotmail.com` are easy to spot; Microsoft 365 business recipients only show up when you look at the MX.
- **Track three numbers per provider:** accepted (`250`), deferred (`4xx`) and rejected (`5xx`). High deferrals at Microsoft but not at Gmail point to rate or reputation; `5.7.515` rejections point to authentication.
- **Inbox versus Junk is never reported.** The server only says it accepted. To know where mail lands, send the same content to test mailboxes you own at Outlook.com and check the folder.
- **Read your DMARC reports.** Microsoft confirms in the announcement that it sends aggregate (`rua`) reports to the address in your DMARC record. They show which servers sent with your domain and whether they passed.

## Authentication passes, still in Junk?

When the header shows `spf=pass`, `dkim=pass` and `dmarc=pass` and mail still lands in Junk, the weight is on reputation and content:

- **Complaints.** The [troubleshooting page](https://substrate.office.com/ip-domain-management-snds/Postmaster/Troubleshooting) names the junk complaint rate as one of the main factors that drive reputation down.
- **New IP or domain.** The same page explains that new IPs have no reputation yet and typically ramp up within a couple of weeks, as long as the list is accurate and complaints stay low.
- **SMTP address verification.** Tools that "check" addresses by connecting to Microsoft's servers without sending can earn you an `SC-002` block.
- **Content.** URL shorteners, links to raw IPs, image-only emails and misleading subjects work against you. See [Why your emails go to spam](https://couryo.com/en/guides/emails-going-to-spam.md).
- **Transactional mixed with marketing.** A campaign with many complaints drags the password reset down with it. Separate the streams.

## Where Couryo fits

With Couryo, your domain is verified with DKIM signed by your own domain (selectors `couryo1` and `couryo2`), a return path on your subdomain and DMARC, the three things Microsoft requires; with Cloudflare connected, the records are created for you. Every email has a timeline with the raw response from Microsoft's server and a plain-language explanation of what to do. Delivery is broken down by destination provider, and policy blocks (`5.7.x`) neither suppress the recipient nor count toward your bounce rate. The deliverability agent tracks bounces and complaints per provider and flags when Microsoft stands out; on paid plans, the inbox placement test shows whether a message landed in the Outlook inbox or in Junk. See [Deliverability agent](https://couryo.com/en/docs/deliverability.md) and [Events and timeline](https://couryo.com/en/docs/events.md).

## FAQ

### Why does my email reach Gmail but not Outlook?

Each provider runs its own filters. The most common cause is a missing DMARC record or DKIM signed with the vendor's domain instead of yours: Gmail may still accept it, while Microsoft rejects it with `550 5.7.515` (above 5,000 a day) or files it in Junk. The second most common cause is IP reputation, which shows up as `S3150` or `RP-00x`.

### I send fewer than 5,000 emails a day. Does Microsoft's rule apply to me?

The formal requirement starts at 5,000 a day, but Microsoft recommends SPF, DKIM and DMARC for every sender. Below the threshold you won't see `5.7.515`, but missing authentication still weighs on the filter and raises the odds of landing in Junk.

### Does asking customers to add me to their contacts fix it?

It helps that one customer, not the problem. Microsoft says Safe Senders lists are not honored for the authentication requirement, and the next customer will hit the same issue. Fix authentication and the list.

### How long does it take to get unblocked by Microsoft?

It depends on the channel. For the Microsoft 365 delist portal, the documentation says 24 hours or longer after confirmation; for `5.7.511`, a reply within 48 hours. The Outlook.com support form has no published timeline. Either way, if the cause isn't fixed, the block comes back.

### Do I need to sign up for SNDS and JMRP?

If you own your sending IPs, yes: both are free and show your Outlook.com reputation and complaints. If you send through a service on shared IPs, the service enrolls; confirm with them that Microsoft complaints reach them and suppress the recipient.