2023/09/28 by Olivier Moulene.
Office 365 / Microsoft 365 Postmaster(y) page
To help the sender community, we are glad to share our experiences collected over the years with some ISPs. This page is about Office 365 which is a subscription-based suite of productivity software and services developed by Microsoft. In this article we will focus on their email hosting solution: Exchange Online.
We will highlight below topics:
Market share and history of MBP
Office 365 was officially launched by Microsoft on June 28, 2011 to provide cloud-based versions of Microsoft's enterprise software, including Exchange Online, SharePoint Online, and Office Communications Online (later replaced by Skype for Business Online).
Over the years, Office 365 evolved with regular updates, feature enhancements, and the addition of new services. Microsoft also offered various subscription plans tailored to different user types, including home users, small businesses, and large enterprises. In April 2020, Microsoft rebranded Office 365 to "Microsoft 365," combining Office applications and services under a single subscription offering.
It held a significant share of the cloud productivity software market. Microsoft's Office 365 has been a dominant player in the business productivity space, competing with other productivity suites like Google Workspace (formerly G Suite) by Google.
To protect its messaging infrastructure, Office 365 relies on its proprietary filters (such as Forefront and Microsoft Antispam) and third-party RBLs (such as Spamhaus). While similar at its core, it appears to have additional rules when compared to the Outlook/Hotmail mailboxes.
When there are issues with inbox placement at Office 365 tenants, it's sometimes valuable to have a look at the proprietary headers of the received message using their Message Header Analyzer.
More explanation on the meaning of each field can be found here: Anti-spam message headers
The following fields are most useful:
- The Spam Confidence Level (SCL) value of the message from 0 to 9. An SCL rating of 5 or 6 is considered suspected spam. See Spam Confidence Levels.
- The Phishing Confidence Level (PCL) of the message, whch indicates whether it’s a phishing message.
- The Bulk Complaint Level (BCL) of the message from 1 to 9. Low is few complaints, high is many complaints. Default bulk mails will be accepted until the complaint level of 7. See Bulk Complaint Level values.
Microsoft Office 365 Technical & SMTP Tweaks
MX servers are *.mail.protection.outlook.com, *.mail.eo.outlook.com or *.prod.protection.outlook.com.
Each MX returns 2 IPs from a cluster of 3 hosts. Clusters are for example EUR04, GBR01, JPN01, AUS01, NAM03.
This means you can't roll up on wildcards. Instead, you need to roll up on cluster or destination IP.
Common Error SMTP Messages
451 4.4.4 Temporary server error. Please try again later ATTR5 [*.prod.protection.outlook.com]
451 4.7.500 Server busy. Please try again later from [X.X.X.X]. (S77719)
Temporary errors on Office 365's end. A message should be retried later.
452 4.5.3 Recipients belong to multiple regions ATTR38 [*.prod.protection.outlook.com]
451 4.4.62 Mail sent to the wrong Office 365 region. ATTR35. For more information please go to https://go.microsoft.com/fwlink/?linkid=865268 [*.prod.protection.outlook.com]
These errors indicate a misconfiguration of the recipient domain.
550 5.4.1 [xxxx@xxxx]: Recipient address rejected: Access denied [*.prod.protection.outlook.com]
This bounce message refers to a non-existing recipient that should be removed from the mailing list.
554 5.4.14 Hop count exceeded - possible mail loop ATTR34 [*.prod.protection.outlook.com]
This indicates a misconfiguration of the recipient domain.
550 5.7.511 Access denied, banned sender[X.X.X.X]. To request removal from this list please forward this message to email@example.com. For more information please go to http://go.microsoft.com/fwlink/?LinkId=526653
This indicates that the sending IP is currently blocked. An email should be sent to firstname.lastname@example.org to initiate a mitigation request
550 5.7.606 Access denied, banned sending IP [X.X.X.X]. To request removal from this list please visit https://sender.office.com/ and follow the directions. For more information please go to http://go.microsoft.com/fwlink/?LinkID=526655 (AS16012609)
This indicates that the sending IP is currently blocked. Go to https://sender.office.com/ to submit a mitigation request.
Abuse Desk & Tech Support
If an IP address has been blocked, you can review the situation and request a resolution at https://sender.office.com/. If an email is being marked as spam or blocked, it is generally due to the recipient domain's O365 administrator settings. In this case, you will need to collaborate with the recipient and provide them with the headers of the affected messages. This will enable them to examine the issue, make any necessary changes, and add the sender to their whitelist if appropriate.