Difficult recipients: Microsoft and T-Online

Module 6: Bounces and troubleshooting · Reading time: 11 minutes

Learning objective: After this lesson, you'll know the specific rules of two recipients that often raise questions, Microsoft (Outlook.com, Hotmail and Microsoft 365) and T-Online, and what you as a user and what a sending server's administrator can do about a delay or block.

Key concepts: Outlook.com and Exchange Online Protection, new IP address without reputation, 451 4.7.500 Server busy, 550 5.7.606 banned sending IP, delisting portal sender.office.com, SNDS, JMRP, Junk Email folder, safe senders, T-Online, own reputation system, forward-confirmed reverse DNS, contact details on the PTR domain's website, no whitelisting, postmaster.t-online.de

Why these two in particular?

Microsoft receives mail for Outlook.com, Hotmail and Live.com, as well as a large share of business mail (via Microsoft 365, with Exchange Online Protection as the filter). T-Online is Germany's largest mail service. Besides the usual standards, both use their own reputation system. Mail that arrives at Gmail without any trouble can be delayed or rejected by them. Anyone with customers or contacts in Germany, or who sends a lot of mail to Hotmail addresses, will run into this sooner or later.

Microsoft: temporarily throttled with 4.7.500

Microsoft's best known message is:

451 4.7.500 Server busy. Please try again later from [203.0.113.25]. (AS843)

The text says "server busy", but that's not quite accurate: it's a deliberate throttling. Microsoft uses this range of codes (4.7.500 to 4.7.699) when a sending IP address still has little reputation, or when behaviour suddenly changes, for example with a sharp rise in the number of emails. Microsoft itself describes it as a temporary restriction to assess suspicious activity, which is lifted automatically once the mail turns out to be fine.

What does that mean for you?

• It's a temporary error (4xx). The sending server holds on to the mail and tries again. Usually the mail still gets through after one or more attempts, sometimes after hours.
• If you get a delay notice, don't resend the mail. That only increases the volume and makes the throttling worse.
• If this is a problem for you (for example with login codes or invoices that need to arrive straight away), report it to your provider along with the delay notice.

What the sending server's administrator can do:

1. Check that the basics are right: PTR with FCrDNS, no blocklist, SPF and DKIM for the domains that send mail through the server (lesson 5.1 and 5.2).
2. Warm up: have a new IP address send a smaller share of the traffic first, then gradually increase it.
3. Limit the rate per recipient: fewer simultaneous connections to Microsoft and a reasonable wait between attempts, so the server doesn't keep hitting the brakes.
4. Register with SNDS and JMRP (see below).

Microsoft: blocked with 5.7.606

If the IP address is genuinely blocked, you'll get a permanent error:

550 5.7.606 Access denied, banned sending IP [203.0.113.25]. To request removal from this list please visit https://sender.office.com/ and follow the directions.

This happens with mail to Microsoft 365 environments. The administrator of the IP address can request removal via the delisting portal sender.office.com: fill in the email address and IP address, open the confirmation email and choose "Delist IP" there. According to Microsoft it can then take up to 24 hours before the block is lifted. Do fix the cause first: an IP address that starts sending spam again after removal will quickly end up on the list again.

For Outlook.com and Hotmail (the consumer side), removal works via a separate form from Microsoft's sender support. Microsoft has no manual whitelist: it remains an automatic reputation system.

Microsoft: SNDS and JMRP

Microsoft offers two free services for administrators of a sending IP address:

• SNDS (Smart Network Data Services): per IP address you can see how much mail Microsoft received, how much of it was judged to be spam, how many complaints there were, and whether the address ended up in spam traps. A colour code (green, yellow, red) shows the current status.
• JMRP (Junk Mail Reporting Program): when an Outlook.com user marks your mail as junk, you receive a copy. This shows you which mail is generating complaints.

Both are only useful for those who manage an IP address themselves: your own server, or the provider of a shared server. As an ordinary user of a hosting package or mail service, you don't register for these yourself.

Microsoft: in the Junk Email folder

Often mail isn't rejected but placed in the Junk Email folder, especially from senders Microsoft doesn't yet know. Error codes won't help here, because there's no bounce. What does work:

• SPF, DKIM and DMARC set up correctly (module 4). If you're a bulk sender, Microsoft requires both SPF and DKIM to pass (lesson 5.3).
• Ask regular contacts to add your address to their contacts or safe senders, and to mark mail that ended up in Junk as "Not junk". That counts towards your reputation.
• Don't send newsletters through your ordinary mailbox (lesson 7.1).

T-Online: a system of its own

T-Online (Deutsche Telekom's mail service, with addresses at @t-online.de and @magenta.de) is known for its strict own rules. The postmaster page postmaster.t-online.de lists the requirements for sending servers. The most important ones:

1. Follow internet standards, including the RFCs for SMTP and for message structure, and forward-confirmed reverse DNS (lesson 5.1).
2. The name in the reverse DNS must lead to a domain with a website that states how to reach the administrator directly. T-Online refers here to the European directive on electronic commerce (directive 2000/31/EC, article 5) on the mandatory information a service provider must provide. In Germany, such a page is called the Impressum.
3. No mail sent directly from dynamic addresses, dial-up connections or "anonymous" cloud servers: these should send via a relay from a suitable provider.
4. Limit the number of simultaneous connections. Too many will get you 421 Maximum parallel connections for your IP-Address reached.
5. No open relay, outgoing mail filtered for spam and viruses, and a valid certificate for TLS.

A block of an IP address at T-Online can look like this, for example:

554 IP=203.0.113.25 - A problem occurred. (Ask your postmaster for help or to contact tosa@rx.t-online.de to clarify.)

In practice you'll also come across variants referring to a poor or missing reputation. The message is always the same: this IP address isn't allowed to deliver right now.

T-Online: what can you do?

T-Online explicitly states that it does not offer whitelisting. A blocked address can, however, be released once the cause has been resolved. The route to get there:

• As an ordinary user (you send mail via a hosting package or mail service): send the full bounce to your provider. Only the administrator of the sending server can contact T-Online; you cannot have the IP address released yourself.
• As the administrator of the sending server: first check the requirements above (PTR, FCrDNS, a reachable website with contact details on the domain from the PTR, no blocklist), and then get in touch via the address given in the error message or via the contact form on postmaster.t-online.de. For recurring temporary blocks with no known cause, T-Online mentions the postmaster address. Don't count on getting an acknowledgement of receipt.
• In the short term: mail to an important T-Online recipient can temporarily be routed differently (another provider or sending service), or you can agree on a different address.

And the rest?

Other major German services too, such as GMX and Web.de, and many corporate filters have their own reputation systems. The pattern is the same everywhere: a sending server with a correct PTR, good authentication, a calm and regular sending pattern and few complaints gets through almost everywhere. If there's a problem, read the bounce, look up the code with the party that issued it, and let the sending server's administrator take action.

Summary

• 451 4.7.500 Server busy from Microsoft is a deliberate, temporary throttling of the IP address, often due to low reputation or a sharp increase. Don't resend.
• 550 5.7.606 means a blocked IP address; the administrator requests removal via sender.office.com, after resolving the cause.
• SNDS and JMRP give administrators of an IP address insight into their reputation with Microsoft.
• T-Online requires, among other things, FCrDNS and a website with contact details on the domain from the PTR, and offers no whitelisting.
• As a user, you can't fix this yourself: pass the full bounce on to your provider.

Quiz

Exercise

Exercise O6.4: Investigating a block at a large recipient. You're given a case: an association has been sending its mail via a new server of its own for a week; mail to Hotmail addresses arrives hours later and mail to T-Online addresses bounces back with an IP block. Answer: (1) what do the two messages mean, (2) who needs to do what, (3) which five things do you check on the server, and (4) what can the association do in the short term? Afterwards you'll see the model answer.

Further reading

The steps in these articles apply to WebOké's control panels; with other providers it works in a similar way.

• My email doesn't arrive or ends up in spam: here's how to figure it out
• Sending mail from your VPS and setting up reverse DNS
• DirectAdmin guide 9.4: My mail ends up in the recipient's spam folder
• Microsoft, Email nondelivery reports and SMTP errors in Exchange Online: https://learn.microsoft.com/en-us/troubleshoot/exchange/email-delivery/ndr/non-delivery-reports-in-exchange-online
• Microsoft, Office 365 Anti-Spam IP Delist Portal: https://sender.office.com/
• Microsoft, SNDS and JMRP: https://sendersupport.olc.protection.outlook.com/snds/
• T-Online Postmaster (requirements and contact): https://postmaster.t-online.de/