We recently took on the task of getting a client’s new IP address removed from a few blacklists. The trickiest part was dealing with Microsoft so that the client’s emails to Hotmail/Outlook etc. inboxes didn’t bounce back as undelivered.
Blacklisted Digital Ocean IP address
The problem arose when the client purchased a VPS from Digital Ocean to host their website and emails. Unfortunately, they hadn’t realised that the IP that was assigned to them had previously been used to send out spam emails. This became apparent when they checked it using a couple of free IP blacklist-checking tools such as MX Toolbox and HetrixTools. Of course, this isn’t exclusive to digital Ocean, it can also happen with other VPS provider such as Linode, Vultr, Amazon Web Services (AWS), Google Cloud Platform (GCP), Microsoft Azure, UpCloud, Scaleway, Hetzner Cloud and OVHcloud.
Check DNS configuration
The client didn’t want to ditch their VPS and hunt for a clean IP so, firstly, we had to make a few DNS tweaks to ensure that sent emails were achieving 10 out of 10 with the awesome free email testing tool at mail-tester.com.
This typically involves making sure the email passes various authentication and configuration tests like SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail), DMARC (Domain-based Message Authentication, Reporting, and Conformance), PTR (Pointer Records), rDNS (Reverse DNS), and checking the hostname. These are key elements in verifying the legitimacy of an email sender and protecting against spam and phishing attacks.
Getting whitelisted from various IP blacklists
When all these were in place, we then got the IP removed and delisted, or whitelisted, from all the usual blacklists including Spamhaus (Spamhaus are a big hitter and are used by Google for their Gmail service). Consequently, within 36 hours, emails began arriving in Gmail inboxes – Yay, sweet!
But… with Hotmail and Outlook accounts, it was still a problem. They weren’t even able to make it to a Hotmail spam folder but were still being rejected outright and bouncing back as undelivered immediately. Here’s an excerpt of the message:
<demo-user@hotmail.com>: host
eur.olc.protection.outlook.com[104.47.13.33] said: 550 5.7.1 Unfortunately,
messages from [xxx.xxx.xx.xxx] weren’t sent. Please contact your Internet
service provider since part of their network is on our block list (S3140).
You can also refer your provider to
http://mail.live.com/mail/troubleshooting.aspx#errors.
[XXX3.eop-eur04.prod.protection.outlook.com
…
Action: failed
Status: 5.7.1
Remote-MTA: dns; eur.olc.protection.outlook.com
Diagnostic-Code: smtp; 550 5.7.1
Try the “Office 365 Anti-Spam IP Delist Portal” first
As above, the first thing to try is to see if your IP is listed by the Office 365 Anti-Spam IP Delist Portal. If it isn’t (and our client’s wasn’t) then like us, you’ll need to dig a little deeper.
Deciphering error/bounce clues S3140 and 550 5.7.1
The error code S3140 in a bounced email message typically indicates that part of the sender’s network is on a block list of the email service provider, such as Outlook.com, Hotmail, etc. This message often accompanies a 550 5.7.1 error code, which further explains that messages from the sender’s IP address were not sent because the IP is on a block list.
Unfortunately, this issue usually requires the sender to contact their Internet service provider (ISP) or, in this case, their VPS provider, to start the resolution process. It’s a common problem when an IP address is suspected of sending spam or has been used for suspicious activities. And, since the client had only just acquired the IP, this looked to be the case.
Getting delisted from @outlook @hotmail @live @msn email addresses
So now came the time to bite the bullet and knuckle down to it – there were no easy shortcuts. So, in order to get delisted/removed from Microsft’s blacklist, you first have to log in here.
You’re then presented with a rather lengthy form that must be filled in. This is what we did and this is the reply we got:
Hi ,
Thanks for your patience while we investigated your request.
Below your IP address(es) and their status(es) are listed.Not qualified for mitigation
[xxx.xxx.xx.xxx]
The IP(s) above do not qualify for mitigation.
Oh dear, that’s not a good start. If this happens to you and you see “Not qualified for mitigation”, don’t despair; persevere. So we replied, informing Microsoft that our emails were passing SPF, DKIM and DMARC, we weren’t sending spam and wanted a reconsideration since the IP had only recently been acquired. We got this reply:
Hello,
Thank you for contacting the Outlook.com Deliverability Support Team.In-order for us to investigate further, please provide the required documents (email from ISP as PDF attachment and Invoice copy) supporting the Proof of Purchase for the IP address [IP ADDRESS]
We will continue our investigation as soon as we have the required information.
Thanks again
OK, so that’s some progress at least. The client then provided a Digital Ocean invoice but it only showed the hostname and not the IP so they also included a screenshot with their reply, which also showed the date the IP was acquired. Here is the response they got:
Hello,
Thank you for contacting the Outlook.com Deliverability Support Team.Please request your ISP/ ESP to send you an email in the below format. Once received please forward the same as an attachment to us for further investigation.
“The IP [xxx.xxx.xx.xxx] was assigned to [example.com/client’s name] on DD/MM/YYYY”
Thanks again
We then advised the client to raise a support ticket with their VPS provider, Digital Ocean, asking them to provide the specific information exactly as requested by Microsoft. To their credit, DO responded very quickly, were extremely helpful, and duly did exactly as asked. This email was saved to PDF and then sent to Microsoft as an attachment. This was their response:
Hello,
Thank you for contacting the Outlook.com Deliverability Support Team.We will be looking into this issue along with the Escalations Team for the IP address [xxx.xxx.xx.xxx]. We understand the urgency of this issue and will provide an update as soon as this is available.
Thanks again
BAM! Within 24 hours the IP was completely unblocked by MS.
The moral of the story
Cleaning a dirty IP with a baaaad reputation may require a bit of effort on your part, especially if it’s blocked from sending to @hotmail @live @msn @outlook @live email addresses. But, if you’re certain your IP is now squeaky clean, it shouldn’t be a problem, and you can’t blame Microsoft for running a tight ship in order to keep their network as spam-free as possible.
Additional tags: Digital Ocean, Linode, Vultr, Amazon Web Services (AWS), Google Cloud Platform (GCP), Microsoft Azure, UpCloud, Scaleway, Hetzner Cloud, OVHcloud
You should all start advising your visitors not to use outlook/msn/hotmail accounts since they act like complete as…oles by blocking all ip ranges by default and then demanding invoices/emails from isp and other docs. If people will stop using Microsoft services then maybe this will teach them a lesson and change this ridiculous actitude.. use protonmail instead
Hi Rupert
Just wanted to thank you for this guide. Did as you suggested, MS responses were as you said and in the end they lifted the ban on my IP.
Just wanted to add that for AWS customer, when I got to the request by MS to provide confirmation from my ISP/ESP of the IP address first I contacted AWS technical support but they suggested the information could be better provided by account/billing support. They did, passed it along to MS and it worked like a charm.
Thank you for this. My ip was blacklisted on the digital ocean network as well. But i followed your instructions to the letter and it is now allowed!
Hi. This is not exactly true “Unfortunately, they hadn’t realised that the IP that was assigned to them had previously been used to send out spam emails.” and this is not exactly true “The client didn’t want to ditch their VPS and hunt for a clean IP so”
My IP is recently blocked and I have had the server and same for like 10 years or something. Its a RANGE that is blocked, so the spammer could be on another IP address within the range. The error is “your Internet service provider since part of their network is on our block list (S3140)”.
“part of their network” is the key issue here. Our IP is not the issue, it’s a similar one.
Still working on this, did you guys answer to Microsoft on the reply you got on email?
Initial response came quick from Microsoft, but the reply on email is taking some time it seems like.
Contacted DigitalOcean as well, but they recommended me to take an email service, to which I kindly declined.
Keeping my fingers crossed.
We didn’t get a final reply, although a blank email did come through. Only had to wait a short while before the IP was whitelisted
I got an initial reply on email after filling in the form. But no answer on the reply I sent on Email, like in the article above. Hopefully this does get sorted, spent some good hours setting up the email server 🫡
Indeed – As did we. Sometimes you have to be persistent.. Good luck!
i followed this guid and got this response from outlook support:
Thanks for your patience while we investigated your request.
Below your IP address(es) and their status(es) are listed…..
Nothing was detected to prevent your mail from reaching Outlook.com customers.
but im still blocked from sending to hotmail/outlook !!!
Hi and sorry you’re still having issues Here are a few steps you can take to further address and possibly resolve this issue:
Review the Original Notification: Double-check any messages or bounce backs you received originally for specifics about why your emails were blocked. Sometimes the reason for blocking might not be directly related to a blacklist issue but could be due to other factors like content filtering or security settings.
Check your IP and Domain Reputation: Use tools like SenderScore, Talos Intelligence, or MXToolbox to check the reputation of your IP address and domain. These tools can provide insights if there are other underlying issues affecting your deliverability.
Ensure Compliance with Outlook.com Policies: Review Outlook.com’s anti-spam policies and technical standards to ensure your email campaigns comply fully. This includes the authentication methods I mentioned in the post about SPF, DKIM, and DMARC, which help prove that your emails and domain are legit.
Resend the Delisting Request: If you are certain that all settings and configurations are correct and compliant, consider sending a detailed follow-up to Microsoft’s support team. Outline all the measures you’ve taken, including compliance with their policies, and ask for a specific reason or any additional insights into why your emails are still being blocked.
Monitor Email Practices: Regularly monitor your email sending practices. This includes keeping low bounce rates, avoiding spammy content, maintaining a good sender reputation, and managing recipient engagement. Poor practices in any of these areas can affect deliverability.
Contact Support Again: Sometimes resolving these issues may require multiple interactions with support. If the problem persists, and you still can’t get it sorted, it’s worth visiting the MS Sender Support website. there’s a ton of information on there too along with a few services you can try like their JMRP (Junk Email Reporting Programme).
Good luck!
about six weeks and no reaction of MS
IP still blocked and all other mail servers accept this sender IP
Followed this guide and it worked like a charm TY
Hi. How long did it take from start to finish of the whole process? My IP has been blacklisted and MS sent me the not qualified for mitigation message. If I appeal it, how long will it normally take to get my IP unblocked?
Hi Mike. It was within 24 hours. Oddly, they didn’t send a reply, they just unblocked the IP. Well, they did send a blank email which I assume should have been the “you’ve succeeded” one 🙂