⚠ Read this before you change anything
Everything on this page is an illustrative example, not a tested, certified, or supported configuration for your mail server, OS, version, or environment. Rejecting or filtering mail to or from a major share of consumer addresses has real trade-offs for your users, your correspondents, and — if you get the syntax wrong — your entire mail flow.
You are solely responsible for reviewing, testing, and validating any change before it touches a production system, for confirming it's compatible with your existing configuration and policies, and for any legal, contractual, or regulatory obligations that apply to your organisation's handling of email.
By copying, adapting, or deploying any snippet, script, or configuration from this page, you accept full responsibility for the consequences — including but not limited to lost or delayed mail, service outages, and downstream impact on your users. DumpMicrosoft and its authors accept none. If you are not able or willing to take that responsibility, do not apply any of the changes described in this guide.
The pattern below rejects incoming mail from Microsoft-hosted
addresses at the MAIL FROM stage, with a 550 response that explains
why and links to dumpmicrosoft.com/users.html. Because
the rejection happens live during the SMTP conversation, it's Microsoft's own
outbound servers that generate the resulting bounce and deliver it back to the
actual sender — so the person using the @outlook.com or @hotmail.com address
sees a message that correctly blames Microsoft's own delivery problems, rather
than concluding (wrongly) that your server is broken or that they did something
wrong. Each tab below also includes an optional block in the other
direction — rejecting outbound mail to Microsoft domains, which protects
your own queue and sending reputation, but doesn't reach anyone using a
Microsoft address, since that bounce never leaves your own server. Adjust the
domain list and message to your own policy. Not ready to reject mail outright?
Two lighter alternatives are covered separately:
delivering the message as normal while still
notifying the sender separately, or just
tagging it with a header and doing nothing more.
1. Create a sender access map
/etc/postfix/reject_microsoft_senders:
# domain-per-line REJECT map, matched case-insensitively against MAIL FROM
/^.*@(?:(?:hotmail|outlook|passport|windowslive)\.[a-z.]+|live\.(?:com|co\.uk|fr|de|it|com\.au|com\.ar)|msn\.com)$/i REJECT 550 5.7.1 We do not accept mail from Microsoft-hosted addresses because Microsoft's own mail service blocks legitimate senders unpredictably — this isn't a reflection on you or this message. See https://dumpmicrosoft.com/users.html
2. Reference it from main.cf via smtpd_sender_restrictions
smtpd_sender_restrictions =
permit_mynetworks,
permit_sasl_authenticated,
check_sender_access pcre:/etc/postfix/reject_microsoft_senders,
... your existing restrictions ...
Keeping permit_mynetworks/permit_sasl_authenticated
first matters: it makes sure the check only applies to incoming mail from
the outside world, not to your own authenticated users relaying outbound mail
that happens to use a Microsoft-hosted sender address.
3. Apply and reload
postfix check postfix reload
Using a plain hash map instead of pcre? List each domain as
its own key (hotmail.com REJECT ..., outlook.com REJECT ..., etc.), then
run postmap /etc/postfix/reject_microsoft_senders and reference it as
check_sender_access hash:/etc/postfix/reject_microsoft_senders.
Optional — also block outgoing mail to Microsoft domains
This protects your own queue and reputation from unpredictable rejections, but the bounce is only seen by your own users, not by anyone using a Microsoft address.
/etc/postfix/reject_microsoft_recipients:
/^.*@(?:(?:hotmail|outlook|passport|windowslive)\.[a-z.]+|live\.(?:com|co\.uk|fr|de|it|com\.au|com\.ar)|msn\.com)$/i REJECT 550 5.7.1 We no longer attempt delivery to Microsoft-hosted addresses due to reliability issues. Please ask your correspondent for an alternative email address that doesn't rely on Microsoft services. See https://dumpmicrosoft.com/users.html
smtpd_recipient_restrictions =
permit_mynetworks,
permit_sasl_authenticated,
check_recipient_access pcre:/etc/postfix/reject_microsoft_recipients,
reject_unauth_destination,
... your existing restrictions ...
ACL check in the MAIL phase
Add to your acl_check_mail section (checked at MAIL FROM
time, typically in /etc/exim4/conf.d/acl/ or your monolithic
exim.conf):
# Reject incoming mail from Microsoft-hosted consumer addresses
acl_check_mail:
accept hosts = +relay_from_hosts
accept authenticated = *
deny
senders = ^.*@(?:(?:hotmail|outlook|passport|windowslive)\.[a-z0-9.-]+|live\.(?:com|co\.uk|fr|de|it|com\.au|com\.ar)|msn\.com)$
message = "550 5.7.1 We do not accept mail from Microsoft-hosted addresses \
because Microsoft's own mail service blocks legitimate senders unpredictably \
— this isn't a reflection on you or this message. See \
https://dumpmicrosoft.com/users.html"
log_message = "rejected sender on Microsoft domain list"
accept
The two accept lines above the deny
matter: they let your own relaying/authenticated users through untouched, so the
check only applies to mail arriving from the outside world.
Then validate and reload:
exim -bV
systemctl reload exim4 # or: exim4
Optional — also block outgoing mail to Microsoft domains
Protects your own queue and reputation, but the bounce stays local — it's seen by your own users, not by anyone using a Microsoft address.
Add to your acl_check_rcpt section instead:
deny domains = ^(?:(?:hotmail|outlook|passport|windowslive)\.[a-z0-9.-]+|live\.(?:com|co\.uk|fr|de|it|com\.au|com\.ar)|msn\.com)$ message = "550 5.7.1 We no longer attempt delivery to Microsoft-hosted \ addresses due to reliability issues. Please ask your correspondent for an \ alternative email address that doesn't rely on Microsoft services. See \ https://dumpmicrosoft.com/users.html" log_message = "rejected recipient on Microsoft domain list"
1. Add entries to the access map, keyed on the envelope sender
/etc/mail/access — the From: tag matches the
MAIL FROM address, i.e. incoming mail:
From:hotmail.com ERROR:550 "5.7.1 We do not accept mail from Microsoft-hosted addresses because Microsoft's own mail service blocks legitimate senders unpredictably. See https://dumpmicrosoft.com/users.html" From:outlook.com ERROR:550 "5.7.1 We do not accept mail from Microsoft-hosted addresses because Microsoft's own mail service blocks legitimate senders unpredictably. See https://dumpmicrosoft.com/users.html" From:live.com ERROR:550 "5.7.1 We do not accept mail from Microsoft-hosted addresses because Microsoft's own mail service blocks legitimate senders unpredictably. See https://dumpmicrosoft.com/users.html" From:msn.com ERROR:550 "5.7.1 We do not accept mail from Microsoft-hosted addresses because Microsoft's own mail service blocks legitimate senders unpredictably. See https://dumpmicrosoft.com/users.html" From:passport.com ERROR:550 "5.7.1 We do not accept mail from Microsoft-hosted addresses because Microsoft's own mail service blocks legitimate senders unpredictably. See https://dumpmicrosoft.com/users.html" From:windowslive.com ERROR:550 "5.7.1 We do not accept mail from Microsoft-hosted addresses because Microsoft's own mail service blocks legitimate senders unpredictably. See https://dumpmicrosoft.com/users.html"
Unlike the pcre-based Postfix map or the
Exim/regex examples elsewhere on this page, Sendmail's access db only matches
exact keys — it has no way to say "any TLD" in one line. That means this list
covers the core Microsoft domains but misses the 30+ country-specific ones
(outlook.com.au, outlook.in, hotmail.co.uk,
hotmail.com.br, ...) unless you add each one you care about as its
own From: line by hand. For automatic coverage of every variant,
see the milter-based Sendmail examples on the
deliver-and-notify page and the
header-only page — both use a real regex
instead of exact keys.
2. Ensure access_db is enabled in sendmail.mc
FEATURE(`access_db', `hash -T<TMPF> /etc/mail/access')dnl
3. Rebuild the map and restart
makemap hash /etc/mail/access.db < /etc/mail/access service sendmail restart
Optional — also block outgoing mail to Microsoft domains
Protects your own queue and reputation, but the bounce
stays local — it's seen by your own users, not by anyone using a Microsoft
address. Use the To: tag instead, which matches the recipient:
To:hotmail.com ERROR:550 "5.7.1 We no longer attempt delivery to Microsoft-hosted addresses due to reliability issues. Please ask your correspondent for an alternative email address that doesn't rely on Microsoft services. See https://dumpmicrosoft.com/users.html" To:outlook.com ERROR:550 "5.7.1 We no longer attempt delivery to Microsoft-hosted addresses due to reliability issues. Please ask your correspondent for an alternative email address that doesn't rely on Microsoft services. See https://dumpmicrosoft.com/users.html" To:live.com ERROR:550 "5.7.1 We no longer attempt delivery to Microsoft-hosted addresses due to reliability issues. Please ask your correspondent for an alternative email address that doesn't rely on Microsoft services. See https://dumpmicrosoft.com/users.html" To:msn.com ERROR:550 "5.7.1 We no longer attempt delivery to Microsoft-hosted addresses due to reliability issues. Please ask your correspondent for an alternative email address that doesn't rely on Microsoft services. See https://dumpmicrosoft.com/users.html" To:passport.com ERROR:550 "5.7.1 We no longer attempt delivery to Microsoft-hosted addresses due to reliability issues. Please ask your correspondent for an alternative email address that doesn't rely on Microsoft services. See https://dumpmicrosoft.com/users.html" To:windowslive.com ERROR:550 "5.7.1 We no longer attempt delivery to Microsoft-hosted addresses due to reliability issues. Please ask your correspondent for an alternative email address that doesn't rely on Microsoft services. See https://dumpmicrosoft.com/users.html"
Same exact-key limitation as above — add any country-specific domains you care about by hand, or use the regex-based milter examples on the deliver-and-notify page for automatic coverage. Rebuild the map (step 3 above) again after adding these.
Via WHM's Exim Configuration Editor
cPanel/WHM servers run Exim under the hood. In
WHM → Service Configuration → Exim Configuration Manager → Advanced Editor,
add the sender ACL from the Exim tab to the SMTP MAIL ACL section
(acl_check_mail, checked at MAIL FROM time — not the RCPT
section), then use Restart Exim from the same page.
deny senders = ^.*@(?:(?:hotmail|outlook|passport|windowslive)\.[a-z0-9.-]+|live\.(?:com|co\.uk|fr|de|it|com\.au|com\.ar)|msn\.com)$ message = "550 5.7.1 We do not accept mail from Microsoft-hosted addresses \ because Microsoft's own mail service blocks legitimate senders unpredictably. \ See https://dumpmicrosoft.com/users.html"
Discussion of this exact recurring blocking problem among hosting administrators, including on shared cPanel/DirectAdmin infrastructure, is documented in the references on the home page.
Optional — also block outgoing mail to Microsoft domains
Protects your own queue and reputation, but the bounce stays local. Add this to the RCPT ACL section instead:
deny domains = ^(?:(?:hotmail|outlook|passport|windowslive)\.[a-z0-9.-]+|live\.(?:com|co\.uk|fr|de|it|com\.au|com\.ar)|msn\.com)$ message = "550 5.7.1 We no longer attempt delivery to Microsoft-hosted \ addresses due to reliability issues. Please ask your correspondent for an \ alternative email address that doesn't rely on Microsoft services. See \ https://dumpmicrosoft.com/users.html"
Not ready to commit to a hard reject? Continue to Section A2 — deliver the mail, but notify the sender, or Section A3 — the lightest-touch header-only option. Need to cover web and app forms too? See Section B.
Pointing an affected visitor here? Send them straight to the switching guide.
Open the user guide →