For mail server administrators · Section A3

The lightest-touch option: a header, nothing more

Accept the mail as normal and just insert a warning header — e.g. X-Delivery-Notice — with no outbound message to anyone.

Simpler still than the notice-and-deliver option, accept the mail as normal and just insert a warning header — e.g. X-Delivery-Notice — with no outbound message to anyone. A support desk, a filtering rule, or anyone inspecting the message source can see that the sender's domain has a history of Microsoft blocking legitimate mail in the other direction. Note that most mail clients don't surface custom headers to an ordinary reader by default; pair this with a client-side rule (an Outlook rule, a Thunderbird filter, a Sieve script) if you want it to actually flag or highlight the message for whoever reads it.

Worth weighing before you pick this option: a header is only ever seen by your recipient, once the mail has already been delivered. It does nothing for the person who actually needs to act — the Microsoft account holder who sent the message. Both the hard-reject approach and the notice-and-deliver option reach them directly, with a reason and a link to dumpmicrosoft.com/users.html. A header alone is the least effort of the three, but it's also the only one that doesn't spread awareness beyond your own mailbox.

Instructions per server below.

Prepend a header instead of rejecting

Postfix access maps support a PREPEND action that inserts a header into the message and then continues on to the rest of your restrictions — unlike REJECT, it doesn't stop delivery.

As a pcre table — one regex line covers every country-specific domain, and needs no postmap compile step — /etc/postfix/warn_microsoft_senders:

/^(?:(?:hotmail|outlook|passport|windowslive)\.[a-z.]+|live\.(?:com|co\.uk|fr|de|it|com\.au|com\.ar)|msn\.com)$/  PREPEND X-Delivery-Notice: Sender's domain has a history of Microsoft blocking legitimate mail unpredictably - see https://dumpmicrosoft.com

Reference it in main.cf — it can sit alongside (before or after) the hard-reject map from the primary section, or replace it entirely:

smtpd_sender_restrictions =
    permit_mynetworks,
    permit_sasl_authenticated,
    check_sender_access pcre:/etc/postfix/warn_microsoft_senders,
    ... your existing restrictions ...
postfix reload
Use warn with add_header instead of deny

Exim's warn ACL verb runs its modifiers — including adding a header — without rejecting the message:

acl_check_mail:
  warn
    senders = ^.*@(?:(?:hotmail|outlook|passport|windowslive)\.[a-z0-9.-]+|live\.(?:com|co\.uk|fr|de|it|com\.au|com\.ar)|msn\.com)$
    add_header = X-Delivery-Notice: Sender's domain has a history of \
Microsoft blocking legitimate mail unpredictably - see https://dumpmicrosoft.com
    log_message = "tagged sender on Microsoft domain list"
  accept

Then validate and reload as before:

exim -bV
systemctl reload exim4   # or: exim4
The access db alone can't insert headers — you need a delivery-time rule or a milter

Sendmail's access map only supports accept/reject-style actions, not header insertion. Two practical options:

Option 1 — procmail, if that's your local delivery agent (common on Sendmail systems, and the simplest option: no milter to build or maintain). Add to /etc/procmailrc:

:0 fhw
* ^From:.*@(hotmail|outlook|live|msn|passport|windowslive)\.
| formail -A "X-Delivery-Notice: Sender's domain has a history of Microsoft blocking legitimate mail unpredictably - see https://dumpmicrosoft.com"

This matches the From: header, not the SMTP envelope sender, so treat it as a best-effort courtesy note rather than a hard signal — it runs at local delivery time, after the message has already been accepted. It also doesn't pin live/msn to a known suffix list the way the other examples on this page do — procmail's regex dialect isn't guaranteed to support the constructs that would need — so it's a little more permissive than a genuinely unrelated live.io or msn.audio deserves. Given this is already a best-effort signal, that's a minor concern; use Option 2 below if you want the tighter match.

Option 2 — a milter, e.g. MIMEDefang, for an SMTP-time check against the real envelope sender. In your MIMEDefang filter.pl:

sub filter_sender {
    my ($sender, $ip, $hostname, $helo) = @_;
    if (lc($sender) =~ /@(?:(?:hotmail|outlook|passport|windowslive)\.[a-z0-9.-]+|live\.(?:com|co\.uk|fr|de|it|com\.au|com\.ar)|msn\.com)>?$/) {
        action_add_header("X-Delivery-Notice",
            "Sender's domain has a history of Microsoft blocking legitimate " .
            "mail unpredictably - see https://dumpmicrosoft.com");
    }
    return ACCEPT;
}

Adjust to match your existing MIMEDefang filter structure and version — this is illustrative of the hook and API to use (filter_sender / action_add_header), not a drop-in replacement for your whole filter file.

Same Exim warn ACL, added via WHM

In WHM → Service Configuration → Exim Configuration Manager → Advanced Editor, add this to the SMTP MAIL ACL section (acl_check_mail), then Restart Exim:

warn
  senders = ^.*@(?:(?:hotmail|outlook|passport|windowslive)\.[a-z0-9.-]+|live\.(?:com|co\.uk|fr|de|it|com\.au|com\.ar)|msn\.com)$
  add_header = X-Delivery-Notice: Sender's domain has a history of \
Microsoft blocking legitimate mail unpredictably - see https://dumpmicrosoft.com

cPanel's webmail clients (Horde/Roundcube) don't highlight custom headers by default — if you want the header to actually change what the reader sees, add a matching filter rule in Roundcube's Settings → Filters (or the equivalent in whatever client your users read mail with).

Want mail to actually reach the sender? See Section A1 — reject outright or Section A2 — deliver and notify.

Pointing an affected visitor here? Send them straight to the switching guide.

Open the user guide →