Outlook / Microsoft 365 Email Verification

What Microsoft's MX records look like

Microsoft hosted domains publish MX records under mail.protection.outlook.com. A Microsoft 365 tenant typically gets a hostname derived from its domain, following the shape contoso-com.mail.protection.outlook.com, while the consumer domains point at Microsoft's own inbound hosts. The common thread is the protection.outlook.com suffix, which is Exchange Online Protection. Mailthentic classifies a domain as Microsoft hosted from that MX suffix rather than from the visible domain name, so a company running Microsoft 365 on its own brand domain is correctly recognised. Some tenants place a third party security gateway in front, in which case the MX points at the gateway and Microsoft sits behind it.

How Outlook answers an SMTP probe

Microsoft, like Google, is an ambiguous provider. Its inbound servers routinely answer RCPT TO with a 250 for recipients that do not exist. The SMTP conversation completes cleanly and offers no way to tell a live mailbox from a fabricated one. This is intentional. Rejecting unknown recipients at the RCPT TO stage would let anyone enumerate a company's entire staff directory by brute force, so Microsoft accepts first and decides later.

The real recipient decision happens after acceptance. If the mailbox does not exist, Microsoft generates a Non Delivery Report, usually carrying a 550 5.1.1 style code and text along the lines of the recipient address not being found in the directory. That only occurs when a message is actually delivered, and a verification probe never sends one.

Tenant configuration adds a second layer of ambiguity

On the Microsoft 365 side, behaviour varies by tenant configuration. Administrators can enable directory based edge blocking, which pushes recipient validation forward and lets Exchange Online Protection reject unknown recipients at the edge. Tenants with that enabled behave less like a catch all. Many tenants do not enable it, and plenty deliberately configure a real catch all mailbox. Because you cannot tell from the outside which configuration a given tenant runs, Mailthentic probes each domain with a randomly generated local part. If that random address is accepted, the domain is treated as accept all and no individual mailbox on it can be confirmed. If the random address is cleanly rejected with a 550 while the target address is accepted, that is a genuinely stronger signal, and Mailthentic scores it accordingly.

Why an Outlook mailbox cannot be confirmed by SMTP

For consumer Outlook, Hotmail, Live and MSN addresses, and for any Microsoft 365 tenant that accepts a random probe, the honest verdict is accept-all and unconfirmed. Mailthentic reports it that way rather than converting a meaningless 250 into a confident valid. A 550 on the target address, by contrast, is definitive: that mailbox does not exist.

Rate limiting, deferrals and greylisting

Exchange Online Protection throttles unfamiliar source IPs aggressively. A probe that connects too often will start collecting temporary responses in the 421, 450 and 451 families, sometimes with text about the message being deferred or the connection being closed for policy reasons. None of these mean the address is bad. Mailthentic treats them as deferrals, backs off, and retries before deciding anything, and it throttles by MX cluster so that a batch containing hundreds of different Microsoft 365 tenants does not hammer the same Microsoft endpoints simultaneously. A temporary deferral is never turned into an invalid verdict.

So what does an Outlook result actually mean?

A clean result on a Microsoft hosted address means the domain resolves, its Exchange Online Protection endpoints are live and answering, the address is well formed, it is not disposable, and no bounce history counts against it. Unless the domain rejected a random probe, it does not mean the mailbox exists. Read it as a domain level clearance with an unresolved recipient.

Understand which kind of Microsoft address you are holding

Consumer Outlook, Hotmail, Live and MSN addresses are always accept-all in practice, so expect an unconfirmed verdict every time. Microsoft 365 business domains are worth reading more carefully. If Mailthentic reports that the domain rejected its random catch all probe and accepted your target address, you have a meaningfully stronger signal than you get from a consumer Outlook address. If the domain accepted the random probe, you are back to unconfirmed, and no amount of extra probing will change that.

What to do with a risky or unknown verdict

Do not automatically suppress. On Microsoft infrastructure, unknown is the structurally expected answer, not evidence of a bad address. Suppressing every Outlook and Microsoft 365 contact would gut most B2B lists for no real deliverability gain. Instead, keep the addresses that pass every signal you can check and manage the residual risk on the sending side:

• Suppress anything with bounce history. A previous hard bounce is a real answer from Microsoft. Honour it permanently.
• Suppress role addresses such as info@, sales@ and abuse@ unless they are your intended audience. They generate complaints and they land in shared mailboxes.
• Strip disposables and obvious typos before they ever reach a campaign.
• Segment by engagement. An Outlook address with no opens or clicks across many sends is a far better candidate for suppression than any SMTP probe result.

Protecting deliverability into Microsoft

Microsoft's filtering is reputation driven and it is unforgiving of sudden changes. SPF, DKIM and DMARC on your sending domain are baseline requirements. Warm new IPs and domains slowly, because Exchange Online Protection is quick to defer or junk mail from a source it does not recognise. Keep volume steady rather than spiky. Process every Non Delivery Report immediately: on Microsoft, as on Google, the NDR is the only authoritative statement you will ever get about whether a mailbox exists, so it is the most valuable list hygiene data you own. Watch your complaint rate, and give recipients an obvious way to unsubscribe so they use that instead of the junk button.

Verify early, verify again before a big send

Run verification at the point of capture so malformed and disposable addresses never enter your database, then re run the list before a large campaign to catch domains that have since gone dark. For Microsoft addresses the pre send pass is about domain health, typos, disposables and known bouncers rather than mailbox existence, which will still return unconfirmed.

Be honest with yourself about the numbers

If a vendor hands you a confident valid for an arbitrary outlook.com address, that verdict was not derived from the SMTP conversation, because the conversation does not contain it. Mailthentic tells you what the protocol actually said and lets you make the call with accurate information.