Table of Contents
Why Are My Microsoft Exchange Emails Getting Rejected by Sender Score?
Administrators managing Microsoft Exchange Online instances should be aware of a recurring delivery issue affecting outbound emails. Recent reports indicate that legitimate emails routed through Microsoft 365 are being blocked because specific Microsoft Exchange Online IP addresses have been flagged by the Sender Score reputation system.
This problem arises not from your specific domain’s reputation, but rather from the shared infrastructure of Microsoft’s cloud services. When an IP address within Microsoft’s outbound pool is blacklisted, any tenant utilizing that specific relay node may experience delivery failures.
Recent Incident Report (December 2025)
As of early December 2025, IT professionals have reported consistent communication failures with external clients. Specifically, emails sent from Microsoft 365 accounts are being rejected by recipient servers that utilize Sender Score for spam filtering.
The Symptom
Senders receive a Non-Delivery Report (NDR) containing error code 554 5.7.1. The error message explicitly states that the client host is blocked using a Real-time Blackhole List (RBL).
Example Error Log
smtp27.gate.iad3a.rsapps.net gave this error:
Decision Engine classified the mail item was rejected because of IP Block (from outbound normal IP pools) -> 554 5.7.1 ACL dns_rbl; Client host [40.107.130.132] blocked using sa-ip4tset.blagr.emailsrvr.com=127.22.0.2 Senderscore.
Affected IP Addresses
Recent analysis via MxToolbox has identified several Microsoft-owned IPs appearing on the Sender Score blocklist, including:
- 52.101.72.139
- 52.101.70.95
- 40.107.159.143
Note: The listing status of these IPs is dynamic; addresses like 52.101.83.76 and 40.107.130.132 have recently been delisted.
The Mechanism: How Sender Score Affects Delivery
Sender Score functions similarly to a credit rating for email servers. It assigns a numerical reputation score (0 to 100) to outgoing mail server IP addresses based on volume, complaint rates, and spam trap hits.
- The Threshold: When an IP address drops below a specific reputation threshold, it is added to a blocklist.
- The Impact: Recipient mail servers configured to query Sender Score databases will automatically reject connection attempts from these listed IPs.
- The Complication: Because Exchange Online uses shared IP pools, a “noisy neighbor” (a different tenant sending spam) can tarnish the reputation of an IP address that your organization also uses. This results in your legitimate business emails being blocked despite your domain having a clean internal record.
Advisory Steps for Administrators
If your organization encounters this specific 554 5.7.1 error, verify the source of the block immediately.
- Analyze the NDR: Confirm the error message references “Sender Score” or “Senderscore.org.”
- Verify IP Status: Use tools like MxToolbox to check the reputation of the specific Microsoft IP address cited in the error log.
- Distinguish the Cause: Recognize that this is likely an infrastructure issue on Microsoft’s end, not a misconfiguration of your local domain settings (SPF/DKIM/DMARC).
- Action Plan:
- Open a Ticket: Submit a support request to Microsoft via the M365 Admin Center. Explicitly state that their outbound IP is blacklisted.
- Delisting Request: While Microsoft typically handles this, you can visit the Sender Score lookup tool to view the data. In some cases, you may attempt to request delisting, though this is often restricted to the IP owner (Microsoft).
- Temporary Workaround: If critical communication is halted, consider routing urgent emails through a secondary SMTP relay or a third-party gateway service temporarily until Microsoft rotates or cleans the affected IP.