Outlook 550 5.7.1 S3150 / S3140: “part of their network is on our block list”

Short answer: Outlook.com, Hotmail and Live have blocked the IP address (or the whole IP range) of your mail server, so nothing you send from it reaches them. Fix: check authentication and blocklists, then ask Microsoft to unblock the IP with the Outlook.com delisting form.

The bounce looks like this
550 5.7.1 Unfortunately, messages from [203.0.113.10] weren't sent. Please contact your Internet service provider since part of their network is on our block list (S3150).
… (S3140). You can also refer your provider to http://mail.live.com/mail/troubleshooting.aspx#errors.

What it means

Microsoft's consumer mail service (outlook.com, hotmail.com, live.com, msn.com) has put the IP address of your mail server on its block list. It is very common on new VPS and cloud servers, because the IP or its range was used for spam before you got it. Microsoft doesn't publish what the codes mean; from what hosting providers observe, S3150 often lifts by itself after a few days without mail to Outlook.com, while S3140 stays until Microsoft removes it. Microsoft 365 business mailboxes use a separate list (see 550 5.7.606 below).

How to fix it

  1. Check the domain you send from with the checker below: SPF, DKIM and DMARC should all pass. Outlook.com requires them from senders of 5,000+ mails a day and penalises missing ones for everyone.
  2. Make sure the server's reverse DNS (PTR) is set to its mail host name, and that the IP is not on Spamhaus or other DNS blocklists – Microsoft uses Spamhaus data too.
  3. Rule out spam from the server itself: an open relay, a hacked WordPress or contact form, or a mailing list without opt-in will get the IP blocked again right after delisting.
  4. Ask for delisting with the Outlook.com delisting form: give the IP and paste the full bounce. The first reply is often an automatic “not eligible”: reply to that email with the details it asks for so a person reviews it.
  5. If the IP is new to you, ask your hosting provider for a short note confirming when it was assigned to you; providers such as Hetzner supply one for exactly this case.
  6. Sign up for Microsoft SNDS (IP reputation data) and JMRP (complaint reports). They don't delist you, but they show problems early.
  7. If you only send a few hundred mails a day, sending through an established service (Amazon SES, Postmark, Mailgun, Brevo or your mailbox provider's SMTP) avoids IP reputation problems altogether.

Check your domain now

Running your own mail server or VPS? I audit and harden it (SSH, firewall, fail2ban, updates) and send a before/after security report.

Get your server secured on Fiverr

Prefer to do it yourself? VPS Security Kit ($19) – audit script, lock-out-safe hardening script, 13-page guide.

Other bounce errors