Business mail platform · Microsoft 365
Verifying addresses at Microsoft 365 domains
Can you verify addresses at domains behind Microsoft 365?
Depends on the domainIt depends on the company. Domains behind Microsoft 365 are probed like any other.
Microsoft 365 answers for the company's own mail rules, so the checker treats every domain on its own: it offers a random address first, and if that is accepted the domain is catch-all and results come back risky ("Accepts all addresses"). Otherwise your address gets a per-mailbox answer. It always checks the syntax, the domain's MX records, disposable domains and role addresses such as info@ first.
Mailbox existsMailbox not foundAccepts all addressesCheck one address
Five checks a minute, no account needed. Nothing is sent to the address — we ask its mail server whether the mailbox exists, then disconnect.
Company domains with an MX at <token>.mail.protection.outlook.com run on Microsoft 365. When every mailbox lives in Exchange Online, Microsoft rejects unknown recipients with 550 5.4.1, so a mailbox check gives a clear answer. Unlike consumer Outlook.com, these domains are probed like any other.
Live DNS snapshot: microsoft.com
Checked 21 October 2026, 07:23 UTCmail.protection.outlook.com is an MX host suffix, not a mail domain, so this is microsoft.com: a domain whose mail runs through Microsoft 365. Read from DNS at the time shown and refreshed at most once a day.
- 10
microsoft-com.mail.protection.outlook.comMicrosoft 365
First MX host belongs to Microsoft 365.
v=spf1 include:_spf-a.microsoft.com include:_spf-b.microsoft.com include:_spf-c.microsoft.com include:_spf-ssg-a.msft.net include:_spf1-meo.microsoft.com -allp=reject: meets the requirement and enforces it.
v=DMARC1; p=reject; pct=100; rua=mailto:itex-rua@microsoft.com; ruf=mailto:itex-ruf@microsoft.com; fo=1Look up any other domain with the MX lookup or the email provider lookup.
Microsoft 365 at a glance
| Operated by | Microsoft, through Exchange Online in Microsoft 365Source: Microsoft: external DNS records for Microsoft 365 |
|---|---|
| MX hosts | <MX token>.mail.protection.outlook.comSource: Microsoft: external DNS records for Microsoft 365 |
| Address rule | Directory-Based Edge Blocking rejects unknown recipients with 550 5.4.1 Recipient address rejected: Access deniedSource: Microsoft: Directory-Based Edge Blocking |
| Address rule | Edge blocking works only on an Authoritative accepted domain; Microsoft advises Internal relay until a migration finishesSource: Microsoft: Directory-Based Edge Blocking |
Why Microsoft 365 domains are usually per-mailbox
Domains with an MX at <token>.mail.protection.outlook.com run on Exchange Online. When every user is in Exchange Online, Directory-Based Edge Blocking is already on and rejects unknown recipients with 550 5.4.1. Despite the wording, that reply means the address doesn't exist, not that you are blocked.
During migrations or hybrid setups, Microsoft advises leaving the accepted domain on Internal relay until every user is synced, and blocking applies only once it is Authoritative. Microsoft also notes rare cases where non-existent addresses get through. A domain in that state accepts addresses that don't exist, so its results look catch-all.
What our checker does behind Microsoft 365
SimpleVerifier doesn't skip or special-case Microsoft 365. For each company domain it offers a random address that can't exist, then your address, and disconnects without sending. If the random address is accepted, the domain is catch-all and its results come back risky with "Accepts all addresses". If it is rejected, your address gets a real answer for that mailbox.
This is the business service only. Consumer outlook.com, hotmail.com, live.com and msn.com use olc.protection.outlook.com hosts, and our checker never probes those by design; see the Outlook.com page.
Cleaning a list full of Microsoft 365 domains
Split the list by domain, not by platform. Two companies on Microsoft 365 can behave in opposite ways, so a catch-all result at one says nothing about the next. The bulk catch-all checker finds which domains in a list accept everything before you spend time on single addresses.
For catch-all domains, keep addresses with recent replies or sign-ups and send the rest in a small first batch, suppressing anything that hard-bounces. For per-mailbox domains, trust the verdict: invalid addresses will bounce, and valid ones were accepted by the company's own directory. Accept-all vs unknown results covers the difference.
Common questions
- Can you verify addresses at domains behind Microsoft 365?
- It depends on the company. Domains behind Microsoft 365 are probed like any other. Microsoft 365 answers for the company's own mail rules, so the checker treats every domain on its own: it offers a random address first, and if that is accepted the domain is catch-all and results come back risky ("Accepts all addresses"). Otherwise your address gets a per-mailbox answer. It always checks the syntax, the domain's MX records, disposable domains and role addresses such as info@ first.
- How do I know if a company uses Microsoft 365?
- Look up the domain's MX records. A first MX host ending in mail.protection.outlook.com means mail goes through Microsoft 365. The email provider lookup and MX lookup tools show it for any domain.
- Are domains behind Microsoft 365 catch-all?
- Some are and some aren't; it depends on how each company configured Microsoft 365. A verifier can tell by offering a random address that can't exist: if the domain accepts it, the domain is catch-all and single addresses there can't be confirmed.
- What does 550 5.4.1 Access denied mean at a Microsoft 365 domain?
- Microsoft documents it as the reply Directory-Based Edge Blocking gives for a recipient that isn't in the organisation's directory. It means the address doesn't exist, so treat it as invalid.
Related tools
Got a list with Microsoft 365 addresses?
Upload the CSV and see how it splits into valid, risky and invalid before you pay. Then clean it with a one-time pack: $9 for 2,500 emails, credits that never expire.