Microsoft 365 email checker: verify a company Outlook address
This Microsoft 365 email checker looks up the domain's MX to confirm it ends in mail.protection.outlook.com, then asks Exchange Online about the address and disconnects before anything is sent. When all of a domain's mailboxes are in Microsoft 365, unknown addresses are rejected with 550 5.4.1, so you get a clear answer. Hybrid and gateway setups often accept everything and come back risky.
Tuned for company domains whose MX ends in mail.protection.outlook.com. Five checks a minute, no account needed. Nothing is sent to the address — we ask its mail server whether the mailbox exists, then disconnect.
Sample result
jane@acme.example couldn't be confirmed. The domain accepts every address.
- jane@acme.example
- Reason
- Accepts all addresses
- Mail host (MX)
- Microsoft 365
What this means for you
Common for hybrid or migrating Microsoft 365 domains; risky means unconfirmed, not bad.
- Confirms the MX is Exchange Online
- Reads 550 5.4.1 as invalid
- Flags hybrid and gateway catch-alls
- Sends Outlook.com addresses to the right page
- Microsoft 365
- Exchange Online
- No signup
By SimpleVerifier Team · Last updated
How do I verify a Microsoft 365 email address?
- Enter one company address, such as
jane@acme.example. Consumer outlook.com and hotmail.com addresses belong in the Outlook checker. - Press Check. The domain's MX is looked up, and the Mail host line shows whether it points at Microsoft 365.
- The checker asks Microsoft about a made-up address first, then the real one, and disconnects.
- Valid means the mailbox was accepted and the made-up one rejected. Invalid means Microsoft said the recipient doesn't exist. Risky means it couldn't be confirmed.
Example
- You enter
- An illustrative address at a domain whose MX ends in mail.protection.outlook.com:
jane@acme.example. - You get
- Mail host "Microsoft 365" and a live verdict. Invalid with "Mailbox not found" when Exchange Online rejects the recipient (
550 5.4.1); risky with "Accepts all addresses" for hybrid, migrating or gateway-fronted domains. An outlook.com address is not probed and returns risky with "Provider hides mailbox status". - Limits
- Five checks a minute per IP address, one address at a time, no account needed.
Why can Microsoft 365 addresses be verified when Outlook.com ones can't?
They run on different systems. Business tenants receive mail at hosts ending in mail.protection.outlook.com; consumer outlook.com and hotmail.com use olc.protection.outlook.com. For a business domain whose mailboxes all live in Exchange Online, Microsoft's Directory-Based Edge Blocking rejects unknown recipients at the door with 550 5.4.1 Recipient address rejected: Access denied, and the checker reads that as invalid.
Consumer Microsoft mail has no published equivalent, so this checker, like the Outlook email checker, doesn't probe outlook.com, hotmail.com, live.com or msn.com and returns risky with "Provider hides mailbox status" once the other checks pass. Type one of those here and the result points you to the right page.
When does a Microsoft 365 domain accept every address?
When Microsoft can't know every mailbox. An organisation that keeps some mailboxes on its own Exchange servers (a hybrid setup) marks its domain as Internal Relay rather than Authoritative, as described in Microsoft's guide to managing accepted domains. Exchange Online then accepts mail for unknown addresses and passes it on. Migrations do the same for a while.
A gateway in front, such as Proofpoint or Mimecast, often accepts everything too and decides later. In each case the checker's made-up address is accepted, so the result is risky with "Accepts all addresses", not a valid you can't trust. If the MX names a gateway and SPF includes spf.protection.outlook.com, the result notes that the gateway answered.
What does 550 5.4.1 Recipient address rejected mean?
That the address doesn't exist in the organisation. Despite the words "Access denied", it's Microsoft 365's directory check, not a block on the sender's IP. The 550 5.4.1 reference has the full text and what to do when your own mail gets it.
If you see it for an address you're sure is right, check the spelling first, then ask the recipient whether it's an alias of another mailbox. Aliases are listed in the directory and accepted like any mailbox.
Who uses this tool, and for what?
- Enterprise prospectors
- In our B2B provider study, SPF showed Microsoft 365 behind at least 42.9% of S&P 500 domains. Check a guessed address there and see at once whether the domain answers clearly or accepts everything.
- Partner and channel teams
- Confirm a contact at a reseller or customer still has a mailbox before sending a contract or invoice.
- IT admins
- Check from outside that a domain rejects unknown recipients, which shows Directory-Based Edge Blocking is in effect.
What can’t this tool tell you?
- Hybrid (Internal Relay) and migrating domains accept every address and come back risky as catch-all.
- Behind a security gateway the gateway answers, not Microsoft.
- Consumer outlook.com, hotmail.com, live.com and msn.com addresses aren't probed.
- A shared mailbox, group or alias accepts mail like a personal one, so valid means the address receives mail, not that one person reads it.
- One address at a time, five a minute.
Common questions
- How do I know if a company uses Microsoft 365?
- Its MX record ends in mail.protection.outlook.com. The checker looks it up and shows it on the Mail host line; the email provider lookup does the same for a domain without checking an address.
- Why is my Microsoft 365 address risky and not valid?
- Usually because the domain accepts every address: a hybrid or migrating setup, or a gateway in front of Microsoft. It can also mean the address is a role inbox like info@, or Microsoft gave a temporary reply.
- Does this work for outlook.com and hotmail.com addresses?
- Those are consumer Microsoft accounts on a different system. They aren't probed and come back risky with "Provider hides mailbox status" once syntax, domain and disposable checks pass. The Outlook email checker explains why.
- Does the person see anything?
- No. The checker disconnects after the RCPT TO step, before any message is sent.
- Is the Microsoft 365 email checker free?
- Yes, five checks a minute with no account. For a list, sign in with Google for 100 free email checks, no card.
Sources
That was one address. Most people have a list.
The free checker does five addresses a minute, one at a time — fine for spot-checking, useless for a CSV of 40,000.
- Upload a CSV up to 100,000 rows
- Valid, risky and invalid exported as separate files
- Repeat checks free for 14 days, no new connections
One plan, cancel anytime, no contract. Sign in with Google and your first 100 email checks are free, no card. The free tools stay free either way.