Configuring postfix to relay mails to Microsoft domains (outlook, hotmail, live...)

dan-v · Feb 26, 2026 at 2:01 PM

It appears that Microsoft has deprecated the current password-protected scheme to authenticate legitimate emails. As a result, any email sent through the ISPConfig server by a user, to one of Microsoft email addresses (outlook.com, hotmail.com, live.com etc.) suffers a rejection with code 550 5.7.1 with (I am told) a misleading message about the sending IP address being on their blocklist.

From articles available on the net, it appears that postfix must be enhanced to use Oauth2 authentication, for these transmissions to succeed .

Is there such a configuration option in ISPConfig 3 ? If not, does anybody know of a workaround ?

till · Feb 26, 2026 at 2:50 PM

I doubt your claims, as it would mean that Microsoft would reject nearly 100% of all emails from now on. Also, relaying and sending emails to microsoft are two different things and the rejection message you posted is not about relaying as far as I see, its about sending emails to an MS hosted account. Plus, I do not have any issues sending to email domain hosted on a Microsoft service like outlook.com. Here a short summary from ChatGPT:

You’re right to doubt it. For normal “server-to-server” email delivery from your ISPConfig/Postfix host to Microsoft MX servers (hotmail/outlook/live), OAuth2 is not used and will not fix a 550 5.7.1 block. OAuth2 only matters when you are authenticating as a client to Microsoft’s SMTP submission service (SMTP AUTH), e.g. sending through Microsoft 365/Outlook.com SMTP with a username/password.

Why OAuth2 is (usually) irrelevant here
Mail sent from your Postfix to outlook.com recipients is delivered over standard SMTP between mail servers. That flow does not use “SMTP AUTH” at all. The receiving side decides to accept/reject based on things like IP/domain reputation and authentication of the message (SPF/DKIM/DMARC), not on OAuth2.

The specific error you mention—550 5.7.1 with the “part of their network is on our block list (S3150)” style text—is widely reported as an Outlook/Hotmail IP/reputation block message, not an SMTP AUTH failure. (Microsoft Learn)

Where Microsoft is deprecating password-based auth (and when OAuth2 matters)
Microsoft is deprecating Basic Authentication for SMTP AUTH in Exchange Online (Microsoft 365). That affects scenarios like:

devices/apps/scripts authenticating to smtp.office365.com with username/password

authenticated relays via Microsoft 365 using SMTP AUTH

Microsoft’s own timeline (as of Jan 29, 2026) describes SMTP AUTH Basic Auth being disabled by default later (end of 2026) and OAuth being the supported method. (TECHCOMMUNITY.MICROSOFT.COM)
And Microsoft provides docs on using OAuth with IMAP/POP/SMTP as a client, i.e., authenticating to Microsoft. (Microsoft Learn)

That’s a different problem than “my Postfix sends directly to outlook.com and gets 550 5.7.1”.

What to do for 550 5.7.1 “blocked / S3150” to Microsoft consumer domains
This is generally solved by deliverability/reputation work, not OAuth2:

Ensure SPF is correct for the sending domain(s)

Enable DKIM signing for outgoing mail (ISPConfig supports this)

Publish DMARC

Set correct PTR/rDNS (reverse DNS matches your sending host), valid HELO, and consistent hostname

Make sure the server isn’t behaving like an open relay and that outbound is clean (no compromised account spamming)

If Microsoft has blocked the IP, follow their delisting / remediation guidance (often the message or related guidance points to delisting). (Microsoft Learn)

Quick way to “verify” which case you’re in
Look at your Postfix logs for the failed delivery:

If Postfix connects to something like hotmail-com.olc.protection.outlook.com on port 25 and gets 550 → server-to-server block (OAuth2 irrelevant).

If Postfix connects to smtp.office365.com / Microsoft 365 as a smarthost and fails authentication → SMTP AUTH issue (OAuth2 may be required, depending on tenant settings and timeline). (TECHCOMMUNITY.MICROSOFT.COM)

Bottom line: The forum claim “Postfix must be enhanced to use OAuth2 for mail to outlook.com/hotmail.com” is not correct in the general case. OAuth2 is for authenticating to Microsoft’s submission service, not for delivering mail to Microsoft recipients. The 550 5.7.1/S3150 symptom points to IP reputation/blocking, so focus on SPF/DKIM/DMARC/rDNS and Microsoft delisting/remediation. (Microsoft Learn)
Click to expand...

So what you need is proper PTR/SPF/DKIM/DMARC setup and when the email originates from your server, the user sending it should be password authenticated.

dan-v · Feb 26, 2026 at 4:33 PM

I think you are correct, Till. This is BS that my ISP has been feeding me to exonerate themselves of having to properly manage their IP addresses reputations. Duly forwarded and Thanks

BTW, all this

So what you need is proper PTR/SPF/DKIM/DMARC setup and when the email originates from your server, the user sending it should be password authenticated.
Click to expand...

is ok, and everything had been working well for 9 months until a few days ago - and there was no change made on my side. The conclusion seems obvious

Log in or Sign up

Configuring postfix to relay mails to Microsoft domains (outlook, hotmail, live...)

dan-v Member

till Super Moderator Staff Member ISPConfig Developer

dan-v Member

Share This Page

Log in or Sign up

Configuring postfix to relay mails to Microsoft domains (outlook, hotmail, live...)

dan-v Member

till Super Moderator Staff Member ISPConfig Developer

dan-v Member

Share This Page

Useful Searches