Account for every recipient when a tenant sender block rejects outbound mail

Source facts

Tenant Allow/Block List domain and email-address blocks quarantine incoming messages from those senders as high-confidence phishing. They also prevent organizational users from sending to the blocked destinations. The documented outbound rejection is 550 5.7.703. If even one recipient matches a block entry, the entire message is blocked for all its internal and external recipients. Microsoft Learn.

Applicability

This concerns ordinary domain and email-address block entries, not the separate spoofed-sender pairing mechanism. Review it when a protective block unexpectedly disrupts a conversation containing additional recipients.

DSE recommendation

Review the outbound recipient impact of a domain or address block before treating it solely as inbound protection. During an incident, preserve the reason for the block while explaining its wider effect to the mail owner. For a rejected multi-recipient message, reconcile the full intended recipient set rather than assuming that everyone except the blocked destination received a copy. Any resend should follow the approved response decision, not automatically remove the protective entry.

Verification

Compare the non-delivery report with the exact configured entry and the original recipient list. In an authorized test, use safe controlled addresses to verify the expected all-recipient rejection without contacting a suspected malicious destination. Document the recipients requiring an approved alternate communication and whether that communication was actually completed. Keep the block’s security rationale separate from the delivery recovery record so neither successful resending nor a help-desk closure is mistaken for removal of the underlying threat.

Official references

Microsoft Learn: Tenant domain and address blocks. Source reviewed September 9, 2026.