How do you block emails by country or top-level domain?

Blocking whole countries or whole domain endings sounds like a quick win against spam. It can be, if you understand what each control actually checks. A country filter looks at the sending server's IP address, while a top-level domain block looks at the text of the sender's address, and both catch legitimate mail if you choose carelessly.

This guide explains the difference, shows the exact settings in Microsoft 365 and Google Workspace, and gives a safe procedure for picking what to block.

Can you block email by country or top-level domain?

Yes, but they are two different controls. A country filter acts on the geographic location of the server that delivered the message. A top-level domain (TLD) block acts on the last label of the sender's email domain, such as .xyz in sales@offers.xyz.

Neither control knows who the sender is. Both are blunt filters that reduce noise when legitimate mail never comes from the place or ending you block.

What is a top-level domain, and how is it different from a country?

A top-level domain is the rightmost part of a domain name. IANA, which manages the DNS root, lists every one in its Root Zone Database and labels each as generic, country-code, sponsored or similar. Generic TLDs include .com, .net and newer ones like .xyz. Country-code TLDs (ccTLDs) are two letters, such as .de or .ru.

A ccTLD doesn't tell you where a sender is. IANA classifies .io as a country-code TLD (IO is the code for the British Indian Ocean Territory), yet many software companies use it. Blocking .ru stops addresses ending in .ru. It does nothing about a sender in Russia using a .com address on a US-hosted server.

A country filter is different. Microsoft 365 records the source country in the X-Forefront-Antispam-Report header as CTRY, which Microsoft defines as "the source country/region as determined by the connecting IP address, which might not be the same as the originating sending IP address" (Microsoft Learn). An example header might contain:

X-Forefront-Antispam-Report: CIP:203.0.113.25;CTRY:XX;LANG:en;SCL:5;SRV:;IPV:NLI;SFV:SPM;...

That's an illustrative value; 203.0.113.25 is a documentation address. Paste a real header into the Email Header Analyzer to see the fields for your own mail.

Should you block email by country?

Sometimes. Microsoft offers the setting but says "we have no specific recommendation for this setting", and it's off in the default policy and in the Standard and Strict preset policies (Microsoft Learn).

A country filter makes sense when all of these are true:

• You have no customers, suppliers, staff or partners in that country.
• Your recent mail logs show no wanted mail from servers there.
• You're happy to release the occasional false positive from quarantine.

It makes less sense when you trade internationally, when staff travel, or when your problem is phishing rather than volume spam. Phishing and business email compromise often arrive through large cloud mail services and compromised accounts, which deliver from countries you can't block. For those, authentication and impersonation checks matter more; see how to stop phishing in Microsoft 365.

How do I block email from a country in Microsoft 365?

The setting lives in each inbound anti-spam policy, at the time of writing (October 2026).

1. Open the Microsoft Defender portal at https://security.microsoft.com/antispam (Email & collaboration > Policies & rules > Threat policies > Anti-spam).
2. Open the default inbound policy or a custom one, and select Edit spam threshold and properties.
3. Under Spam properties, set From these countries to On.
4. Type each country name and select it from the list, then save.

Matching messages are "automatically identified as spam" (Microsoft Learn), and the policy's Spam action decides what happens next: Junk Email folder by default, or quarantine if you set it. Contains specific languages works the same way for message language.

In PowerShell, the parameters are EnableRegionBlockList and RegionBlockList, which takes ISO 3166-1 two-letter codes (Microsoft Learn). This example adds two placeholder codes without removing existing ones:

Set-HostedContentFilterPolicy -Identity "Default" -EnableRegionBlockList $true -RegionBlockList @{Add="XX","YY"}

Replace XX and YY with real codes. Two catches:

• Preset policies win. If users are in the Standard or Strict preset security policy, Microsoft says settings in default and custom anti-spam policies are ignored for them. Our guide to Microsoft 365 anti-spam policies explains the precedence.
• The connecting IP may be a relay. If your MX points to a filtering service, Microsoft 365 receives mail from that service, so CTRY can reflect the service's location. Set country rules on the service itself. Enhanced Filtering for Connectors helps Microsoft 365 see the original source IP for its checks, but Microsoft doesn't say whether the country filter uses it, so don't rely on it for country rules.

How do I block a whole top-level domain in Microsoft 365?

You have two options.

Tenant Allow/Block List

Microsoft's documentation states that "the wildcard syntax *.TLD is supported, where TLD can be any top-level domain" (Microsoft Learn).

1. Go to https://security.microsoft.com/tenantAllowBlockList, Domains & addresses tab.
2. Select Add > Block and enter, for example, *.xyz.
3. Choose Remove block entry after: 30 days is the default, or pick Never expire or a date up to 90 days ahead.

Blocked mail is marked high confidence phishing and quarantined. Know the side effect: users "also can't send email to these blocked domains and addresses", and the whole message bounces with 550 5.7.703. Our guide to blocking a sender or domain in Microsoft 365 covers expiry and limits.

Mail flow rule

A mail flow rule can quarantine inbound mail by pattern without blocking outbound mail. Use The sender > address matches any of these text patterns (FromAddressMatchesPatterns). Patterns aren't case sensitive, and SenderAddressLocation lets the rule check the From header, the envelope sender, or both (Microsoft Learn).

New-TransportRule -Name "Quarantine .xyz senders" -FromScope NotInOrganization -FromAddressMatchesPatterns '\.xyz$' -SenderAddressLocation HeaderOrEnvelope -Quarantine $true -Mode Audit

-Mode Audit logs matches without acting. Switch to Enforce once you've reviewed them. Our mail flow rules guide covers testing.

How do I block a TLD in Google Workspace?

Google's Blocked senders setting (Apps > Google Workspace > Gmail > Spam, Phishing and Malware) rejects the addresses or domains on its list (Google Workspace Admin Help). The page doesn't document wildcards or TLD entries, so use a content compliance rule for domain endings instead:

1. Go to Apps > Google Workspace > Gmail > Compliance and configure Content compliance.
2. Under messages to affect, choose Inbound.
3. Add an Advanced content match: location Envelope sender (or Sender header), match type Matches regex, value \.xyz$.
4. Choose Quarantine message while you test, or Reject message once you're confident.

Google uses RE2 regular expression syntax and limits each expression to 10,000 characters (Google Workspace Admin Help). Our content compliance rules guide walks through the editor.

We couldn't find a sending-country option in Google's Gmail admin documentation at the time of writing (October 2026). Content compliance rules can match a Source IP range, but that's a list of addresses you supply, not a country lookup.

How do you choose which countries and TLDs to block?

Base the list on your own mail, not on someone else's list.

1. Export 30 days of inbound mail data. In Microsoft 365 use message trace; in Google Workspace use Email Log Search.
2. List the sender domains and TLDs of mail people actually wanted. Include suppliers, customers, banks, payroll and software notifications.
3. Mark candidates that appear only in spam or not at all.
4. Start in a reversible mode: a mail flow rule in audit mode, a quarantine action, or a Tenant Allow/Block List entry with an expiry.
5. Check quarantine weekly for a month. Release and exempt anything legitimate. Our guide to false positives covers how.
6. Write down why each block exists, so the next admin doesn't remove it or extend it blindly.
7. Review twice a year. New suppliers and staff in new countries change the picture.

Don't block your own customers' countries to stop spam. And don't treat a TLD block as phishing protection: look-alike domains such as those in our lookalike domain guide usually use ordinary endings like .com.

When does a filter in front of your mailbox help?

Built-in settings are enough if you only need one or two TLD blocks. A filter at the MX level, such as a secure email gateway that receives mail before your mailbox provider does, helps when you want these rules applied consistently to every mailbox and alias, set in one place, with held mail visible to each user.

iBlockSpam includes geographic filters, attachment-type filters and custom domain rules in its advanced settings, plus a personal quarantine with scheduled digests, so a user can release a wrongly held message from a blocked country themselves. If you're weighing that against Microsoft's own tools, our comparison of Microsoft 365 built-in filtering vs a gateway sets out both sides.

Next steps

• Paste a few spam headers into the Email Header Analyzer and note the CTRY value and sender domain before you decide anything.
• Pull 30 days of mail logs and list the countries and TLDs your legitimate mail comes from.
• Add your first block in audit or quarantine mode, not reject.
• If you want country and attachment rules applied before mail reaches Microsoft 365, read Microsoft 365 built-in filtering vs a gateway.

Browse more guides on running email day to day.