# How do you block a sender or domain in Microsoft 365?

URL: https://iblockspam.com/blog/block-sender-or-domain-microsoft-365
Last updated: 2026-10-09
Published: 2026-10-09
Topic: Running email day to day
Author: iBlockSpam Team

> Block an email address or domain in Microsoft 365 with the Tenant Allow/Block List, anti-spam policies, mail flow rules or Outlook, and how long blocks last.

## Short answer

Use the Tenant Allow/Block List in the Microsoft Defender portal at security.microsoft.com/tenantAllowBlockList. On the Domains & addresses tab, select Add, then Block, enter the address or domain and choose an expiry. Blocks last 30 days by default, up to 90 days, or never. Users can also block senders for their own mailbox in Outlook.

Microsoft 365 gives you five places to block a sender, and they behave differently. Some quarantine the mail, some send it to Junk Email, some also stop your staff from writing back, and some quietly expire after 30 days.

This guide shows which to use, the exact steps in the Defender portal and PowerShell, and how long each block lasts. If you want the opposite, see our guide to [allowing a sender safely](https://iblockspam.com/blog/whitelist-sender-microsoft-365-google-workspace).

## Which blocking method should you use in Microsoft 365?

Microsoft lists the options from most to least recommended ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/create-block-sender-lists-in-office-365)):

1. Block entries for domains and email addresses in the Tenant Allow/Block List.
2. Outlook Blocked Senders, which affect one mailbox.
3. Blocked sender or blocked domain lists in anti-spam policies.
4. Exchange mail flow rules (transport rules).
5. The IP Block List in the default connection filter policy.

Here's how they compare:

| Method | Who it affects | What happens to the mail | How long it lasts |
|---|---|---|---|
| Tenant Allow/Block List | Whole organization | Marked high confidence phishing and quarantined | 30 days by default; up to 90 days or never |
| Outlook Blocked Senders | One mailbox | Treated as spam (`SFV:BLK`); Junk Email or quarantine per policy | Until removed |
| Anti-spam policy blocked lists | Recipients the policy covers | Marked high confidence spam; the policy's action applies | Until removed |
| Mail flow rule | Whatever the conditions match | Whatever the action says: reject, delete, quarantine | Until removed or disabled |
| Connection filter IP Block List | Whole organization | Blocked by source IP | Until removed |

For most admins, the answer is the Tenant Allow/Block List. Use the others only when it can't do what you need.

## How do you block a sender with the Tenant Allow/Block List?

You need the Security Administrator role, Organization Management, or another role Microsoft lists for the Tenant Allow/Block List ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/tenant-allow-block-list-email-spoof-configure)).

1. In the Microsoft Defender portal, go to **Email & collaboration** > **Policies & rules** > **Threat policies** > **Tenant Allow/Block Lists** in the **Rules** section. The direct link is `https://security.microsoft.com/tenantAllowBlockList`.
2. Check that the **Domains & addresses** tab is selected.
3. Select **Add**, then **Block**.
4. In **Domains & addresses**, enter one address or domain per line, up to 20 at a time.
5. Under **Remove block entry after**, choose **1 day**, **7 days**, **30 days** (the default), **Never expire** or **Specific date** (at most 90 days ahead).
6. Add a note saying why, so the next admin knows. Then select **Add**.

Microsoft says an entry "should be active within 5 minutes." The same thing in Exchange Online PowerShell:

```powershell
New-TenantAllowBlockListItems -ListType Sender -Block `
  -Entries "invoices@bad-example.com","bad-example.net" `
  -NoExpiration `
  -Notes "Invoice fraud attempts, ticket 1042"
```

Use `-ExpirationDate` instead of `-NoExpiration` for a temporary block. To review what's there, run `Get-TenantAllowBlockListItems -ListType Sender -Block`. To remove an entry, run `Remove-TenantAllowBlockListItems -ListType Sender -Entries "bad-example.net"`.

### What a Tenant Allow/Block List block does

Microsoft's Tenant Allow/Block List article says mail from blocked domains and addresses is "marked as *high confidence phishing* and then moved to quarantine" ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/tenant-allow-block-list-about)). Microsoft's older blocklist overview still says these messages are marked high confidence spam and handled by the anti-spam policy, but both Tenant Allow/Block List articles say high confidence phishing. Users can't release high confidence phishing themselves, so you'll handle any mistakes. Some other points:

- **It checks the From address.** Entries apply to the `5322.From` address users see, not the envelope sender (`5321.MailFrom`).
- **It covers internal and external senders.**
- **It blocks outbound mail too.** Your users can't send to a blocked domain or address. They get `550 5.7.703 ... blocked by your organization using Tenant Allow Block List`, and the whole message is refused for every recipient, even if only one matched.
- **Subdomains need their own entry.** Microsoft notes that an entry for `contoso.com` blocks only `contoso.com`, and `*.contoso.com` blocks subdomains but not the domain itself. Add both to cover everything.
- **Blocks beat allows.** In the Tenant Allow/Block List, "block entries take precedence over allow entries."

### Entry limits

Limits depend on your licence ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/tenant-allow-block-list-email-spoof-configure)):

| Subscription | Block entries for domains and addresses |
|---|---|
| Microsoft 365 without Defender for Office 365 | 500 |
| Defender for Office 365 Plan 1 | 1,000 |
| Defender for Office 365 Plan 2 | 10,000 |

If you're close to the limit, you're probably blocking individual spam addresses that change every day. That's a sign the filter needs tuning, not a longer list.

## How long does a block last?

This is the detail that catches people out. A Tenant Allow/Block List block on a domain or address expires after **30 days** unless you change it. You can pick up to 90 days, or **Never expire**. Blocks for spoofed senders and IP addresses never expire ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/tenant-allow-block-list-about)).

Blocks you create from the **Submissions** page, by selecting **Block all emails from this sender or domain**, also land in the Tenant Allow/Block List, so the same 30-day default applies.

Outlook Blocked Senders entries, anti-spam policy lists and mail flow rules don't expire. They stay until someone removes them, which is its own problem: old blocks pile up and nobody remembers why. Add notes and review the lists every quarter.

## When should you use an anti-spam policy block list instead?

Use the **Blocked** senders and domains lists in an anti-spam policy when you want to stop inbound mail but still let staff write to that domain. Microsoft points to this list for exactly that case ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/anti-spam-protection-about)).

Messages from listed senders are marked **High confidence spam**, and the policy's action for that verdict applies ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/create-block-sender-lists-in-office-365)). In the default policy, that action is Junk Email. In the Standard and Strict preset policies, it's quarantine.

1. Go to **Email & collaboration** > **Policies & rules** > **Threat policies** > **Anti-spam** (`https://security.microsoft.com/antispam`).
2. Open the policy, then edit the **Allow & block list** section.
3. Under **Blocked**, select **Manage (nn) sender(s)** or **Block domains**, add the entries and save.

Two catches. The lists hold about 1,000 entries, and the portal accepts only 30, so use PowerShell for more. And you can't add blocked lists to the Standard or Strict preset policies, whose settings override custom policies for anyone they cover ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/anti-spam-policies-configure)). If you use presets, this method may do nothing for those users.

## When does a mail flow rule make sense for blocking?

A mail flow rule earns its place when you need something the lists can't do:

- Reject with a custom bounce message instead of quarantining.
- Match on more than the sender, such as a subject phrase plus a sender domain.
- Check the envelope sender as well as the From address.

The **SenderDomainIs** condition "matches domains and subdomains," and `SenderAddressLocation` lets you check the header, the envelope or both ([Microsoft Learn](https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/new-transportrule?view=exchange-ps)). Start in audit mode so you can see what it would catch:

```powershell
New-TransportRule -Name "Block bad-example.com" `
  -SenderDomainIs "bad-example.com" `
  -SenderAddressLocation HeaderOrEnvelope `
  -RejectMessageReasonText "Mail from this domain is not accepted." `
  -Mode Audit
```

`Audit` writes what the rule would have done to the message trace logs without touching delivery. When you're happy, switch it with `Set-TransportRule -Identity "Block bad-example.com" -Mode Enforce`. If you'd rather set a custom enhanced status code, `-RejectMessageEnhancedStatusCode` accepts `5.7.1` or `5.7.900` to `5.7.999`, but Microsoft's reference says combining it with `-RejectMessageReasonText` resets one of the two to a default value, so use one or the other.

Microsoft's warning applies: "It's easy to create rules that block too many messages or that don't block enough messages." Use specific conditions and watch the rule's hits. For a wider set of useful rules, see our guide to [mail flow rules for security](https://iblockspam.com/blog/microsoft-365-mail-flow-rules-for-security).

## How do users block a sender for their own mailbox?

When one person is bothered by one newsletter or contact, let them handle it. Users can add addresses and domains to their Blocked Senders list ([Microsoft Support](https://support.microsoft.com/office/9bf812d4-6995-4d19-901a-76d6e26939b0)):

- **New Outlook for Windows and Outlook on the web:** **Settings** > **Mail** > **Junk email**, add the address under **Blocked senders** or the domain under **Blocked domains**, then **Save**.
- **Classic Outlook for Windows:** right-click a message, then **Block** > **Block Sender**.

Microsoft stamps these messages with `SFV:BLK` and treats them as spam. They go to Junk Email or quarantine depending on the anti-spam policy ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/configure-junk-email-settings-on-exo-mailboxes)). Admins can manage the same list in PowerShell:

```powershell
Set-MailboxJunkEmailConfiguration -Identity "ori@example.com" `
  -BlockedSendersAndDomains @{Add="shopping@fabrikam.com"}
```

The `@{Add=...}` syntax keeps the user's existing entries. Without it, you overwrite the whole list.

## What about blocking by IP address?

Only as a last resort. Microsoft says to use the IP Block List in the default connection filter policy "*only then*" when the other options won't work, to keep it small, and to avoid ranges that belong to shared or consumer services ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/create-block-sender-lists-in-office-365)). It accepts IPv4 ranges from /24 to /32. One IP often sends for thousands of unrelated senders, so a careless entry blocks real mail.

## Why doesn't blocking stop most spam?

Blocking works on senders who keep the same address: a persistent marketer, a former supplier, a harasser. It does little against spam and phishing campaigns, which rotate addresses and domains faster than you can add them. A block also checks the From address, which an attacker can choose.

So pair each block with a report. Microsoft advises submitting blocked messages for analysis, because confirmed bad sources get blocked for everyone without list upkeep ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/create-block-sender-lists-in-office-365)). Before you block, read the headers in our [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer) to check the real sending domain. Our guide to [Microsoft 365 spam headers](https://iblockspam.com/blog/microsoft-365-spam-headers-explained) explains what each value means. If a flood of sign-up confirmations is the problem, blocking won't keep up. See our guide to [email bombing](https://iblockspam.com/blog/email-bombing-subscription-bombing) instead.

If you need blocks applied before mail reaches Microsoft 365, a filtering gateway on your MX keeps its own lists. iBlockSpam's [approved and blocked sender lists](https://iblockspam.com/features/allow-block-lists) are one example.

## Next steps

1. Open `https://security.microsoft.com/tenantAllowBlockList` and review existing block entries, their expiry dates and notes.
2. Move permanent blocks to **Never expire** on purpose, and let temporary ones lapse.
3. Find old mail flow rules that block senders, and replace simple ones with Tenant Allow/Block List entries.
4. Submit the messages behind each block to Microsoft from the **Submissions** page.
5. If spam keeps getting through despite blocks, work through [why spam gets through Microsoft 365](https://iblockspam.com/blog/microsoft-365-spam-getting-through).

Browse more guides on [running email day to day](https://iblockspam.com/blog/topic/operations).

## Frequently asked questions

### Does blocking a domain in the Tenant Allow/Block List also block its subdomains?

No. Microsoft says a block entry for contoso.com blocks only contoso.com, and an entry for *.contoso.com blocks its subdomains but not contoso.com itself. To block a domain and every subdomain, add both entries. A mail flow rule condition that checks the sender domain, by contrast, matches subdomains automatically.

### How long does a blocked sender entry last in Microsoft 365?

In the Tenant Allow/Block List, block entries for domains and addresses expire after 30 days by default. You can choose 1 day, 7 days, a specific date up to 90 days ahead, or Never expire. Blocked spoofed senders and IP address entries never expire. Mail flow rules and Outlook Blocked Senders entries stay until someone removes them.

### Can users in my organization still email a domain I blocked?

Not if you blocked it in the Tenant Allow/Block List. Those entries also stop outbound mail, and senders get a 550 5.7.703 bounce. The whole message is blocked, even if only one recipient matches. If staff must keep writing to the domain, block it with the blocked domains list in an anti-spam policy instead.

### Why do emails from a blocked sender still arrive?

Usually because the sender changed address or domain, or because the block checks a different address than you expect. Tenant Allow/Block List entries match the From address shown to users, not the envelope sender. Also check for allow entries, Safe Senders or a mail flow rule that delivers the mail before your block takes effect.

### Is it better to block spam senders or report them to Microsoft?

Do both. Microsoft recommends submitting the messages in your blocklists for analysis, because if Microsoft finds the source harmful it can block it for you, with no list for you to maintain. A block entry gives you immediate control while the submission is reviewed. Spammers rotate addresses, so reporting tends to matter more over time.

## Sources

- [Microsoft Learn: Create blocklists for inbound email in Microsoft 365](https://learn.microsoft.com/en-us/defender-office-365/create-block-sender-lists-in-office-365)
- [Microsoft Learn: Allow or block email using the Tenant Allow/Block List](https://learn.microsoft.com/en-us/defender-office-365/tenant-allow-block-list-email-spoof-configure)
- [Microsoft Learn: Manage allows and blocks in the Tenant Allow/Block List](https://learn.microsoft.com/en-us/defender-office-365/tenant-allow-block-list-about)
- [Microsoft Learn: Anti-spam protection (allow and block lists in anti-spam policies)](https://learn.microsoft.com/en-us/defender-office-365/anti-spam-protection-about)
- [Microsoft Learn: Configure junk email settings on Exchange Online mailboxes](https://learn.microsoft.com/en-us/defender-office-365/configure-junk-email-settings-on-exo-mailboxes)
- [Microsoft Learn: New-TransportRule](https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/new-transportrule?view=exchange-ps)
- [Microsoft Support: Block or unblock senders in Outlook](https://support.microsoft.com/office/9bf812d4-6995-4d19-901a-76d6e26939b0)

## Free tools for this guide

- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [MX Lookup](https://iblockspam.com/tools/mx-lookup): See where your mail is delivered, spot unfiltered backup MX and broken hosts.
- [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject.

---

Source: iBlockSpam, https://iblockspam.com/blog/block-sender-or-domain-microsoft-365 (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt