Microsoft 365 IPs blocked by SenderScore on KloudEmail (Rackspace)
Overview
Some customers using KartHost KloudEmail (powered by Rackspace) may see bounce messages when receiving email from Microsoft 365 senders. The bounce typically looks similar to:
554 5.7.1 ACL dns_rbl; Client host [40.93.198.108] blocked using sa-ip4tset.blagr.emailsrvr.com=127.22.0.2 Senderscore. Please visit https://senderscore.org/rtbl/ for more information on why this message could not be delivered (G31)
Message rejected by: smtpXX.gate.[region].rsapps.net
This indicates that the Microsoft 365 outbound IP address is listed on the SenderScore/Validity blocklist, which Rackspace (and others) uses as part of its spam and security protections. When an IP is listed, Rackspace’s KloudEmail gateways reject the connection before the message reaches your mailbox.
KartHost is not blocking your domain or mailbox; this is a reputation issue with the sending Microsoft 365 server IP.
Why this happens
-
Microsoft 365 uses large shared pools of outbound IP addresses to send email.
-
Some of these IPs have recently been flagged on the SenderScore blocklist for spam or phishing‑related activity.
-
Rackspace (the infrastructure behind KloudEmail) queries SenderScore and other IP reputation services as part of its inbound spam filtering.
-
If the connecting Microsoft IP is on SenderScore’s list, Rackspace rejects the SMTP connection and you receive the 554 5.7.1 ACL dns_rbl error.
Important points:
-
Your KartHost KloudEmail service and domain are not globally blacklisted.
-
The block is tied to specific Microsoft 365 outbound IP addresses.
-
Multiple Microsoft IPs may be affected over time because Microsoft rotates outbound IPs.
Recommended long‑term fix (sender / Microsoft side)
The correct long‑term solution must be done by the sender’s IT team or email provider (e.g., Microsoft 365):
-
Identify the blocked IP
-
From the bounce, note the IP in brackets, for example:
[40.93.198.108].
-
-
Check and remediate IP reputation
-
The sender’s provider should investigate why that IP was listed (spam complaints, compromised accounts, misconfiguration, etc.).
-
They should follow SenderScore/Validity’s process to request delisting from the blocklist.
-
-
Microsoft 365 specific actions
-
Open a support ticket with Microsoft 365.
-
Provide the full bounce, including the IP and the SenderScore URL.
-
Request that Microsoft:
-
Clean up the affected IPs so they are removed from SenderScore’s list, and/or
-
Move the tenant’s outbound mail to clean IPs not currently listed.
-
-
Once the Microsoft IPs are removed from the SenderScore blocklist, Rackspace‑backed KloudEmail should accept messages from those IPs again, subject to normal spam and security checks.
Temporary workaround: safelisting Microsoft IP ranges
For time‑sensitive situations, there is a temporary workaround: Safelist broad Microsoft IP ranges at the domain level so messages from those ranges bypass spam filtering.
Example ranges commonly used for Microsoft 365 outbound mail:
-
40.107.%.%
-
52.101.%.%
-
52.103.%.%
-
40.93.%.%
When you add these ranges to the safelist for your domain in the KloudEmail/Rackspace control panel:
-
Messages from these Microsoft IP ranges will skip most spam scoring and filtering.
-
Messages will still be scanned for malware/viruses and trojans; the antivirus engine remains active.
-
Because these are broad ranges shared by many Microsoft tenants, this effectively trusts a large amount of traffic from Microsoft, not only one sender.
Risk of safelisting IP ranges
Pros:
-
Helps ensure that important email from Microsoft 365 senders can reach your KloudEmail mailboxes, even if some Microsoft IPs remain on SenderScore’s blocklist.
Cons:
-
Increases the chance of spam from any sender using those Microsoft IP ranges, because the spam filters treat them as “trusted.”
-
You may see more unwanted messages in your Inbox while the safelist is active.
For this reason, safelisting IP ranges should be considered a temporary workaround only. Once Microsoft has cleaned up their IPs and deliverability is restored, you should remove these IP ranges from your safelist.
How to safelist and later remove IP ranges (KloudEmail)
KartHost provides access to the KloudEmail Master Control Panel so you can manage safelists yourself.
1. Log in to the KloudEmail Master Control Panel
See:
-
Logging into the KloudEmail Control Panel
https://customercenter.karthost.com/knowledgebase/169/Logging-into-the-KloudEmail-Control-Panel.html
2. Learn the basic controls
See:
-
KloudEmail Control Panel Knowledgebase
https://customercenter.karthost.com/index.php/knowledgebase/28/KloudEmail-Control-Panel
3. Add or remove safelist entries
For email/domain safelists (and the same area where IP safelists appear):
-
Adding Email Address or Domain to Safelist
https://customercenter.karthost.com/knowledgebase/77/Adding-Email-Address-or-Domain-to-Safelist.html
In the Rackspace‑style interface (for IPs):
-
Go to Spam/Safelist settings for your domain.
-
In the “Safelisted IP Addresses” or equivalent section, use “Add” to enter an IP or IP range (for example,
40.93.%.%). -
To remove an IP or range later, select it in the list and choose “Remove,” then save.
(Your KloudEmail control panel layout may differ slightly; KartHost can assist if you are unsure where to enter these values.)
Best practice recommendation
-
Use IP‑range safelisting only as a short‑term measure when critical emails from Microsoft 365 senders are being blocked, and you fully understand the spam risk.
-
In parallel, insist that the sender’s IT provider or Microsoft 365 support address the root cause by cleaning up and delisting the affected IPs.
-
Once deliverability is restored and the IPs are no longer listed by SenderScore, remove the Microsoft IP ranges from your safelist to restore normal spam‑filtering behavior.
If you are a KartHost client and need help reviewing a specific bounce message or adjusting your safelist, please open a support ticket and include the full bounce (headers and error text).
(Created: March 4, 2026)
