What the bounce says
Exact wording as it appears in the rejection or NDR. Placeholders such as x.x.x.x and example.com stand for your own address and domain.
550 DY-001 Mail rejected by Outlook.com for policy reasons. We generally do not accept email from dynamic IPs as they are not typically used to deliver unauthenticated SMTP e-mail to an Internet mail server. 550 DY-002 Mail rejected by Outlook.com for policy reasons. The likely cause is a compromised or virus infected server/personal computer.
Outlook.com does not accept mail directly from IP addresses that look like consumer or dynamic assignments, because almost all such traffic is from infected machines. DY-001 is that policy applied to your sending IP; DY-002 adds that the address looks compromised.
Most common causes
- Mail is sent directly from a home or small-office connection
- The hosting range is registered as dynamic or has generic PTR names
- The PTR record looks auto-generated (contains the IP or "dyn", "pool", "dhcp")
- No PTR at all
What to verify next
- Send through your provider’s SMTP relay or a sending platform instead of directly
- If the IP is static, get the provider to set a proper PTR under your domain
- Ask the provider to correct the range classification
- Verify PTR and HELO with the reverse DNS auditor
How an IP is classified dynamic
Provider allocation records, PTR names that embed the address or words like dyn, pool, dhcp or ppp, and absence of any PTR all mark an IP as dynamic. A static business address on a range the provider registers as residential is still treated as dynamic.
Sending directly from an office connection or a home lab produces this immediately.
- PTR naming and allocation records decide the classification.
- Static addresses on residential ranges are still affected.
- No PTR counts as dynamic.
The reliable fix
Do not send directly from that address. Relay through your ISP’s SMTP server, a hosted mailbox provider, or a sending platform. That is what Microsoft expects and it also gives you authenticated, reputable infrastructure.
If you must send directly
Obtain a genuinely static address on a business range, have the provider publish a PTR under your domain, make the HELO match, and warm the address slowly. Even then, some receivers keep the range classification.
Best diagnostic path
Mail Failure Doctor
Classify the complete rejection and preserve provider-specific diagnostic context.
Open analysis → Live analysisReverse DNS & HELO Auditor
Check reverse identity, forward confirmation and SMTP greeting consistency.
Open analysis → Live analysisEmail Infrastructure Digital Twin
Map the domain’s public mail infrastructure and provider relationships before remediation.
Open analysis →Known limits
- Range classification is the provider’s and cannot be changed by the sender.
- DY-002 usually indicates compromise; check the host first.
Common questions
Can Microsoft reclassify my IP?
Rarely. The classification comes from allocation data; relaying through proper infrastructure is the practical path.
Does a PTR fix it?
It helps if the address is genuinely static on a business range. On a residential range, no.
What is DY-002?
The same policy plus an indication that the address appears compromised. Scan the host before anything else.
Why the exact message matters
The same status family can be triggered by different conditions, and providers frequently add diagnostic text that narrows the issue. Use the complete rejection text rather than treating the numeric code as a complete diagnosis.
Provider reference
For the provider-defined meaning and current requirements, review Microsoft Outlook.com sender troubleshooting.