@Mail Domain Check

Wallet login · Outlook / Hotmail · OTP safety

Crypto wallet verification email not received in Outlook

When a controlled Gmail recipient gets the message but an Outlook, Hotmail, or Live recipient does not, preserve the receiver split and trace one attempt before changing DNS or sending another code.

Treat the mailbox split as evidence, not a diagnosis

One Gmail success and one Outlook failure do not prove that Microsoft blocked the sender. They do justify separating recipient cohorts. Record the exact UTC attempts, provider message IDs, recipient domains, message type, template version, sending route, and outcome without publishing an address or secret code.

All recipients fail
Start at the application, queue, template, provider account, suppression, and sender route.
One receiver family fails
Compare SMTP replies, sending IPs, authentication identities, volume, and receiver evidence for that cohort.
Provider says delivered
The receiving server accepted the message. Inbox visibility, quarantine, rules, forwarding, and user access remain unproven.
Code arrived but fails
Treat expiration, invalidation by a newer code, duplicate use, and security-scanner prefetch as a separate boundary.

Build the incident path locally. The tool needs only bounded evidence categories; do not enter a recipient, message, code, link, token, or credential.

Read the signed public Nostr incident path for the complete six-boundary workflow and reusable operations resources.

1. Prove one wallet-security event generated one message

  • Identify the login, device approval, withdrawal, password reset, or transaction event and one random internal correlation ID.
  • Confirm the intended template, locale, visible From identity, provider route, normalized recipient domain, and queue result.
  • Check worker errors, idempotency, regional routing, feature flags, rate limits, and whether a later retry invalidated the first secret.
  • Do not infer that an account row, API success, or queued job means the provider accepted a message.

2. Follow the provider message ID to a terminal or retrying event

Preserve processed, suppressed, dropped, delayed, bounced, or delivered events with timestamps. A suppression is an application or provider-side stop. A bounce or delay should carry an SMTP response. A delivered event usually means receiver acceptance, not inbox placement.

If Gmail and Outlook attempts used different sending IPs, subaccounts, regions, Return-Path domains, or templates, the recipient domain is not the only changed variable. Compare the complete route before escalating to the receiver.

3. Preserve the Outlook SMTP response

Keep the three-digit reply, enhanced status code, complete diagnostic text, receiving host, sending IP, and attempt time. Decode the response before retrying. A 4xx reply is temporary for that attempt; a 5xx reply is permanent for that attempt and should not be handled with an aggressive retry loop.

Microsoft documents 550 5.7.515 for high-volume Outlook.com consumer mail that does not meet its authentication level. That specific code supports an SPF, DKIM, and DMARC investigation. Its absence does not prove authentication or placement is healthy.

If the complete NDR instead contains 550 5.7.1 and S3150, follow the Microsoft sending-IP block-list path. That marker identifies an IP-reputation rejection, not an authentication verdict.

Decode the bounded SMTP diagnostic locally, then retain the original provider event as the authoritative record.

4. If Microsoft accepted the message, inspect receiver evidence

  1. Check Junk, quarantine, focused or other views, rules, aliases, forwarding, blocked senders, and mailbox storage in the mailbox interface.
  2. When the message is visible, export the complete original header and read the final trusted Authentication-Results plus newest Received fields.
  3. Compare visible From, SPF MAIL FROM, DKIM d=, DMARC alignment, sending IP, and timestamps with the successful Gmail control.
  4. For a sender-side pattern, use Microsoft's sender troubleshooting, reputation, complaint, and support evidence. Do not ask the affected user to forward a live OTP or security link.

The browser-local header analyzer structures authentication and routing fields without uploading the pasted header.

5. Verify the exact production sending path

  • Confirm the observed sending IP is authorized for the envelope identity and that SPF does not have duplicate records or exceed its lookup budget.
  • Check the actual DKIM selector from a delivered or attempted production message instead of guessing a default selector.
  • Require at least one passing SPF or DKIM identity to align with the visible From domain for DMARC.
  • Verify PTR and forward DNS for the actual public sending IP, then review complaint, consent, bounce, and volume evidence separately from public DNS.

Use the focused Outlook authentication guide when the domain approaches Microsoft's documented high-volume threshold or returns 5.7.515.

Recover without weakening wallet security

After fixing the first unproven boundary, send one new controlled message through the same production route. Invalidate older codes according to the product's security model, show which request is current, and keep rate limits and account-risk controls active. A fallback channel should be independently secured and monitored; it should not silently bypass withdrawal, device, or login protections.

Never request or publish a recipient address, OTP, verification URL, password, session token, seed phrase, private key, wallet signature, provider API key, SMTP password, or complete account log.

Primary references