Microsoft SNDS: why most senders misread it

Microsoft's Smart Network Data Services is the nearest thing to Postmaster Tools on the Microsoft side. It is genuinely useful — and comprehensively misunderstood. Teams frequently report “SNDS is green” while their placement to Outlook.com, M365, or Hotmail-origin mailboxes is failing. The mismatch is not a bug; it is structural.

What SNDS is, precisely

SNDS reports per-IP statistics for mail arriving at Microsoft's consumer mail properties:

• outlook.com, hotmail.com, live.com, msn.com consumer mailboxes
• Per-IP per-day aggregate counts
• Complaint rate estimate
• Spam trap hits (bucketed: None / Yellow / Red)
• Filter result distribution (green/yellow/red)

What SNDS does not cover

• M365 / Exchange Online. Business tenants on Microsoft 365 are a different filtering stack. SNDS green is not a guarantee for them.
• Per-domain data. SNDS is per-IP. If you share an IP pool (ESP-style), your data is muddled with other senders.
• Placement detail. Green does not distinguish Inbox from Focused-Other; yellow can mean Junk or mixed.

The four common misreads

1. “SNDS is green so everything is fine.” Green means “your complaint rate on this IP for consumer Outlook is within tolerance”. It does not mean your mail is landing in Focused. It does not mean anything for M365 at all.
2. “Shared IP green is my reputation green.” On a shared ESP IP, SNDS data aggregates all senders. Your individual domain reputation can be Bad while the IP looks Green.
3. “I don't need JMRP because SNDS shows complaints.” SNDS complaint rate is bucketed and delayed. JMRP (Junk Mail Reporting Program) returns specific per-message complaints in near-real-time. Different instruments.
4. “Red means I'm blocked.” Red means the filter leans toward Junk. You are probably still delivered in the SMTP sense; you are just landing in Junk.

Focused vs Other: the invisible third bucket

Microsoft's Focused Inbox sorts inbox mail into Focused and Other. SNDS does not distinguish between them. Many senders celebrating “green” are actually landing in Other — a tab users rarely check. The only way to detect Focused vs Other routing is seed testing with real Outlook.com and M365 mailboxes.

The M365 gap

Microsoft 365 business mail uses Exchange Online Protection (EOP) plus Defender for Office 365 as its filtering stack. Reputation signals, content filtering, Safe Links, Safe Attachments, and per-tenant admin policies all contribute. SNDS sees none of this. For M365 you need:

• Seed tests against M365 mailboxes to observe Focused / Other / Junk routing
• DMARC aggregate reports to watch authentication trends
• Tenant admin feedback if you have a relationship with the recipient org

JMRP: the FBL you should actually have

Junk Mail Reporting Program is Microsoft's feedback loop. When a consumer Outlook.com user clicks “Report junk”, JMRP sends you an ARF-formatted copy of the complaint email within minutes. Enrolment is per-IP, free, and separate from SNDS. If you send to Microsoft consumer mail at any volume, enroll.

# Typical JMRP report fields
Feedback-Type: abuse
User-Agent: Microsoft SNDS; JMRP; 1.0
Version: 1
Original-Mail-From: sender@example.com
Original-Rcpt-To: user@hotmail.com
Received-Date: Tue, 24 Feb 2027 10:14:22 +0000

Reading the SNDS table honestly

• Filter Result — Green/Yellow/Red distribution. Not a placement figure. Directional reputation signal only.
• Complaint Rate — watch trends, not absolutes. A sudden jump from 0.05% to 0.25% is the alarm.
• Trap Hits — any non-None should stop sending until root cause is understood.
• Volume — own sanity check; should match your sending logs.

What to do instead of staring at SNDS

1. Enroll in SNDS and JMRP. Free. Use SNDS for weekly reputation review, JMRP for complaint-trigger alerts.
2. Seed-test weekly. Outlook.com + M365 + Hotmail mailboxes. Record Focused/Other/Junk.
3. Turn on DMARC aggregate. Complements SNDS by showing authentication health across recipient domains.
4. Watch Defender Safe Links patterns. If click rate suddenly spikes to implausible levels, Defender is pre-clicking your URLs. Your click metric is corrupted, but your placement is probably fine.

FAQ