Probe a Microsoft-hosted address at a reasonable rate and you will usually get a sensible answer: 550 5.5.0 for an address that does not exist, 250 for one that does. Probe a few thousand and the responses change character.
You start seeing 421 4.7.500, which is a rate limit. Connections get dropped. The same address that returned a clean rejection twenty minutes ago now returns a temporary failure, and neither response is more true than the other.
Their architecture explains it. Exchange Online Protection fronts both the consumer service and every business tenant, and it caps concurrent connections far more tightly than Google does. Where Google tolerates parallel connections and cares about engagement, Microsoft cares about connection behavior.
There is a second layer on business tenants. Directory-based edge blocking is an administrator setting, and a tenant with it switched off accepts every recipient. Two companies on identical licenses behave completely differently, and the license tells you nothing.
What this means for your list
A Microsoft-heavy list produces more unknowns than a Gmail-heavy one, from any verifier. That is a property of the receiver rather than a difference in effort.
Results can change between runs. An address unresolved on Tuesday may resolve on Thursday, which is worth knowing before you conclude a vendor is unreliable.
A tenant that accepts everything is a catch-all domain regardless of what platform it runs on, and the administrator's setting is the cause rather than Microsoft's policy.
Security gateways in front of a tenant answer the probe themselves. A Mimecast or Proofpoint response tells you about the appliance and not about the mailbox behind it.
Where this argument costs us something
The short version
- Expect lower coverage on Microsoft-hosted addresses than on almost anything else.
- Treat a 421 as no answer, never as a verdict.
- Check whether a business domain accepts every recipient before trusting a positive result on it.
Questions people ask
Why do Microsoft results vary between runs?
Because the response depends on load and on how their infrastructure feels about the connecting IP at that moment. Under throttling the same address can produce a rejection, a temporary failure or nothing.
Is Microsoft 365 a catch-all provider?
Not inherently. Recipient validation is a tenant setting, and a large share of tenants have it configured in a way that accepts everything.