How to Block Emails From an Entire Company Domain

You have blocked the founder, two SDRs, and the marketing automation address from the same firm. Then a fifth pitch arrives from a name you have never seen. Individual-address blocking is the wrong tool here. A company with a persistent sales team can rotate through staff inboxes indefinitely, and no amount of one-by-one blocking catches up with them.

Blocking the domain shuts down the whole sending infrastructure in a single rule. The problem is that most guides tell you to block the domain and stop there — without telling you that the domain you need to block is rarely the one on the company's website. Their marketing stack sends from em.acme.com; their support desk sends from mail.zendesk.com; their direct sales mail is the only thing actually on acme.com. Block the wrong domain and the rest keeps arriving. This post covers how to find the right domain, the steps for Gmail, Outlook, and both the Google Workspace and Microsoft 365 admin consoles, and what to do when the block does not stick.

Before you block: find the real sending domain#

A company's website domain is often not the domain their email systems send from. Most organisations run their marketing campaigns through a provider like HubSpot, Marketo, or Salesforce Marketing Cloud, which delivers from a subdomain such as em.acme.com or a provider-owned domain like send.acmecorp.io. Their sales team sends from personal inboxes on the main domain. Support and billing notifications come from a help-desk platform that has its own sending infrastructure entirely. You can block acme.com and still receive marketing campaigns and support tickets from that company with no interruption.

Before you create any rule, open one of the messages you want to stop and view its raw source. In Gmail, click the three-dot menu on the message and choose Show original. In Outlook on the web or New Outlook, open the message, click the three-dot menu, and look for View message source or View message details. In classic Outlook, open the message and go to File, then Properties — the headers appear in the Internet headers box. In the raw headers, find the Return-Path line and the domain cited in the Authentication-Results header next to dkim=pass or dkim=fail. That domain — not the display name in the From field — is what the sending system actually controls, and it is the domain your block rule needs to match.

Also make a deliberate decision about what happens to blocked mail before you set the rule. A domain block is not targeted: it silences the company's entire email output, including invoice confirmations, contract renewals, password resets, and support tickets. If you have an active commercial relationship with this company, or any chance you might in the next 90 days, route to a holding folder rather than deleting outright. Recoverable is safer than gone.

How to block a company domain in Gmail#

Gmail's filter system lets you match on sender domain by using the from: operator with an @ prefix. A filter for @domain.com matches every address at that domain regardless of username. This covers the exact domain only — em.domain.com and mail.domain.io require separate filters. If you need a full walkthrough for blocking in Gmail specifically, the companion post on blocking an entire email domain in Gmail covers the edge cases in more depth.

1. 1

   Find the sending domain

   Open a message from the company, click the three-dot menu, and choose Show original. In the headers, locate the Return-Path and the domain in the dkim= or spf= line of Authentication-Results. Note the exact domain — this is what you will enter in the filter.

2. 2

   Open the filter creator

   In Gmail, click the settings gear and choose See all settings. Go to the Filters and Blocked Addresses tab, scroll to the bottom, and click Create a new filter.

3. 3

   Enter the domain in the From field

   In the From field, type @domain.com — include the @ symbol and replace domain.com with the exact domain you identified. Do not add any other criteria. Click Create filter.

4. 4

   Choose the action

   To remove matching messages permanently, select Delete it. To audit first, select Apply the label and assign a dedicated holding label. Click Create filter to save the rule.

5. 5

   Repeat for additional sending domains

   If the company sends from additional subdomains — for example, em.domain.com or mail.domain.io — create a separate filter for each, following the same steps. Each filter covers one exact domain.

How to block a company domain in Outlook#

Outlook stores domain blocks in a Blocked domains section within the Junk Email settings — separate from the individual Blocked Senders list. Messages matching a blocked domain are routed to the Junk Email folder, where they are automatically and permanently deleted after 14 days. The steps below apply to New Outlook for Windows and Outlook on the web, which share the same settings interface.

1. 1

   Open Settings

   Click the gear icon in the top-right corner of Outlook or Outlook on the web to open the Settings panel.

2. 2

   Go to Junk email

   Navigate to Mail, then Junk email. Scroll down to the Blocked senders and domains section.

3. 3

   Add the domain

   In the Blocked domains field, type the domain name without the @ symbol — for example, acme.com. Click Add. Repeat for each sending domain you identified.

4. 4

   Save

   Click Save at the bottom of the page. Outlook begins routing messages from the blocked domain to Junk immediately.

How to block a company domain for your whole team#

Personal inbox rules protect one person. When a company is targeting multiple people across an organisation, a tenant-wide block prevents mail from reaching any mailbox at all — the block is applied at the mail server level before delivery.

1. 1

   Google Workspace: open Default routing

   Sign in to admin.google.com as a super administrator. Navigate to Apps, then Google Workspace, then Gmail, then Default routing. Click Configure or Add another rule to create a new routing rule.

2. 2

   Google Workspace: add a domain pattern and reject action

   Under Specify envelope recipients to match, select Pattern match. Enter a regular expression for the sending domain — for example, .*@acme\.com matches every address at acme.com. Under the action options, select Reject message. Click Save. Changes propagate across the organisation within approximately 24 hours and require no end-user action.

3. 3

   Microsoft 365: open the Tenant Allow/Block List

   Sign in to the Microsoft Defender portal at security.microsoft.com. Go to Email and collaboration, then Policies and rules, then Threat policies. Under the Rules section, open Tenant Allow/Block Lists and select the Domains and addresses tab.

4. 4

   Microsoft 365: create a block entry

   Click Add, then Block. Enter the domain name: type domain.com to block the main domain only, or *.domain.com to also cover every subdomain. Set an expiration date appropriate to the situation, or select Never expire. Add an optional note describing why the block was added, then click Add to save.

5. 5

   Microsoft 365: understand what happens to blocked mail

   Messages from a blocked domain are classified as high confidence phishing and placed in quarantine — they do not reach any user's inbox or Junk folder. Administrators can review quarantined messages in the Defender portal under Email and collaboration, then Review, then Quarantine. Users in the organisation also cannot send to blocked domains; outbound messages return a 550 5.7.703 bounce.

Platform differences at a glance#

What to do when the block is not working#

The most common failure is a mismatch between the domain you blocked and the domain the company actually sends from. If mail is still arriving after you create a rule, open one of the messages that slipped through and check the raw headers again. Compare the Return-Path and DKIM domain against the domain you blocked. If they differ, the company is sending from a second domain — add a new rule for it. Some organisations run marketing, transactional, and support mail from three distinct domains, and each requires its own block.

In Microsoft 365, if you blocked domain.com but mail is arriving from subdomain.domain.com, your Tenant Allow/Block List entry covers the exact string you entered and nothing else. Delete the entry and replace it with *.domain.com to cover every current and future subdomain in one entry. Note that this wildcard applies immediately to all subdomains, including any the company may add later, so use it only when you are certain the entire domain hierarchy is unwanted.

In Gmail, if a message from the blocked domain is appearing in your inbox rather than going to Trash, check the filter action — if you selected Skip Inbox without selecting Delete it, messages are archived rather than removed. Also check whether the message arrived via a Google Group or a shared alias. Personal filters do not apply to Group memberships; messages sent to a group and delivered to your address bypass your individual filters and require a Group-level rule instead.

A faster way to manage domain blocks#

The steps above work. The problem is maintenance. A company with a large sales motion will eventually rotate sending subdomains or switch bulk-email providers, and each time you have to re-check headers, identify the new domain, and create another rule.

AI Emaily's cold-email filter matches on sender behavior and domain pattern rather than a single hardcoded address. When a company rotates from one subdomain to another, the filter does not reset — you review the classification once and subsequent mail from that organisation stays filtered regardless of which domain they switch to. We build AI Emaily. The cold-email filter page describes how the matching works in full.