![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(208, 44%, 30%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJD%3C/text%3E%3C/svg%3E)
Exchange Online
A cloud-based service included in Microsoft 365, delivering scalable messaging and collaboration features with simplified management and automatic updates.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(144, 15%, 23%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJB%3C/text%3E%3C/svg%3E)
Hi Jonas,
What you're observing appears to be consistent with documented Exchange Online behavior.
Microsoft documents that when Exchange Online forwards or relays messages on behalf of external senders, it may use a dedicated relay pool instead of the standard Exchange Online outbound delivery infrastructure. Microsoft further states that these relay-pool IP addresses:
•Are not published because they can change frequently.
•Are not included in spf.protection.outlook.com.
•Are not part of Microsoft's published Microsoft 365 outbound IP address ranges.
Because of this design, it is expected that an IPv6 address such as 2603:10a6:20b:5e1::9 may appear in message headers, message traces, or DMARC aggregate reports even though it does not appear in the published Microsoft 365 SPF record.
Why are these IPv6 ranges not included in spf.protection.outlook.com?
Official Microsoft document states that Exchange Online may use a separate relay-pool infrastructure for certain forwarding and relay scenarios, and those relay-pool addresses are intentionally excluded from both Microsoft's published SPF record and published outbound sending ranges.
Since the the relay pool can change frequently and therefore is not published. As a result, the absence of an address such as 2603:10a6:20b:5e1::9 from spf.protection.outlook.com should not be interpreted as evidence that the address is new, unknown, or unsupported. Rather, it appears to belong to infrastructure that Microsoft intentionally does not publish.
The ability to modify Microsoft's spf.protection.outlook.com record is also not available. That SPF record is owned and maintained by Microsoft. Any changes to the IP ranges contained within it can only be made by Microsoft. You can voice this modified suggestion through design change request if you wish.
Are these addresses used only for internal Exchange Online transport?
No. While some Microsoft infrastructure addresses are used purely for internal hops, the specific ranges associated with the relay pool are used for outbound delivery of certain forwarded or relayed messages.
And the system communicates with user with error code and guide to troubleshoot after resolving the IP with SPF list internally.
Should SPF or DMARC validation treat these addresses differently from published Exchange Online sending ranges?
No. Based on Microsoft's published guidance, relay-pool addresses are not intended to receive special SPF or DMARC treatment. Authentication checks should continue to follow the sender domain's published SPF, DKIM, and DMARC policies, regardless of whether the connecting IP address belongs to Microsoft.
This behavior is largely by design. SPF is based on what the domain owner explicitly authorizes through its published SPF record rather than on ownership of the sending infrastructure. As a result, receiving systems evaluate the message against the sender's published authentication policy instead of attempting to determine whether an unpublished Microsoft relay address should be implicitly trusted.
While it may seem that a more advanced approach could automatically recognize Microsoft-operated relay infrastructure, Microsoft's current documented model favors standardized and predictable authentication behavior across all Microsoft 365 tenants. The published guidance does not indicate any special exception or alternate validation logic for relay-pool IP addresses.
Therefore, based on the information currently available, these addresses should be evaluated the same way as any other sending IP: against the sender domain's published authentication records and standard SPF, DKIM, and DMARC validation processes.
I hope this information helps you in the right direction. If you have any further questions or can provide an update on the situation, please do not hesitate to comment. I will be happy to help you.