Why adding to Blocked Senders sometimes doesn't block the sender

Recently in Outlook.com, I've seen a spurt of user complaints that they are adding senders to the blocked senders list, but keep getting spam from the same sender day after day.

I did some investigation.

First, adding spammers to Blocked Senders isn't the best way to stop spammers from sending you unwanted email. Spammers randomize the sending addresses and so adding them to the blocked senders list stops yesterday's spam, but it doesn't stop tomorrow's spam from a different sender with the same content. The best way to stop spam is to report it as Junk (see here: The difference between adding safe and blocked senders in outlook vs outlook-com).

However, in some circumstances it makes sense to add to Blocked Senders, and that's when the From: address is consistent and doesn't change.

So why is it that sometimes adding a sender to Blocked Sender doesn't get stopped in the future from the same one?

We recently made a change to the user interface for managing blocked senders. To get there from Outlook.com's web interface, select the Gear icon > Options > Mail > Junk email > Blocked senders. We added a line of text that you can add a maximum of 1024 blocked senders and 1024 blocked domains:

What happens is that when a user populates their blocked senders or domains list to full, when they try to add more, the UX fails silently. That is, the blocked sender doesn't get added, and the user is not notified. Thus, the user thinks they are adding more blocked senders, when in fact they are not. Scrolling through the blocked senders list would confirm this.

We are fixing this behavior such that when the blocked senders list is full, when you try to add more (either through the management page shown above, or from the Junk Email folder), you'll get a notification indicating that the list is full and you'll need to remove some before you can add more.

I don't have an ETA on the fix, but it has our attention.

Some technical stuff

One reason why the behavior is like this is because it's rare for users to fill up their blocked senders list. Like I said, the right way to stop spam is report is as Junk. For the most part, a user adds and adds and adds to their blocked senders list, but it doesn't matter because the spammers randomize their sending addresses. It's only when a spammer sends with the same sender does a user with a full blocked senders list matter.

Adding to the blocked senders list is an asynchronous operation. That is, when a user clicks "Block", it is not instantaneously added. Instead, the front end makes a request to the backend, but doesn't wait for it to complete. If it did, the user would click "Block" and then have to wait for the update to complete before being allowed to proceed. We don't want to do that, we want the "Block" operation, from the user perspective, to be seamless.

But because it's asynchronous, we didn't have a good way to communicate back to the user that the operation failed. We're not going to make it blocking, but instead will do a hybrid approach where we can communicate instantaneously back to the user when their blocked senders list is full, and also do it without the user having to wait and wait and wait while the transaction completes.

Hopefully that will help.