Microsoft SNDS: Reading the Data Like a Pro
SNDS is the most honest reputation signal Microsoft gives you — if you know what each column means. Here's how to read the dashboard column by column and what to act on first.
If you've enrolled in SNDS (and you should), you're looking at a no-frills HTML table with eleven columns. Most senders glance at the color and ignore the rest — missing the leading indicators that would have warned them three days before a block.
Here's how to read each column.
The Columns
| Column | What it measures | What "healthy" looks like |
|---|---|---|
| IP | The specific IP / /24 you've registered | n/a |
| Activity period | Calendar day of the data row | n/a |
| RCPT commands | Recipients attempted in EHLO conversations sampled | Steady, consistent volume |
| Data commands | Messages actually transmitted | Close to RCPT |
| Message recipients | Distinct recipient addresses | Close to Data |
| Filter result | % of sampled mail Outlook.com filtered as spam | < 10% green, > 50% red |
| Complaint rate | % of recipients who reported as junk | < 0.1% great, > 0.3% danger |
| Trap message period | Days during which the IP hit Microsoft spam traps | "Not applicable" is ideal |
| Trap hits | Number of trap addresses mailed | 0 ideal, < 3 tolerable |
| Sample HELO | The EHLO hostname Microsoft observed | Matches your PTR |
| Sample MAIL FROM | The return-path domain Microsoft observed | Matches your sending domain |
| Comments | Microsoft-attached notes (rare) | n/a |
What the Color Actually Means
The color summary is a function of complaint rate, trap hits, and filter result. It's not deterministic from any single column.
- Green — Microsoft is happy with this IP. Most mail goes to inbox.
- Yellow — One or more inputs is elevated. Microsoft is throttling or junking some mail. This is your warning window.
- Red — Microsoft is filtering aggressively and you're at risk of an S3140 block.
You can read each underlying column to see why an IP turned yellow, and fix the specific cause.
Reading the Data in Practice
Scenario A: Color is yellow, complaint rate is fine, trap hits are zero, filter result is high
This is almost always a content or authentication problem, not a list-hygiene problem.
- Check SPF/DKIM/DMARC are passing with Domain Health.
- Inspect a recent message header with Email Headers Analyzer — look for compauth ≠ pass.
- Audit content — sudden change in templates, new URL shorteners, image-heavy redesign.
Scenario B: Color is yellow, complaint rate is above 0.2%, filter result is moderate
Classic list-hygiene problem.
- Pull JMRP reports. The flagged recipients are your suppression queue.
- Audit recent list growth — purchased, scraped, or co-registered sources are common culprits.
- Tighten opt-in (drop single opt-in, add re-confirmation).
Scenario C: Trap hits non-zero
Microsoft maintains pristine traps (addresses that never opted in to anything) and recycled traps (formerly real addresses that have been abandoned for years and reactivated as traps).
- Pristine trap hits → you have purchased or scraped data in your list. Identify the source and remove.
- Recycled trap hits → your sunset policy isn't aggressive enough. Drop recipients who haven't engaged in 90 days; for cold outreach, 30 days.
Scenario D: Sample HELO or MAIL FROM doesn't match what you expect
Symptoms of a mail server misconfiguration — the EHLO or Return-Path is being set to something other than your sending domain.
- Verify EHLO matches your PTR hostname.
- Verify Return-Path is on a domain with valid SPF for the sending IP.
How Often to Check SNDS
If you're managing your own IPs, daily is the right cadence. Most blocks are preceded by 2–4 days of yellow status — checking daily gives you time to fix things before recipients notice.
If daily is unrealistic, set up alerting. MailVitals' IP Monitoring pulls SNDS data automatically and alerts on color changes.
SNDS Data Latency
SNDS data is one-day delayed. The row dated 2026-06-09 shows what happened on 2026-06-08. Plan around that — don't expect a fix today to show up in SNDS until tomorrow's row.
FAQ
Why does my SNDS show "no data" for some days? Microsoft only generates a row when the IP sent enough sampled mail (~100+ messages). Lower-volume IPs have gaps.
Are SNDS color and JMRP complaint rate always consistent? Not always. SNDS samples a subset of traffic; JMRP captures all reported messages. JMRP is the more accurate complaint-rate source.
Can I get historical SNDS beyond 30 days? No — Microsoft only retains 30 days. Export and archive daily if you want a longer record.