Based on the symptoms, the issue is most likely on the sender’s side or in how that specific MFA message is being generated and routed, not in Outlook itself.
Key points from the scenario:
- Other messages from the same domain (notifications, password resets) arrive correctly.
- The sender address/domain has already been added to Safe Senders.
- Rules have been removed.
- The problem affects only a specific type of message (MFA codes).
When only one specific message type from a sender is missing, typical Outlook-side causes (junk filtering, rules, blocked senders) are largely ruled out. The remaining common causes are:
- The MFA system is sending from a different underlying address or subdomain than the visible “From” address, and that technical sender is blocked, throttled, or misconfigured on the sender’s mail system or upstream provider.
- The MFA messages are being rejected or dropped before they reach Outlook.com/Outlook (for example, by the sender’s mail gateway or a third-party security service they use).
- The sender’s system has internal rules or rate limits that affect only MFA messages (for example, per-user limits, IP reputation, or template-specific blocking).
What can be checked in Outlook/Outlook.com
- Junk and focused inbox
- Confirm the MFA messages are not in Junk Email and not hidden by Focused/Other filtering. In Outlook.com, check both Focused and Other tabs and the Junk Email folder. If anything appears there, mark it as “Not junk”.
- See: check Junk Email folder and settings and mark messages as not junk if needed.
- Blocked senders and rules
- In Outlook.com or Outlook on the web, verify the sender/domain is not on the blocked senders list and that there are no rules moving or deleting these messages:
- Settings → Mail → Junk email → Blocked senders and domains.
- Settings → Mail → Rules.
- In Outlook desktop, check Home → Junk → Junk Email Options → Blocked Senders.
- If anything related to that domain or address appears, remove it.
- Safe senders configuration
- In Outlook.com, ensure the sender/domain is in Safe senders and domains:
- Settings → Mail → Junk email → Safe senders and domains → Add safe sender.
- In Outlook desktop, confirm the address/domain is on the Safe Senders tab in Junk E-mail Options.
If all of the above are already done and other mail from the same sender works, Outlook has no further user-side setting that would selectively block only MFA codes from that sender.
Next steps with the sender (TopStep)
Because Outlook is receiving other messages from that sender, TopStep (or their email/MFA provider) needs to:
- Confirm the exact envelope sender and sending IPs used for the MFA emails and verify they are correctly configured (SPF/DKIM/DMARC, reputation, no internal blocking).
- Check their outbound logs for delivery attempts to the mailbox at the times MFA codes were requested, including any SMTP error codes or deferrals.
- Confirm that their system is not rate-limiting or suppressing MFA messages to that address (for example, due to previous bounces or a suppression list).
If TopStep’s logs show the messages are being accepted by Microsoft but still not visible, support can be contacted from the Outlook.com side for deeper tracing:
- Use Outlook.com Help (menu bar → Help, then “Still need help?” → Yes) while signed in.
Summary
- Since other messages from the same sender arrive and safe sender/rules have already been addressed, this is most likely a sender-side or MFA-system configuration issue, not a general Outlook issue.
- The only Outlook checks left are Junk/Other tabs, blocked senders, rules, and safe senders; if those are clean, the sender’s support team must investigate their outbound logs and configuration for the MFA messages specifically.
References: