T-Online Blocks AWS & Hetzner IPs

Why is T-Online blocking emails from AWS and Hetzner cloud servers?

You send a campaign from your app hosted on AWS, and half your emails vanish into T-Online’s spam filter. No bounce, no error — just silence. You’ve set up SPF, DKIM, and DMARC. The technical setup is perfect. So why is T-Online refusing your messages?

T-Online, Germany’s largest internet service provider, blocks outbound mail from shared cloud IPs — including AWS and Hetzner — not because of technical flaws, but because these ranges are heavily abused. Spammers use them to send low-cost, high-volume mail from compromised accounts. T-Online treats entire IP ranges as suspicious unless they’ve proven trustworthy over time.

Key takeaways

T-Online blocks mail from AWS and Hetzner IPs due to historical spam abuse on shared cloud infrastructure, not individual sender faults.
Even authentic mail from properly configured senders can be rejected if the IP lacks sender reputation or warm-up history with T-Online.
Verifying email addresses before sending — especially to T-Online — prevents wasted sends and protects sender reputation.

Does T-Online block mail from all cloud IPs?

No — T-Online does not block mail from all cloud IPs like AWS or Hetzner. It applies filters based on sender reputation, historical abuse reports, and domain alignment, not just a provider’s location. Well-known brands with clean sender practices often deliver successfully through cloud infrastructure if their reputation is strong and their domains are properly authenticated.

Why some cloud IPs get blocked — and others don’t

Cloud providers like AWS and Hetzner host millions of users, including spammers. T-Online uses reputation-based filtering to block mail from IP ranges with a history of abuse. An IP from Hetzner isn’t automatically blacklisted — but if that IP has sent spam recently, or if the sending domain lacks proper SPF/DKIM alignment, delivery will fail.

Spamhaus and other real-time blocklists track these patterns. T-Online integrates with such systems, meaning your mail can be blocked if your IP or domain appears on one of them. But that doesn’t mean your cloud provider is the problem — it’s the behavior behind the IP that matters.

How to stay deliverable on cloud infrastructure

Even on AWS or Hetzner, you can maintain inbox placement if you follow email best practices. Use authenticated domains (SPF, DKIM, DMARC), avoid sudden spikes in volume, and keep your list clean. MailSender reputation is built over time — not just on where you host, but how you send.

Your domain’s sending history is weighed more heavily than your infrastructure. A brand new domain sending from AWS with no prior engagement is more likely to be flagged than a trusted domain with a history of low bounce and high engagement.

Let’s say you’re sending transactional emails via a cloud-hosted service. You’re not blocked by design — but you’re vulnerable if you skip hygiene steps. A single bounce from a disposable email, or a high rate of hard bounces, can still tank your reputation. That’s why real-time verification is essential.

Check your list before you send. Use MailTester’s bulk verification or real-time API to flag invalid, risky, or catch-all addresses before they damage your sender reputation. Even a single poor reputation signal can lead to T-Online filtering.

MailTester’s inbox placement tests give you direct feedback on how likely your emails are to land in the inbox — not the spam folder — on T-Online and other major providers. It’s not about avoiding cloud IPs. It’s about verifying that your sending setup is trustworthy, regardless of where it runs.

For more on how to test your deliverability, see our inbox tester. And if you’re managing lists across platforms, explore our integrations with Mailchimp, Klaviyo, and SendGrid.

What makes AWS and Hetzner IPs suspicious to T-Online?

Cloud IPs from providers like AWS and Hetzner are flagged by T-Online because they often come from shared, high-volume networks with no sender reputation tied to a specific domain. When thousands of users share the same IP range — especially without consistent sending practices — it becomes easy for spammers to exploit, triggering automated filters. T-Online’s systems treat such ranges as inherently risky, especially if they’ve previously been associated with spam complaints or bulk sends.

You’re sending from AWS or Hetzner, and that IP range is used by hundreds of other senders — many of whom may be abusive. T-Online sees this as a red flag: no history, no track record, just anonymous mass delivery. That lack of domain-specific reputation makes it hard to trust individual messages coming from such networks, even if your own use is legitimate.

Aggregated reputation and internal blocklists

IPs in large cloud networks are commonly hijacked for spam. When one user sends malicious content from a shared IP, the whole range can get marked by spam filters like Spamhaus or SURBL. T-Online doesn’t just rely on public blacklists — it maintains its own internal blocklists based on historical abuse patterns. If an IP range shows repeated spam complaints or high bounce rates across its use, T-Online will reject mail from that range, even if the current sender is clean.

That’s where tools like MailTester come in. You can test delivery risks before sending by checking real inbox placement and identifying problematic IPs. Inbox placement testing helps you see how likely your message is to land in a T-Online user’s inbox — and why a clean message might still be blocked. The same check works for bulk email verification, letting you filter out low-reputation or invalid addresses before they harm your sender reputation.

While you can’t always avoid cloud IPs, you can control how they’re used. Using a dedicated IP and sending only from verified domains improves your chances. But even then, if your IP comes from a network known for abuse, T-Online may still reject your mail. That’s why verification is crucial: it stops you from sending to addresses that can’t receive — or worse, that trigger spam traps.

For teams using platforms like SendGrid, Mailchimp, or HubSpot, integrating MailTester across your workflow helps identify high-risk IPs and domains before they impact deliverability. The goal isn’t perfection, but consistency — and reducing the number of bounces, blocklist hits, and wasted sends. Real-time validation via our API or bulk verification at https://mailtester.com/email-list-verify gives you the data to act fast.

As a rule, you don’t want to depend solely on a public IP’s legitimacy. Cloud providers are not inherently bad — but they’re not immune to abuse. T-Online knows this, and so should you. The best defense is validation, transparency, and treating every sending IP like a potential risk until proven otherwise.

Can you still send to T-Online email addresses from AWS or Hetzner?

Yes, you can still send to T-Online email addresses from AWS or Hetzner — but only if your sender reputation is strong, your domain is properly authenticated, and your email list is clean. T-Online doesn’t block cloud IPs outright, but it evaluates each message based on multiple signals. A new domain with no sending history on a shared cloud IP will often be rejected, even if technical checks pass.

Why cloud IPs alone aren’t the issue

It’s not the IP address itself — it’s the context. T-Online uses reputation-based filtering, so a newly created domain on AWS or Hetzner with no past sends will likely get dropped. Unlike some mail providers, T-Online doesn’t rely solely on reverse DNS or blocklists. Instead, it looks at your sender history, how your recipients interact with your emails, and whether your content aligns with normal behavior.

Let’s say you’re using AWS EC2 or a Hetzner VPS. The IP might not be blacklisted. But if your domain has no SPF, DKIM, or DMARC records, or if your email content looks like spam, T-Online will flag it. And if your list includes inactive or disposable emails, that harms your reputation fast.

What you need to send successfully

First, ensure your domain is properly authenticated. SPF, DKIM, and DMARC aren’t optional for modern deliverability. Without them, even clean lists on cloud IPs are at high risk. Second, your sender reputation must be strong. A low-performing IP on a shared network will struggle to win trust from providers like T-Online.

A good rule of thumb: never send to T-Online addresses on a new domain with no sending history. If you’re setting up a new campaign, use a warm-up strategy. Start with low volumes, gradually increase, and focus on engagement. You can test inbox placement with tools that simulate real-world delivery, like MailTester’s inbox placement test.

Even if you’re on a cloud provider with a clean IP, a poor domain reputation or low engagement will sink your deliverability. Tools like bulk email verification can help by filtering out invalid and risky addresses before they impact your sending performance. Proper list hygiene is as important as technical setup.

For ongoing sending, consider using a dedicated IP if you’re sending at scale. But for most senders, consistent alignment, clean lists, and engagement are what matter — not the specific hosting provider. T-Online respects sender behavior more than IP origin.

For a trusted, real-time way to validate your list before sending, check MailTester’s verification API. It flags invalid, catch-all, and disposable emails with 98.9% accuracy — meaning you send only to addresses that matter.

How to test if your email will land in a T-Online inbox

Send a test email to a real T-Online address through an inbox-placement tool that mimics delivery to European ISPs. MailTester’s inbox test checks how real T-Online recipients receive your message—whether it lands in the inbox, gets marked as spam, or is rejected. This tells you before you send to your full list whether T-Online’s filters are blocking you. No guesswork. No wasted sends.

Step-by-step: Verify T-Online deliverability before your campaign

Choose a real-time inbox-placement testing tool that evaluates delivery to actual European mailboxes. T-Online blocks emails from many cloud IPs like AWS and Hetzner due to high spam volume in their infrastructure. Tools that simulate real ISP behavior—like Spamhaus or MxToolbox—can validate whether your sender reputation or IP is triggering filters.
Use MailTester’s inbox placement test to send a sample email to real T-Online recipients. Unlike spam traps or fake addresses, this test uses active inboxes. You’ll get precise feedback: delivered, marked as spam, or rejected. This reflects how your email will perform at scale. More accurate than testing with invalid or disposable domains.
Check if your sending IP or domain is blacklisted. T-Online often blocks IPs associated with bulk senders that lack proper authentication. Use tools like MxToolbox to verify your IP’s reputation and check if it’s listed on known blocklists (e.g., Spamhaus). If your IP is on a blocklist, fixing it should improve results.
Verify your authentication setup (SPF, DKIM, DMARC). Misconfigured or missing records are rejected by T-Online. Even if your IP is clean, missing or weak authentication will cause delivery failure. Use an SPF/DKIM/DMARC checker from a reputable source like RFC 7208 or RFC 7483 to confirm proper alignment.
Run an API-powered test before sending at scale. The MailTester API allows you to test individual or bulk addresses, including T-Online, in real time. This helps catch issues like catch-all domains, role-based accounts, or greylisted IPs early. Integration with platforms like Mailchimp or HubSpot can automate verification workflows.

Why this avoids wasting time and money

Most teams find out too late that their emails aren’t landing in T-Online inboxes—after they’ve sent thousands of messages. That leads to poor deliverability, damaged sender reputation, and lost revenue. A single inbox test costs less than a small email send. It gives you actionable insight before you scale up. With MailTester’s inbox placement test, you learn quickly whether your email reaches the inbox or gets blocked—so you can adjust your setup with confidence.

What to do if T-Online rejects your email from a cloud IP

If T-Online blocks your email from an AWS, Hetzner, or similar cloud IP, it’s likely due to poor sender reputation or misconfigured email authentication. You must verify your identity with SPF, DKIM, and DMARC; clean your list of invalid, role, disposable, or catch-all addresses; and warm up your domain gradually with trusted platforms. These steps address the root causes of blocklists and rejection.

Verify your sender identity

Check that SPF includes your cloud provider’s IPs and is not overly permissive. Overly broad SPF records can trigger spam filters.
Ensure DKIM is set up and signs every outgoing message—this cryptographically verifies your domain's authenticity.
Align SPF and DKIM with your sending domain. Misalignment is a common reason for rejection, especially with T-Online.
Use an official email validation tool like MailTester’s API to check alignment and authentication in real time before sending.

Optimize your sending setup

Remove invalid, role-based, disposable, and catch-all emails—these harm deliverability and hurt sender reputation. Use MailTester’s bulk verification to filter them out at scale.
Start with low-volume sends from your cloud IP. Many ISPs, including T-Online, closely monitor sudden volume spikes from new or untrusted IPs.
Gradually increase email volume across multiple trusted platforms. This builds trust incrementally—no shortcuts.
Monitor feedback loops and spam complaints. High complaint rates are a direct path to blocklisting.
Consider using a dedicated outbound IP with a clean history, especially if you're sending large volumes.

Reputation isn’t built in a day—every message builds or erodes it.

You can test inbox placement and reputation in real-world conditions using MailTester’s inbox placement tool. It simulates how your email lands across major providers, including T-Online, and gives you actionable insights. If you're integrating with platforms like Mailchimp, Klaviyo, or SendGrid, MailTester integrates directly, letting you automate verification before every send. A clean, well-verified list and steady send volume are stronger than any cloud IP workaround.

How MailTester helps you avoid T-Online blocks

You don’t need to guess why T-Online is blocking your mail. With 98.9% accuracy, MailTester identifies invalid, catch-all, and risky email addresses before you send—cutting out the accounts most likely to trigger T-Online’s spam filters or bounce. By removing these risky entries in bulk, you lower the chance of triggering T-Online’s reputation-based block systems, especially when sending from cloud IPs like AWS or Hetzner.

Bulk list verification prevents delivery failures

Let’s be clear: T-Online’s filters are aggressive. They react strongly to high bounce rates, spam trap hits, and inactive or role-based addresses. With MailTester’s bulk list verification, you can scrub large email lists in minutes. It flags invalid domains, catch-all addresses, and disposable inboxes—common culprits behind deliverability issues on T-Online. This isn’t guesswork; it’s systematic elimination of risk.

When you send from a cloud IP—especially one shared with other senders like AWS or Hetzner—T-Online monitors sender reputation closely. Every bounce or soft fail can hurt your standing. MailTester helps you avoid those signals by ensuring your list only includes active, deliverable addresses. This reduces the probability of your messages landing in spam or being blocked outright.

Real-time API integration for ongoing protection

Once you’ve cleaned your list, you don’t go back to zero. The MailTester real-time API lets you verify every new address as it’s added—whether through a form, signup widget, or CRM sync. That way, you’re not just cleaning old data; you’re building a clean, safe inbox from the start. Integrations with tools like Mailchimp and HubSpot, available at our integrations page, help automate this.

For a deeper look at your actual inbox placement, use the inbox placement tool. It sends test messages to real inboxes—including T-Online’s—to see whether they arrive in the inbox, spam, or get blocked. It’s a trusted way to spot issues before scaling campaigns.

While cloud providers like Hetzner and AWS are technically compliant, their shared IP pools can lead to high-risk reputations if not monitored. This is where real-time verification and consistent list hygiene become essential. A clean list isn’t just about reducing bounces—it’s about protecting sender reputation, which T-Online weighs heavily.

What does a 'risky' verdict mean in email verification?

A 'risky' verdict means the email address shows signs of potential deliverability issues—such as being a role-based address (like info@ or admin@), hosted on a domain with a history of abuse, or associated with a temporary or disposable service. These addresses aren’t automatically invalid, but they’re more likely to be blocked, flagged as spam, or never reach the inbox—especially by strict ISPs like T-Online that prioritize user trust and filter aggressively.

Why risky addresses hurt deliverability

You might think a valid email is safe to send to, but a risky label indicates a higher likelihood of failure. For example, T-Online has strict filtering policies and often blocks mail from cloud IPs like AWS or Hetzner due to past abuse patterns, especially when sending from shared infrastructure. If you’re sending to role accounts or domains with poor reputation, your messages are far more likely to land in spam folders—or be outright rejected. This isn’t a bounce per se, but it damages your sender reputation and reduces overall inbox placement.

According to industry benchmarks, emails sent to role-based or high-risk addresses see a 30–40% higher chance of being flagged as spam. ISPs assess sender behavior over time, and even a few risky deliveries can push your reputation into the red zone. The problem compounds when you ignore these warnings and send to large numbers of risky addresses—it inflates your bounce rate, triggers filters, and can lead to blacklisting.

How to act on risky verdicts

Let’s be clear: you can still send to risky addresses, but you should do it with caution. If you're building a campaign and have 5000 addresses, sending to 300 risky ones may not break anything—but sending thousands of mailshots to them will. The best approach is to filter them out early, especially if you’re aiming for high deliverability.

Tools like MailTester’s bulk verification flag these risks accurately—our service uses real-time checks across SMTP, MX, and historical data to identify risky patterns. It’s not about blocking every role account, but about knowing when the risk isn’t worth it. For high-volume senders, pairing this with our real-time API ensures every new sign-up or update is verified before it hits your inbox.

Understanding what ‘risky’ means helps you avoid costly mistakes. It’s not about perfection—it’s about controlling exposure and maintaining sender reputation. As email filtering evolves, the difference between a delivered message and a missed opportunity often comes down to recognizing those warning signs early.

Common misconceptions about cloud IPs and deliverability

You don’t get automatic inbox access just because your emails pass SPF and DKIM. ISPs like T-Online evaluate the reputation of the sending IP and your overall sending behavior—shared cloud IPs aren’t inherently blocked, but poor sender hygiene can trigger filters. Even if your technical setup is flawless, a history of spam complaints or unengaged recipients can block even AWS or Hetzner IPs. Let’s clear up the myths.

SPF and DKIM don’t guarantee inbox delivery

Just because your emails are technically valid doesn’t mean they’ll land in the inbox. T-Online and other ISPs check IP reputation and sender engagement, not just authentication. A valid SPF record means you’re authorized to send on that domain—but it doesn’t guarantee trust. If your IP has a history of spam or high bounce rates, even properly signed messages can be rejected.

For example: AWS and Hetzner are not on any official blocklist. But shared IPs are vulnerable to abuse. If one user on a public IP sends spam, all emails from that IP—yours included—can be filtered. This is why reputation matters more than just setup.

Shared infrastructure isn’t the enemy—poor practices are

It’s not true that Hetzner or AWS are banned. The real issue is shared infrastructure with inconsistent sender behavior. If your mailing pattern matches that of known spammers (spike sends, low engagement, high complaint rates), your messages will be flagged—even if you’re sending newsletters to engaged users.

Similarly, sending less doesn’t help if your domain hasn’t been actively used. Inactivity harms domain reputation over time. ISPs like T-Online use long-term engagement patterns to judge trust. The longer a domain remains inactive, the harder it is to restore sender reputation, regardless of technical correctness.

Consistent sending wins over sporadic bursts

You’re better off sending regularly to real users than pausing for months and then sending massive volumes. Low engagement over time—especially on cloud IPs—signals that your list is stale or purchased. ISPs detect this and filter your emails accordingly.

Use tools like MailTester’s bulk verification or inbox placement tester to check list health and avoid sending to invalid or risky addresses. A clean, active list with consistent delivery patterns shows ISPs you’re a trusted sender.

For real-time validation of new addresses and ongoing list hygiene, consider integrating with our API checker. It helps prevent deliverability issues before they happen—even on shared cloud infrastructure.

Best practices for sending to T-Online users from cloud infrastructure

Yes, T-Online actively blocks mail from shared cloud IPs like those used by AWS and Hetzner. The best way to avoid this is using domain-specific IPs for high-volume sends, verifying your list with high-accuracy tools, and continuously monitoring engagement to stay off their radar.

Use domain-specific IPs for high-volume sends

Shared cloud IPs are commonly blacklisted or rate-limited by T-Online due to abuse from low-reputation senders.
When you send at scale, request a dedicated IP address tied to your domain and configure it with proper reverse DNS, SPF, and DKIM.
This improves sender reputation and reduces the chance of delivery issues tied to shared infrastructure.
Many large senders use this approach to maintain inbox placement with strict providers like T-Online.

Verify your list before every send

Always use a high-accuracy verification tool like MailTester to check your list before sending.
You should eliminate invalid, catch-all, and role accounts—especially for large campaigns.
MailTester’s 98.9% accuracy rate helps you avoid wasted sends and protect your sender reputation.
With MailTester’s real-time API, you can validate emails at point of capture or during batch processing.

Monitor engagement and clean inactive users

T-Online prioritizes inbox placement for engaged recipients. Low engagement triggers spam algorithms.
Track open, click, and reply rates. Remove users who show no engagement over 60–90 days.
A clean list with active users improves sender reputation and reduces the risk of being blocked.
Use tools like MailTester’s inbox placement test to simulate delivery and assess real-world performance.

Deliverability isn’t just about sending. It’s about proving your mail is wanted—every time.

For best results, combine these practices with consistent monitoring, clean data hygiene, and infrastructure that respects the boundaries of providers like T-Online. Your reputation depends on it.

Conclusion: Deliverability is not about the IP — it's about reputation

T-Online’s filters don’t block AWS or Hetzner by design. They block senders perceived as untrusted, regardless of hosting provider. The IP address is a signal, not a verdict.

Even from a cloud IP, your emails can reach the inbox if your domain is authenticated, your list is clean, and your recipients engage consistently. Reputation begins with list hygiene, not infrastructure.

Switching providers won’t fix poor deliverability. The real work is verifying your list, warming your domain, and maintaining sender health. Trust is earned — not inherited.

Sources

Microsoft (Outlook/Hotmail) is the toughest major provider for senders, with just 75.6% inbox placement and a 14.6% spam placement rate — the highest spam rate among major mailbox providers. — Validity 2025 Email Deliverability Benchmark Report (2025)
The effective spam-complaint target for 2026 has tightened to below 0.1%, down from the historical 0.2–0.3% tolerance, as mailbox providers raise the bar for senders. — Validity 2026 Email Deliverability Benchmark Report (via The Agile Brand Guide) (2026)

Keep reading

Ready to put this into practice? MailTester verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

Why does T-Online block emails from AWS and Hetzner?

T-Online blocks emails from cloud IPs with poor sender reputation or high spam abuse history, not the providers themselves. Shared IPs are frequently used for spam.

Can I still send to T-Online users from AWS?

Yes, if your domain has strong authentication, a clean list, and a proven sending history. Shared IPs alone don’t cause blockage — behavior does.

How do I test if my email reaches T-Online inboxes?

Use inbox placement testing tools like MailTester to send test emails to real T-Online addresses and evaluate delivery results.

What is the difference between 'catch-all' and 'invalid' email addresses?

A catch-all address accepts all emails, even invalid ones, and often leads to bounces. An invalid address cannot receive mail at all.

How accurate is MailTester's email verification?

MailTester has a 98.9% accuracy rate in identifying valid, invalid, catch-all, and risky addresses.

Do verified emails guarantee inbox delivery?

No. Verification ensures the address is technically valid, but inbox placement depends on sender reputation, engagement, and ISP filters.

Can disposable emails harm my sender reputation?

Yes — if you send to disposable emails, recipients may mark you as spam, harming your reputation and increasing the risk of being blocked.

How often should I clean my email list?

Quarterly cleaning is standard. Use tools like MailTester to remove invalid or risky addresses before each campaign.

Is it safe to use a cloud provider like Hetzner for email sending?

Yes, but only if you maintain proper authentication, list hygiene, and sender reputation. Shared IPs require more care than dedicated ones.

What happens if my domain is on a T-Online blocklist?

Your emails will be rejected or marked as spam. You must identify the cause (e.g. poor list hygiene), clean your list, and rebuild reputation over time.

Does MailTester help with DMARC or SPF setup?

MailTester verifies addresses and assesses deliverability risk, but does not configure DNS records. Use tools like MxToolbox for DNS checks.

Are there any free tools to check T-Online deliverability?

No reliable free tools exist for testing inbox placement to T-Online. Most providers offer limited or inaccurate results.