Microsoft absolutely does use strict ASN-based blocking.

> permanent error (550): 5.7.1 Unfortunately, messages from [{REDACTED IP}] weren't sent. Please contact your Internet service provider since part of their network is on our block list (S3140). You can also refer your provider to http://mail.live.com/mail/troubleshooting.aspx#errors.

The other providers don't seem to be as picky. (At least I haven't seen major issues sending from Digital Ocean which is an ASN with a bad reputation.) It seems that once they had experience with my domain (with SPF + DKIM) they judge messages primarily using domain reputation not IP reputation.

Those are temporary/ephemeral IP restrictions. They typically last for a few minutes. That's not the same as the static 'outdated' IP block lists that the OP is referring to.

Simply said: if block lists were permanent, we'd be blocking the entire IPv4 space by now. And also, spammers would have almost free reign when using IPv6, since you can get blocks of millions of addresses for free. Large email providers know this, they have been battling spam for decades now.

When enabling DMARC the IP address more or less becomes irrelevant. If the email is not DMARC aligned the email won't be accepted anyway (I'm assuming a 'reject' DMARC policy here) and if the email is DMARC aligned, the domain reputation, rather than IP reputation will be used.

When working with DMARC aligned domains, most email service providers will rely solely on content based spam detection, and how often people flag the email as spam to determine the domain's reputation.

Of course I am generalizing here. What I wrote here is true for most large email service providers, but each have their own implementation. And of course there will always be self-hosted/on-premise solutions that keep using static block lists (for example: Spamhaus).

These aren't temporary. Every message I have sent for years has got the same block message. Sure, they aren't necessarily outdated but they aren't lasting for a few minutes.

> When working with DMARC aligned domains, most email service providers will rely solely on content based spam detection

This seems to be true for most major providers. But my experience shows that Microsoft and Apple don't do this. They still apply strict broad IP-based blocking. Sending messages from the same domain via a relay such as AWS SES is perfectly fine. But if the sender IP is in Digital Ocean ASN it is dropped right away. The domain is p=reject

IP block lists are still used, though mostly in form of "IP reputation" blocks.

And they suck.

I worked with a guy who would take every piece of spam we got, dig into the mail headers, and then add the source IP to a custom blacklist on our mail server. It took a few hours to figure out why we weren't getting email from a customer and that's how I found the list.

He had manually added over 20,000 IP addresses to the list.