Skip to content
inboxprobe

Checkers

Generators

Guides

Bounce error codes · Microsoft 365 (Exchange Online)

550 5.7.606-649 Access denied, banned sending IP

Microsoft 365 put the IP address your mail came from on its blocked senders list. You can ask for removal yourself, once the reason it was blocked is gone.

The exact error texts

  • Delist yourself

    550 5.7.606-649 Access denied, banned sending IP [IP1.IP2.IP3.IP4]

  • Needs Microsoft to investigate

    550 5.7.511 Access denied, banned sender[xxx.xxx.xxx.xxx]. To request removal from this list, forward this message to [email protected]. For more information, go to https://go.microsoft.com/fwlink/?LinkId=526653.

Quoted from Microsoft Learn — Use the delist portal to remove yourself from the blocked senders list

Check your domain

Paste the IP from the bounce to see whether it's also on public blocklists.

What it means

Microsoft 365 keeps a blocked senders list of IP addresses it considers a potential threat (spam, spoofing or phishing). Every code from 5.7.606 to 5.7.649 means the connecting IP is on it. The block is on the IP address, not your domain, so your SPF, DKIM and DMARC can be perfect and still bounce.

First: whose IP is it?

  • Your own server (a VPS, an office mail server, a web host sending form mail): you can request delisting yourself.
  • Your email provider's shared IP (a newsletter tool, a transactional service): other customers' mail affects that IP. Contact the provider. They manage the IP and can move you to another one.
  • Not sure? Paste the headers of a message from the same system into the header analyzer: it shows the first external hop's IP. The blacklist checker shows whether it's on public DNS blocklists too.

Using the delist portal

  1. Go to the Office 365 Anti-Spam IP Delist Portal at https://sender.office.com.
  2. Enter the email address that received the bounce and the IP from the error. The portal takes one address and one IP per visit.
  3. Open the confirmation email and follow its link back to the portal.
  4. Select Delist IP.

Microsoft says removal can take up to 24 hours or longer, and that an IP keeps getting blocked if abusive or malicious mail continues. Fix the cause first.

If the code is 5.7.511

5.7.511 means Microsoft wants to investigate the traffic from that IP further, and the portal won't work. Forward the bounce to [email protected] with the full NDR code and the IP address. Microsoft says it replies within 48 hours with next steps.

Questions

Will fixing SPF, DKIM or DMARC remove the block?

No. This block is on the sending IP. Authentication still matters after delisting: Microsoft says delisted mail is delivered when it passes its other filters, including composite authentication.

Does this affect Outlook.com and Hotmail recipients too?

The delist portal is for Microsoft 365 recipients. Microsoft has a separate delisting form for its consumer service, Outlook.com.

Why was my IP blocked?

Microsoft adds an IP when it looks like a threat to the service. Common reasons are a hacked mailbox or website sending spam, an open relay, or a list with many invalid addresses. On a shared IP, it can be another customer's mail.

How long does delisting take?

Microsoft says results vary and removal can take up to 24 hours or longer. For 5.7.511 it says it contacts you within 48 hours.

Sources

Last reviewed: