The fix for 550 5.7.606 is Microsoft's self-service delist portal at sender.office.com: enter the address that got the bounce and the IP address in the error, confirm by email, and select Delist IP. The fix for 550 5.7.708 is different. That block sits on your Microsoft 365 tenant, so your admin cleans up the cause and then asks Microsoft support to lift it.
What does 550 5.7.606 mean?
The 550 5.7.606 code means Microsoft 365 put the IP address you send from on its blocked senders list. The full text is "Access denied, banned sending IP [IP address]," and the same message covers codes 5.7.606 through 5.7.649. Microsoft's delist guide says a source is added "If a source IP address is identified as a potential threat to the service." Every message from that IP to a Microsoft 365 recipient bounces until it's removed.
This happens to senders outside Microsoft 365. Say your mail goes out from a web host, a shared server or an office connection, and someone else on that IP sent spam, or a hacked account on your side did. The ban is on the IP, not your domain.
What does a Microsoft block mean for my business?
A Microsoft block means none of your email reaches customers on Outlook or Microsoft 365 until it's lifted, and that can be a big share of your customers. Quotes, invoices and replies all bounce at once. The first job is to find out whether the cause is a hacked mailbox on your side, because a delist won't hold if the spam keeps coming.
How do I get delisted from a 5.7.606 block?
You get delisted by submitting the IP through Microsoft's Office 365 Anti-Spam IP Delist Portal. According to Microsoft's delist guide, the steps are:
- Go to sender.office.com and follow the instructions there.
- Enter one email address and one IP. Use the address that received the bounce and the IP shown in the error. The portal takes one of each per visit.
- Confirm by email. Microsoft sends a message with a confirmation link that returns you to the portal.
- Select Delist IP.
Microsoft says removal "might take up to 24 hours or longer." Before you submit, find out why the IP was listed. If the spam is still flowing, Microsoft notes the IP "might be blocked again."
If the code is 550 5.7.511 "Access denied, banned sender," the portal won't work. Microsoft's delist guide says to email [email protected] with the full bounce code and IP address, and that "Microsoft will contact you within 48 hours with the next steps."
What does 550 5.7.708 mean?
The 550 5.7.708 code means Microsoft 365 won't accept outbound traffic from your tenant's sending IP because its reputation is low. Microsoft's fix page for 5.7.703 through 5.7.750 gives the text as "Access denied, traffic not accepted from this IP" and says the issue "is more likely to affect new customers, such as those who have a Microsoft 365 trial subscription." Its fix is for your admin to "contact Microsoft Support to request an IP address exception until you assign Exchange Online licenses."
A close relative, 550 5.7.705 "Access denied, tenant has exceeded threshold," means your tenant sent too much spam or bulk mail. Microsoft names two common sources: "A compromised on-premises server that routes mail to Exchange Online" and "A compromised admin account that's used to create connectors." Secure the accounts, turn on multifactor sign-in, remove connectors you don't recognize, and then contact Microsoft support. Microsoft says to do that "After you address the underlying cause."
How do I tell which block I have?
You tell them apart by who sent the bounce and what the code says. A 5.7.606 bounce comes back when you send to a Microsoft 365 customer from outside it. A 5.7.705 or 5.7.708 bounce comes from your own Microsoft 365 tenant refusing to send. To check a long bounce, paste it into the free reader on the 550 5.7.606 page at postmortem.report. It runs in your browser and names the error.
Blocks often follow a hacked mailbox, and weak email security makes it easier for someone to send as you. When I checked local businesses' email settings, I found 79.2% of 847 businesses that email from their own domain (1,527 checked) in Southwest Michigan have no DMARC enforcement. Got a different code? The email rejection error codes guide lists every code with its own fix page.
When should you get help with a blocked IP?
You should get help when the block comes back after a delist, or when you suspect a compromised account. Both mean the cause is still there. If you run a business in Battle Creek, Kalamazoo or anywhere in Southwest Michigan, my DMARC audit service maps every system that sends as your domain and locks down SPF, DKIM and DMARC so spoofed mail stops getting through. Call me at (269) 460-1772 or use the contact form and tell me what the bounce says.