5.7.501 to 5.7.503: access denied, spam abuse detected or banned sender
Microsoft 365 banned the account that sent the message because it detected spam coming from it. The account usually needs cleaning up, new credentials and a support request.
Access denied, spam abuse detected
Microsoft's description for 5.7.501 in its Exchange Online NDR reference; 5.7.502 and 5.7.503 read "Access denied, banned sender".
What 550 5.7.501-503 means
Microsoft's NDR reference lists three related codes. 5.7.501 is "Access denied, spam abuse detected", and 5.7.502 and 5.7.503 are "Access denied, banned sender". For all three, the cause is the same: the sending account was banned because of detected spam activity.
These are outbound blocks on your own account, not a recipient refusing you. The most common reason is a compromised mailbox: an attacker signs in with a phished or reused password and sends spam or phishing until Microsoft stops it. Bulk sends from an ordinary mailbox, or a misbehaving app sending through a user account, can also trigger it.
Microsoft's fix is to verify that the account issues are resolved, reset the account's credentials, and then contact support through your regular channel to restore the account's ability to send. For 5.7.501, Microsoft also points to its article on 451 5.7.500-699 (ASxxx). Before you ask for the ban to be lifted, check the account properly: sign-in history, inbox and forwarding rules, registered MFA methods and app consents. If the cause isn't removed, the account can be banned again.
Likely causes
- A compromised mailbox used by an attacker to send spam or phishing.
- Large volumes of bulk or marketing mail sent from a normal user mailbox.
- An app, script or device sending through the account at a high rate.
How to fix it
If you sent the message
- Treat it as a possible account compromise: reset the password, sign the user out of all sessions and review sign-in logs.
- Remove unknown inbox rules, forwarding and app consents, and check the MFA methods on the account.
- Then contact Microsoft Support through your regular channel to restore sending.
- Move bulk mail to a service built for it instead of a user mailbox.
If you're the recipient or their admin
- No action needed by recipients: the block is on the sender's Microsoft 365 account.
Frequently asked questions
Is 5.7.501 the same as being on Microsoft's banned IP list?
No. 5.7.501 to 5.7.503 apply to a sending account in Microsoft 365. Codes such as 5.7.511 and 5.7.606 to 5.7.649 are about a banned sending IP address and have their own delisting steps.
Does 'spam abuse detected' mean my account was hacked?
Often, yes. A compromised mailbox sending spam is the most common reason. Reset the password, revoke sessions, remove unknown rules and check MFA before asking Microsoft to restore sending.
Sources
- Email nondelivery reports (NDRs) and SMTP errors in Exchange Online (Microsoft Learn)
- Responding to a compromised email account (Microsoft Learn)
Provider messages are quoted as the provider publishes them. Servers can change their wording, so the bounce you received may differ slightly.
Related codes
- 550 5.1.8 550 5.1.8: access denied, bad outbound sender
- 550 5.7.708 550 5.7.708: access denied, traffic not accepted from this IP
- 451 4.7.500-699 451 4.7.500 to 4.7.699 (ASxxx): access denied, please try again later
- 550 5.7.511 550 5.7.511: access denied, banned sender
- 550 5.7.12 5.7.12: sender was not authenticated by organization
- 550 5.7.510 5.7.510: access denied, recipient domain does not accept email over IPv6
- 550 5.7.236 550 5.7.236: daily limit for external mail from onmicrosoft.com domains
Related guides
Microsoft 365 user restricted from sending (550 5.1.8): how do you investigate and unblock it?
Fix 550 5.1.8 Access denied, bad outbound sender: why Microsoft 365 restricts users, how to check for compromise, unblock on Restricted entities, prevent it.
9 min read Running email day to dayHow do you remediate a compromised Microsoft 365 account?
Microsoft 365 hacked account checklist for admins: disable sign-in, revoke sessions, remove attacker MFA, rules and forwarding, then investigate and unblock.
11 min read Phishing & threatsSigns your business email account has been compromised, and what to do
The warning signs of a hacked business mailbox, from hidden inbox rules to MFA prompts, and the step-by-step response for Microsoft 365 and Google Workspace.
10 min read Setup guidesHow do you configure the outbound spam policy in Microsoft 365?
Configure the Microsoft 365 outbound spam policy: recipient limits, block actions, external forwarding, custom policies per group and the PowerShell for each.
10 min read