550 5.7.511: access denied, banned sender
Your sending IP address is banned by Microsoft 365 and needs further investigation. Unlike other blocks, you can't use the self-service delist portal.
550 5.7.511 Access denied, banned sender[xxx.xxx.xxx.xxx]. To request removal from this list, forward this message to delist@microsoft.com.
Start of the example NDR in Microsoft's delist portal article.
What 550 5.7.511 means
Microsoft's NDR reference describes 5.7.511 as "Access denied, banned sender": the IP you're trying to send from was banned. Its delist article explains the difference from the more common 5.7.606 to 5.7.649 blocks: in some cases Microsoft needs to investigate traffic from the IP further, so the self-service delist portal won't work.
To request removal, do what the NDR says: send a message to delist@microsoft.com and include the full NDR code and the IP address. Microsoft says it will contact you within 48 hours with next steps.
Use those 48 hours. A 5.7.511 usually follows serious abuse from the IP, such as a compromised server or account sending large amounts of spam. Have a clear answer about what happened and what you changed, because Microsoft can block the IP again if bad traffic continues.
Likely causes
- Significant spam or malicious traffic from your IP address.
- A compromised server, website or mailbox using your IP.
- A shared IP abused by another sender.
How to fix it
If you sent the message
- Find and stop the abuse source before contacting Microsoft.
- Email delist@microsoft.com with the full NDR code and the IP address.
- Expect a reply within 48 hours, and be ready to explain what you fixed.
If you're the recipient or their admin
- Recipients can't lift this block; the sender has to work with Microsoft.
Frequently asked questions
Can I use sender.office.com for 5.7.511?
No. Microsoft says the delist portal doesn't work for 5.7.511. Forward the NDR to delist@microsoft.com with the full NDR code and IP address instead.
How long does Microsoft take to respond?
Microsoft says it will contact you within 48 hours with next steps.
Sources
- Remove yourself from the blocked senders list and address 5.7.511 Access denied errors (Microsoft Learn)
- Email nondelivery reports (NDRs) and SMTP errors in Exchange Online (Microsoft Learn)
Provider messages are quoted as the provider publishes them. Servers can change their wording, so the bounce you received may differ slightly.
Related codes
Related guides
How to get your domain or IP removed from an email blacklist
How to check if your mail server IP or domain is on a DNS blocklist, find the real cause, and request removal from Spamhaus, SpamCop, Barracuda and Microsoft.
9 min read Phishing & threatsHow to prevent business email compromise (BEC)
What business email compromise is, what the FBI's 2025 IC3 figures show, and the payment checks and technical controls that stop BEC fraud at small firms.
9 min read Phishing & threatsWhat to do after clicking a phishing link
Clicked a phishing link or typed your password into a fake page? Steps for users and admins: reset, revoke sessions, add MFA, check mailbox rules and report it.
9 min read Phishing & threatsMicrosoft 365 user restricted from sending (550 5.1.8): how do you investigate and unblock it?
Fix 550 5.1.8 Access denied, bad outbound sender: why Microsoft 365 restricts users, how to check for compromise, unblock on Restricted entities, prevent it.
9 min read Phishing & threatsSigns your business email account has been compromised, and what to do
The warning signs of a hacked business mailbox, from hidden inbox rules to MFA prompts, and the step-by-step response for Microsoft 365 and Google Workspace.
10 min read