550 5.7.606 to 5.7.649: access denied, banned sending IP
Your sending IP address is on Microsoft 365's blocked senders list, so mail to Microsoft 365 recipients is refused. You can request removal through Microsoft's delist portal.
550 5.7.606-649 Access denied, banned sending IP [<Source IP address>]: To request removal from this list please visit https://sender.office.com/ and follow the directions.
Start of the NDR text as shown in Microsoft's delist portal article.
What 550 5.7.606-649 means
Microsoft says Microsoft 365 uses a blocked senders list to protect customers from spam, spoofing and phishing. If a source IP address is identified as a potential threat, it's added to the list, and mail from it to Microsoft 365 organizations is blocked. Any code from 5.7.606 to 5.7.649 with "banned sending IP" means you're on that list.
For these codes, Microsoft provides the Office 365 Anti-Spam IP Delist Portal at sender.office.com. You enter the email address that received the NDR and the IP address from the error, confirm by email, then select Delist IP. Microsoft notes that removal can take up to 24 hours or longer, and that an IP sending abusive or malicious mail can be blocked again.
Before you request removal, find out why the IP was listed. Microsoft points senders to its deliverability practices and asks them to make sure the IP's reputation isn't degraded by compromise or malicious traffic. On shared hosting, other customers' mail can affect the IP you send from.
Likely causes
- Spam or malicious mail was sent from your IP, often through a compromised account, website or server.
- A shared IP was listed because of another customer's sending.
- Sending patterns Microsoft treats as abusive, such as large volumes to invalid addresses.
How to fix it
If you sent the message
- Find and stop the source of bad mail first: compromised mailboxes, web forms, scripts.
- Go to sender.office.com, enter the address that got the NDR and the IP from the error, and follow the confirmation steps.
- Allow up to 24 hours or longer for the delisting to take effect.
- Check the IP on public blocklists as well.
If you're the recipient or their admin
- Recipients can't remove a sender from Microsoft's list; the sender has to request delisting.
Frequently asked questions
How long does Microsoft delisting take?
Microsoft says results vary and removal can take up to 24 hours or longer after you complete the delist portal steps.
Why was my IP listed if I only send normal business email?
Common reasons are a compromised mailbox or website sending spam from the same IP, or a shared hosting IP used by other senders. Fix the source, then delist; otherwise the IP can be blocked again.
Sources
- Remove yourself from the blocked senders list and address 5.7.511 Access denied errors (Microsoft Learn)
- Email nondelivery reports (NDRs) and SMTP errors in Exchange Online (Microsoft Learn)
Provider messages are quoted as the provider publishes them. Servers can change their wording, so the bounce you received may differ slightly.
Related codes
Related guides
How to get your domain or IP removed from an email blacklist
How to check if your mail server IP or domain is on a DNS blocklist, find the real cause, and request removal from Spamhaus, SpamCop, Barracuda and Microsoft.
9 min read SPF, DKIM & DMARCGmail, Yahoo and Microsoft bulk sender requirements explained
What Gmail, Yahoo and Outlook.com require from bulk senders: SPF, DKIM, DMARC, alignment, one-click unsubscribe and spam rates, with the real dates and limits.
9 min read Running email day to dayWhy did this email go to spam or quarantine?
Why an email went to the spam folder or quarantine, what each spam verdict means, how to find the reason in the headers, and how to fix or release the message.
9 min read