550 5.7.511: Access Denied, Banned Sender (Microsoft 365)

550 5.7.511 means Microsoft 365 (Exchange Online Protection) has banned the IP address your mail came from, and it won't accept anything from it. Unlike Microsoft's ordinary IP blocks, this one can't be cleared through the self-service delist portal. Microsoft's instruction is to email delist@microsoft.com with the full bounce code and the IP address, after you've fixed whatever got the IP banned.

Microsoft's NDR reference gives the core text as Access denied, banned sender. A real bounce posted to Microsoft's Q&A forum looked like this (IP replaced, and the removal address was masked in the post):

550 5.7.511 Access denied, banned sender[203.0.113.7]. To request removal
from this list please forward this message to [removal address].
For more information please go to
http://go.microsoft.com/fwlink/?LinkId=526653. AS(1410)

The removal address and trailing codes vary. Microsoft's current documentation says to use delist@microsoft.com.

What it means

Every message sent to a Microsoft 365 mailbox passes through Exchange Online Protection (EOP), Microsoft's filtering layer. EOP keeps its own lists of IPs it won't accept mail from. This is a private list: no public lookup tool or third-party blocklist checker will show it. The bounce is the only evidence.

Microsoft has two IP-level rejection codes, and the difference matters because the fix is different:

Microsoft's delist portal documentation is explicit: if you get 5.7.511, "you can't use the delist portal." Microsoft doesn't publish what separates the two, but the manual route suggests 5.7.511 is reserved for cases it wants a person to review.

Despite the word "sender," the docs describe the cause as the sending IP being banned. It isn't about your From address.

Common causes

Microsoft doesn't publish the triggers. In general, IP bans come from what the IP has been sending:

1. A compromised account or server. A hijacked mailbox, a web form or WordPress plugin abused to send spam, or an open relay. The IP's traffic suddenly looks like spam, and it gets banned.
2. Sustained spam complaints or spam trap hits from a marketing program sending to a poorly sourced or stale list.
3. A shared IP you don't control. On shared hosting or a shared ESP pool, another customer's mail can earn the ban for everyone. See my ESP's shared IP is blocklisted.
4. A newly assigned IP with a bad history. Cloud and hosting IPs get recycled. You can inherit a ban the previous tenant earned.

How to fix it

1. Confirm the IP. Take it from the bounce, not from what you think your server's IP is. If you send through an ESP, it's the ESP's IP, and the ESP should handle the request (tell them).
2. Find and stop the cause first. Check for compromised accounts (unusual sent volume, new forwarding rules, unfamiliar logins), abused forms or scripts, and open relay. Pull your sending logs for the last few weeks and look at what actually left that IP. If it's a marketing stream, look at list source, complaint rates and recent sends to old data. Emailing an old list is a common trigger.
3. Check the public blocklists too. If your IP is compromised, it's often on Spamhaus or others as well. The blocklist overview explains which ones matter, and we got blocklisted walks through the cleanup.
4. Email delist@microsoft.com. Include the full NDR code (the whole bounce line, not just "5.7.511") and the IP address. Briefly say what happened and what you changed. Microsoft says it will contact you within 48 hours with next steps.
5. Don't send to Microsoft 365 recipients from that IP while you wait. Repeated attempts won't help. If you have a clean alternative path, such as an ESP or a different server, use it for critical mail.

How to confirm it's fixed

Once Microsoft confirms the removal, send a test to a Microsoft 365 mailbox you control (a colleague at another company works) and check that it's accepted. Then watch bounce logs for 5.7.511 and 5.7.606 over the next several days. If acceptance works but mail lands in Junk, that's a reputation problem, not a block. See why emails go to junk in Outlook.

How to keep it from coming back

• Turn on multifactor authentication for every mailbox, and alert on unusual outbound volume.
• Lock down web forms with CAPTCHA and rate limits, and keep plugins patched.
• Make sure no server will relay mail for unauthenticated clients.
• Send marketing mail only to people who asked for it, remove bounces and complainers promptly, and don't revive old lists without a plan.
• Separate marketing and transactional streams onto different IPs or providers, so a problem in one doesn't ban the other.

When to get help

If you can't find what triggered the ban, or Microsoft's reply asks for a remediation explanation you can't give yet, a second set of eyes on your logs and sending practices is worth it. Get in touch.

FAQ

Can I use sender.office.com to fix 5.7.511?

No. Microsoft's documentation says the delist portal doesn't work for 5.7.511. Use delist@microsoft.com instead.

Is this the same as an Outlook.com block?

No. 5.7.511 comes from Microsoft 365 (business mailboxes). Outlook.com and Hotmail use different codes, like S3150, and a different delisting form. How to get delisted by Microsoft covers both.

How long does it take?

Microsoft says it will reply within 48 hours with next steps. How long the actual removal takes depends on the case and isn't documented.

My IP isn't on any blocklist. Why is it banned?

Microsoft's lists are private and separate from public DNS blocklists. A clean result on a blocklist checker says nothing about EOP.