550 5.7.606-649: Access Denied, Banned Sending IP (Microsoft)

550 5.7.606 through 5.7.649 means Microsoft 365 has blocked the IP address your mail came from, so Exchange Online Protection is refusing everything from it. This is the self-service version of a Microsoft IP block: once you've fixed whatever caused it, you can request removal yourself at sender.office.com. Microsoft says removal can take up to 24 hours or longer.

Microsoft's documented example:

550 5.7.606-649 Access denied, banned sending IP [203.0.113.7];
To request removal from this list please visit https://sender.office.com/
and follow the directions. For more information please go to
https://go.microsoft.com/fwlink/?LinkID=526653.

In real bounces you'll see a single code from the range, such as 5.7.606, followed by the same text.

What it means

Every message to a Microsoft 365 mailbox passes through Exchange Online Protection (EOP), Microsoft's filtering layer. EOP keeps a private list of IPs it won't accept mail from. It isn't a public blocklist, so blocklist checkers won't show it. The bounce is your only evidence.

Microsoft's stated cause is short: the IP you're sending from was banned. Its suggested fix is equally short: follow deliverability best practices, make sure the IP's reputation isn't degraded by compromise or malicious traffic, and use the delist portal if you think the block is a mistake.

This affects Microsoft 365 business recipients. Outlook.com and Hotmail use different codes, such as S3150, and a different delisting form. If 5.7.606 shows up for some business domains and not others, that's expected: only recipients on Microsoft 365 are affected.

Don't confuse it with 550 5.7.511, "banned sender". That one can't be cleared through the portal and needs an email to Microsoft.

Common causes

Microsoft doesn't publish the triggers. In practice, the usual suspects are:

1. A compromised account, server or form. A hijacked mailbox or an abused contact form sends a burst of spam, and the IP gets blocked. This is the case Microsoft's docs point to.
2. A new or recycled IP. A freshly provisioned cloud server, a new office internet connection or a new hybrid Exchange server can arrive with no history or with someone else's bad history. Blocks on IPs that have never sent mail before are a recurring complaint on Microsoft's forums.
3. Marketing mail to poor data. High complaint rates, lots of invalid addresses or spam trap hits, often after mailing an old or purchased list.
4. A shared IP. On a shared ESP pool or shared hosting, someone else's mail can get the IP blocked. If it's your ESP's IP, the ESP should request removal. See my ESP's shared IP is blocklisted.

How to fix it

1. Get the IP from the bounce. Use the address in the brackets, not what you assume your server's IP is.
2. Find and fix the cause. Check sent volume from that IP over the past few weeks. Look for compromised mailboxes (new forwarding rules, odd logins, sudden volume), abused forms or scripts, and open relay. For marketing mail, check list source, bounce rate and complaints for recent campaigns.
3. Check public blocklists while you're at it. A compromised IP is often on Spamhaus or others too. The blocklist overview explains which ones matter.
4. Request removal at sender.office.com. Enter the email address that received the bounce and the IP address from the bounce (one of each per visit), and submit. Microsoft emails a confirmation link to that address. Click it, then select Delist IP in the portal.
5. Wait. Microsoft says results vary widely and removal can take up to 24 hours or longer. Hold off on resending large volumes to Microsoft 365 recipients until it clears.

If the portal says the IP isn't blocked but you're still getting 5.7.606, or removal doesn't stick, the next step is a support case with Microsoft, or a question to your ESP or hosting provider if it's their IP. How to get delisted by Microsoft covers the escalation paths.

How to confirm it's fixed

Send a test to a Microsoft 365 mailbox you can check, such as a colleague at another company, and confirm it's accepted. Watch your logs for 5.7.6xx codes over the next few days. If mail is accepted but lands in Junk, that's a separate reputation problem; see why emails go to junk in Outlook.

How to keep it from coming back

Microsoft's own warning: if the IP keeps sending abusive or malicious mail after removal, it may be blocked again. So:

• Enforce multifactor authentication and alert on unusual outbound volume.
• Protect forms with CAPTCHA and rate limits.
• Warm up new IPs gradually instead of starting at full volume.
• Mail only people who opted in, and suppress bounces and complainers quickly. If you're restarting an old list, read emailing an old list first.

When to get help

If the block keeps coming back after removal, or you can't find what's sending from the IP, it's worth having someone look at your logs and sending setup.

FAQ

What's the difference between 5.7.606 and 5.7.649?

Microsoft documents the whole range as one error with one fix and doesn't say what the individual numbers mean. Treat any code in the range the same way.

Is there a fee to get delisted?

No. The sender.office.com portal is free. Anyone charging to remove you from Microsoft's list isn't Microsoft.

Why don't blocklist checkers show the block?

Microsoft's list is internal to Exchange Online Protection. It isn't published as a DNS blocklist, so public checkers can't see it.

Can the recipient whitelist my IP?

Microsoft doesn't document a recipient-side override for this block, and even if one works, it would only help that one company. Getting the IP removed fixes it for every Microsoft 365 recipient.