Microsoft 365 "550 5.1.8 Access denied, bad outbound sender"

What it means

A Microsoft 365 user tries to send an email and gets back:

550 5.1.8 Access denied, bad outbound sender

Microsoft has placed this account on its Restricted entities list. It does this when an account sends a large amount of spam or goes over the sending limits. The account can still receive email, but it can no longer send any.

In most cases, the account was hacked: someone stole the password (often with a phishing email) and used it to send spam. Sometimes it is a legitimate but very large mass mailing sent from a normal mailbox. Microsoft 365 mailboxes have daily sending limits and are not designed for newsletters.

Why it matters

• The user cannot send email until an administrator unblocks the account.
• If the account was hacked, the attacker may still have access, may have created hidden forwarding rules, or may have read sensitive emails.
• Spam sent from your domain can damage its reputation and get it blacklisted.

How to check

• In the Microsoft Defender portal, open the Restricted entities page: the blocked user is listed there.
• Look at the Sent Items folder and the sign-in logs for messages and logins the user does not recognise.
• Check your blacklists: type your domain at /domain-scanner or check your sending IPs at /blacklists.

How to fix it

1. Secure the account first. Reset the password, sign the user out of all sessions, and turn on multi-factor authentication (MFA).
2. Look for traps the attacker left. Remove unknown inbox rules, forwarding to outside addresses, and unknown apps or devices connected to the account.
3. Scan the user's computer for malware if the password may have been stolen from it.
4. Unblock the user. In the Defender portal, go to the Restricted entities page, select the user and choose to unblock. It can take up to 24 hours to work. Microsoft limits how many times an account can be unblocked, so do not skip the earlier steps.
5. Move mass mailings elsewhere. If the block came from a real newsletter, send it through a dedicated email marketing service, not a normal mailbox.

Microsoft explains the full process in Responding to a compromised email account.

Check that it is fixed

Once unblocked, send a short email from the account to an outside address. Then send a test email from it to the address on the Delivmail home page /: the report should show SPF, DKIM and DMARC passing and no blacklist listing. With the paid dashboard's DMARC monitoring, watch for unexpected sending from your domain in the following weeks.