Microsoft 365 "550 5.7.606 Access denied, banned sending IP": how to delist your IP

What it means

Microsoft 365 (Exchange Online), which hosts business mailboxes of many companies, refuses your email because your sending IP address is on its list of banned IPs. The bounce usually looks like this:

550 5.7.606 Access denied, banned sending IP [203.0.113.10]. To request
removal from this list please visit https://sender.office.com/ and follow
the directions. For more information please go to
http://go.microsoft.com/fwlink/?LinkID=526655 AS(1430)

The code can be anything between 5.7.606 and 5.7.649; they all mean the same thing. The block is on the IP, so every email from that server to any Microsoft 365 organization fails.

Why it happens

• Spam or phishing was sent from this IP, possibly by a compromised account or hacked website.
• Poor reputation of the IP range, common on low-cost hosting and VPS providers.
• High volumes of email to invalid addresses or unengaged recipients.
• A new IP with no history that suddenly sends a lot.

How to check

• Send a test email: on the Delivmail home page (/), copy your unique test address and send it a normal email from the same server, tool or mailbox that bounced. Open the report when it is ready.
• Read the blacklist and reverse DNS sections. Being banned by Microsoft often comes with listings on public blacklists. You can check the IP alone on /blacklists.
• Look at your server logs for unusual volumes or accounts sending much more than usual.

How to fix it

1. Fix the cause first. Secure compromised accounts, fix abused forms or scripts, and remove spam from the queue. If you delist without fixing, the IP will be banned again, and repeated delisting may be refused.
2. Check the basics: reverse DNS with a real hostname, SPF, DKIM and DMARC passing for your domain.
3. Use the Microsoft delist portal at sender.office.com:
   • Enter an email address you can access and the IP from the bounce.
   • Microsoft sends a confirmation link to that address. Open it.
   • On the page that opens, click the button to delist the IP.
4. Wait for the removal to take effect. It usually works within a few hours, but can take up to 24 hours.
5. If the IP belongs to a hosting or email provider and you cannot fix the source, send them the bounce. They can investigate their customers or give you a clean IP.
6. Keep good habits: send only to people who asked for your emails, remove bounced addresses and add an unsubscribe link to marketing emails.

Not the same as Outlook.com

The portal at sender.office.com is for Microsoft 365 business mailboxes. Consumer Outlook.com and Hotmail mailboxes have separate blocks (codes like S3150) and a separate support form.

Check that it is fixed

Send a new Delivmail test to confirm authentication passes and the IP is clean. After the delisting has taken effect, send a normal email to the Microsoft 365 address that bounced. If the error comes back, the cause is still active: look again at your logs before requesting a new delisting.