Microsoft 5.7.606: banned sending IP
By Jose Pollman · Published
Microsoft has blocklisted the IP address you send from. Every code from 5.7.606 to 5.7.649 means the same thing, and it is a judgement about that address's history rather than about this message. Request delisting through Microsoft's portal, then fix the cause — usually failing authentication or a compromised account sending spam.
The error
550 5.7.606 Access denied, banned sending IP [1.2.3.4]
Access denied, banned sending IP. To request removal from this list please visit https://sender.office.com/What it means
Microsoft has blocklisted the IP you are sending from. The codes 5.7.606 through 5.7.649 all mean the same thing; the varying number identifies which internal list caught it.
The receiver is refusing your mail because of how your sending IP or domain behaves, not because of this particular message.
Why it happens
Microsoft blocks the address rather than the message, so a shared or recently reassigned IP can inherit a block earned by someone else. It also follows a compromise: one account sending spam for an afternoon is enough.
How to fix it
- Confirm the IP in the bounce is actually yours and is not shared with other senders.
- Fix whatever caused it — a compromised mailbox, an open relay, or a list you should not have mailed.
- Submit a delisting request at sender.office.com with the full bounce text and the IP.
- Delisting typically takes 24 hours or so, and repeated requests without fixing the cause will not succeed.
Official documentation: Microsoft: use the delist portal.
Related guides
- Microsoft 5.4.1: relay access denied — Microsoft returns 5.4.1 for two different situations: the recipient address does not exist in the destination tenant, or the receiving system does not accept mail for that domain at all.
- Microsoft 5.7.23: SPF violation — The receiving Microsoft system checked your SPF record and the sending IP was not authorised by it.
- TLS and DANE validation bounces — Microsoft would not deliver because the destination’s TLS setup failed validation — no STARTTLS, an expired certificate, a hostname mismatch, or a failing DANE or DNSSEC record.