Microsoft 365 550 5.1.8: “Access denied, bad outbound sender” AS(42004)

Short answer: Microsoft 365 has blocked this mailbox from sending because it sent too much mail or mail that looked like spam, usually after the account was hacked. Fix: an admin secures the account (password, MFA, rules, forwarding), then unblocks it under Restricted entities in the Microsoft Defender portal.

The bounce looks like this
Your message couldn't be delivered because you weren't recognized as a valid sender. The most common reason for this is that your email address is suspected of sending spam and it's no longer allowed to send email. …
Remote Server returned '550 5.1.8 Access denied, bad outbound sender AS(42004)'

What it means

The mailbox went over Exchange Online's sending limits (10,000 recipients a day, or lower limits set in your outbound spam policy) or sent mail that Microsoft scored as spam, so it is restricted from sending. It still receives mail but can't send anything, to anyone, until the block is lifted. Microsoft treats this as a sign of a compromised account; the other common cause is cold outreach or bulk mail sent from a normal mailbox. Once it is on the Restricted entities list, only an admin of your Microsoft 365 organisation can remove it.

How to fix it

  1. Users: you can't fix this yourself. Tell your Microsoft 365 admin, and look in Sent Items for mail you didn't send – that means the account was hacked.
  2. Admins, secure the account first: reset the password (don't email the new one to the user), turn on MFA, sign the user out of all sessions, and remove MFA methods, app consents and admin roles you don't recognise.
  3. Check rules and forwarding: look for Inbox rules that forward, redirect or delete mail, and for forwarding to outside addresses (Get-InboxRule -Mailbox user@yourdomain.com -IncludeHidden and Get-Mailbox -Identity user@yourdomain.com | Format-List Forwarding*Address,DeliverTo*). Remove anything the user didn't create.
  4. Unblock: Microsoft Defender portal → Email & collaboration → Review → Restricted entities, select the mailbox, choose Unblock, work through the wizard and Submit – or run Remove-BlockedSenderAddress -SenderAddress user@yourdomain.com. Restrictions usually lift within an hour, at most 24 hours.
  5. Mailbox not on that page? Then it hit a sending limit, and sending resumes when the 24-hour window clears; with the default outbound spam policy action the block lasts until the next day (UTC).
  6. Blocked again after cold outreach or a newsletter? Microsoft 365 mailboxes aren't meant for bulk mail. Send campaigns through an email sending service from a separate domain or subdomain with SPF and DKIM set up (setup guides).
  7. Keep the User restricted from sending email alert on (Defender portal → Email & collaboration → Policies & rules → Alert policy) so you hear about the next block straight away.

Check your domain now

After the fix, send a test email to see SPF, DKIM and DMARC pass on a real message, then keep an eye on it: free DMARC monitoring shows every service that sends mail as your domain and which ones fail, in plain English.

Rather not touch DNS? I set up SPF, DKIM and DMARC without breaking your other senders, with a before/after report.

Get it fixed on Fiverr

Prefer to do it yourself? Get the step-by-step Fix Kit ($15) – 28-page guide, checklist, 20+ providers.

Other bounce errors