Microsoft 365 550 5.7.606 / 5.7.511: “Access denied, banned sending IP”

Short answer: Microsoft 365 has put your sending IP on its blocked senders list, so mail to business mailboxes hosted at Microsoft bounces. Fix: request removal at sender.office.com (5.7.606–649), or email the bounce to delist@microsoft.com (5.7.511).

The bounce looks like this
550 5.7.606-649 Access denied, banned sending IP [203.0.113.10]: To request removal from this list please visit https://sender.office.com/ and follow the directions.
550 5.7.511 Access denied, banned sender[203.0.113.10]. To request removal from this list, forward this message to delist@microsoft.com.

What it means

The recipient's company email runs on Microsoft 365 (Exchange Online), and Microsoft has added your server's IP to its blocked senders list after seeing spam, spoofing or phishing from it or its range. Every message from that IP to any Microsoft 365 organisation bounces until it is removed. This is a different list from the Outlook.com consumer block (S3150/S3140).

How to fix it

  1. 5.7.606 to 5.7.649: open the Office 365 Anti-Spam IP Delist Portal, enter the email address that got the bounce and the IP from the error (one of each per visit), confirm the link Microsoft emails you, then click Delist IP. Removal can take up to 24 hours or longer.
  2. 5.7.511: the portal won't work for this one. Forward the full bounce, including the IP, to delist@microsoft.com; Microsoft says it replies within 48 hours with next steps.
  3. Before you delist, fix the cause: authentication (check your domain below), a compromised account or website sending spam, or bulk mail without opt-in. Messages still have to pass Microsoft's filters afterwards, and the IP can be blocked again.
  4. If Microsoft refuses and the IP belongs to your hosting provider, ask the provider to contact Microsoft, or move mail to a reputable sending service.

Check your domain now

Rather have it unblocked for you? I find why Microsoft blocked your server, fix SPF, DKIM, DMARC and reverse DNS, and file the delist request, following up until Microsoft answers.

Get it unblocked on Fiverr

Prefer to do it yourself? Fix Kit ($15) for SPF, DKIM and DMARC, or the VPS Security Kit ($19) so a hacked server can't get the IP blocked again.

Other bounce errors