550 5.7.606 'Access Denied, Banned Sending IP': How to Delist From Microsoft 365

550 5.7.606 Access denied, banned sending IP [203.0.113.25] means Microsoft 365 has put your sending IP on its blocked senders list. Every message from that IP to any Microsoft 365 organisation will be refused until the IP is delisted. The fix is Microsoft's self-service portal at sender.office.com: enter the email address that received the bounce and the blocked IP, confirm by email, then select Delist IP. Microsoft says it can take up to 24 hours or longer. Fix whatever caused the listing first, or the IP will be blocked again.

Reading the bounce

Microsoft's own example, from its delist guide (read 2 November 2026):

550 5.7.606-649 Access denied, banned sending IP [Source IP address]: To request removal from this list please visit https://sender.office.com/ and follow the directions.

• 550 is a permanent refusal. Your server will not retry.
• 5.7.606 to 5.7.649 is the range Microsoft uses for this block. You will see one number from it, such as 5.7.606.
• The IP in brackets is the IP Microsoft blocked. That is the public IP of the server that handed over the message: yours, or your provider's.

Microsoft's Exchange Online NDR reference (updated 24 August 2026) describes the cause simply: "The IP that you're trying to send from was banned." Its suggested fix is to follow email deliverability best practice, make sure the IP's reputation is not degraded by compromise or malicious traffic, and use the self-service portal if you believe the block is a mistake.

Is it 5.7.606, 5.7.511 or something else?

Microsoft uses several similar-looking codes. They need different fixes.

Code	Text	What it means	What to do
5.7.606-649	Access denied, banned sending IP	Your IP is on the Microsoft 365 blocked senders list	Delist at sender.office.com
5.7.511	Access denied, banned sender	Microsoft wants to investigate the IP further	Email delist@microsoft.com with the NDR; the portal will not work
5.7.705, 5.7.708	Tenant has exceeded threshold / traffic not accepted from this IP	You are sending from Microsoft 365, and your tenant is restricted	Fix compromises, then contact Microsoft support
5.7.509	Sending domain does not pass DMARC	Your domain failed DMARC with p=reject	Fix authentication. See 550 5.7.509
5.4.1	Recipient address rejected: Access denied	The recipient does not exist	Suppress the address. See 550 5.4.1
451 4.7.650	Temporarily rate limited due to IP reputation	Outlook.com consumer throttling	Slow down. See 451 4.7.650

Only 5.7.606-649 uses the portal. If you cannot tell which one you have, paste the full bounce into Bounce Doctor.

Delisting step by step

From Microsoft's guide:

1. Go to the Office 365 Anti-Spam IP Delist Portal at sender.office.com.
2. Enter the email address that received the NDR and the IP address from the error message. Microsoft allows "only one email address and one IP address per visit".
3. Select Submit.
4. Microsoft sends a message to the address you entered. Select the confirmation link in it to return to the portal.
5. In the portal, select Delist IP.

Microsoft then notes: "Results can vary widely before the restrictions are removed. It might take up to 24 hours or longer." After removal, mail that passes Microsoft's normal filtering is delivered, and Microsoft adds a warning: "Verify that messages aren't abusive or malicious. Otherwise, the IP address might be blocked again."

If the bounce says 5.7.511

Microsoft says you cannot use the portal for 5.7.511. Send a message to delist@microsoft.com with the full NDR code and the IP address. Microsoft says it will contact you within 48 hours with next steps.

If you are mailing Outlook.com or Hotmail

The blocked senders list above is for Microsoft 365. For Outlook.com, the consumer service, Microsoft's guide points to a separate delisting form and asks senders to read the Outlook.com sender support FAQ first.

Before you delist: find the cause

Delisting without changing anything usually buys a few days. Check these first:

Likely cause	What to check
Mail to unverified, old or bought lists	Recent bounce rates. Invalid addresses and spam traps are a common trigger
A sudden jump in volume	New domains, inboxes or campaigns added at full speed
Complaints	Cold mail to people with no reason to expect it, many follow-ups to non-responders
A compromised account or server	Outbound logs and sent items for mail you did not write
A new or cheap IP with a history	A fresh VPS or shared IP can arrive already blocked
Authentication gaps	SPF, DKIM and DMARC for the sending domain

The IP blacklist check shows whether the same IP is also on Spamhaus, Barracuda, SpamCop and others, which often happens together. The reverse DNS lookup confirms whose IP it is.

If the IP is not yours

If you send through an email service provider or a cold email platform's shared pool, the blocked IP belongs to them.

• Send them the full bounce with timestamps. They can delist it and deal with the sender who caused it.
• Ask to move pools if it keeps happening.
• Read shared vs dedicated IPs before you decide to run your own.

If you send from Google Workspace or Microsoft 365 mailboxes, the IP belongs to Google or Microsoft. Check the bounce again: the code may be a different one from the table above, and the fix may be on your account rather than the IP.

While you wait

• Pause mail to Microsoft 365 recipients from the blocked IP. More attempts mean more bounces in your platform's stats.
• Do not rotate IPs to get around the block. Microsoft judges behaviour, and the new IP will follow the old one.
• Fix the list for when you resume. Verify unsent leads and suppress every hard bounce.
• Check the domain's settings for Outlook.com too, using the Microsoft sender requirements checker.

Staying off the list

• Verify before every campaign and re-verify anything older than about a month.
• Ramp new IPs and domains slowly and keep daily volume steady.
• Authenticate everything: SPF, DKIM and DMARC aligned with your From domain.
• Keep complaints low: tight targeting, fewer follow-ups, a clear opt-out.
• Watch Microsoft-bound bounces per campaign and stop a campaign that spikes.

If the bounce you see is from your own Microsoft 365 tenant being restricted, rather than your IP being blocked, read Microsoft 365 restricted sender instead.

Where SimpleVerifier fits

Verification cannot delist an IP. It removes one of the causes. SimpleVerifier runs a live mailbox check on each address and returns safe to send, send with care, check again later or do not send, with the reason. Microsoft 365 business domains are probed normally, and catch-alls stay risky, never valid, so your main campaign only goes to addresses a server confirmed.

The first 100 checks are free with a Google sign-in on the verify page. Pro is $39 a month with the first 100,000 checks a month at full speed, then slower, never cut off. See pricing.