Microsoft 365 5.1.8
Access denied, bad outbound sender
Microsoft 365 5.1.8 means: access denied, bad outbound sender. It is a permanent failure, so do not retry it unchanged. Stop sending from the affected account or IP until the cause is fixed. Check for a compromised account, and remove unverified and unengaged addresses before you resume.
Microsoft 365’s exact wording
Quoted from Microsoft Learn: Email non-delivery reports and SMTP errors in Exchange Online, checked 2026-11-05. Placeholders are Microsoft 365’s own.
Provider's description
Access denied, bad outbound sender
Possible cause
The account was blocked for sending too much spam. Typically, this problem occurs because the account was compromised (hacked) by phishing or malware.
| Who sends it | Microsoft 365, Exchange Online and Outlook.com |
|---|---|
| Basic code | Microsoft 365 lists the enhanced code only |
| Enhanced code | 5.1.8: Bad sender's system address |
| Permanent or temporary | Permanent (5xx) |
| Verifying the list prevents it | Partly |
In practice
550 5.1.8 Access denied, bad outbound sender means Microsoft blocked the sending account for sending too much spam, usually because it was compromised through phishing or malware. Reset the password, check for forwarding rules and app access added by an attacker, and then ask an administrator to remove the account from the restricted users list. Microsoft adds accounts that send spam to a restricted users list. Until an administrator removes the account, it can receive mail but cannot send. Also check the account's sign-in logs and remove any inbox rules or app passwords an attacker may have created.
What the sender should do
Stop sending from the affected account or IP until the cause is fixed. Check for a compromised account, and remove unverified and unengaged addresses before you resume.
Would verifying the list have prevented Microsoft 365 5.1.8?
Partly
The reply is not only about one address, but providers weigh how often a sender hits addresses that do not exist. Removing bad addresses before sending lowers that signal.
Common questions
- What does Microsoft 365 5.1.8 mean?
- Microsoft 365 5.1.8 means: access denied, bad outbound sender. It is a permanent failure, so do not retry it unchanged. Stop sending from the affected account or IP until the cause is fixed. Check for a compromised account, and remove unverified and unengaged addresses before you resume.
- Should I retry after Microsoft 365 5.1.8?
- No. It is a permanent (5xx) failure, so the same message to the same address will fail again. Fix the cause first. Stop sending from the affected account or IP until the cause is fixed. Check for a compromised account, and remove unverified and unengaged addresses before you resume.
- Would verifying my list have prevented Microsoft 365 5.1.8?
- Partly. The reply is not only about one address, but providers weigh how often a sender hits addresses that do not exist. Removing bad addresses before sending lowers that signal.
Sources
- Microsoft Learn: Email non-delivery reports and SMTP errors in Exchange Online (checked 2026-11-05)
- IANA: SMTP Enhanced Status Codes registry (checked 2026-11-05)
Registry and provider wording is quoted exactly; guidance is written by the SimpleVerifier Team.
SimpleVerifier Team · Last checked against the sources 2026-11-05