550 5.7.508: Microsoft IPv6 range over its limit
550 5.7.508Access denied, IPv6 range exceeded permitted limitsPermanent: retrying will not helpFrom Microsoft 365 and Outlook.com
550 5.7.508 Access denied, [2001:db8::25] has exceeded permitted limits within /64 range
What it means
Microsoft accepts IPv6 mail but watches the whole range, not just the single address, because an IPv6 sender can rotate through millions of addresses in one /64. When a range sends too many messages in too short a window, Exchange Online refuses with 5.7.508, and the text typically names the address and the range size it counted.
This is specific to IPv6. Over IPv4 the comparable throttle is a 4.7.5xx "Server busy" deferral or 4.7.650 reputation limiting. The 5.7.508 form is a hard reject for that message, so the sending server will not retry it.
The sender has to change behaviour; the recipient’s admin has no switch to exempt one IPv6 range from Microsoft’s volume limits.
Likely causes
- A new IPv6 range with no sending history is pushing a large campaign without warm up.
- Your MTA spreads outbound mail across many IPv6 addresses in one prefix, which Microsoft adds together.
- Other customers on the same provider /64 are also sending and you share their total.
- A compromised host on your network is sending spam over IPv6.
How to fix it
- Lower the rate and the number of concurrent connections your MTA opens to Microsoft hosts.
- Send from one stable IPv6 address per server with matching reverse DNS, instead of rotating addresses.
- If IPv6 reputation is new or weak, prefer IPv4 for Microsoft destinations until it builds up (in Postfix, `smtp_address_preference = ipv4`).
- Make sure SPF covers the IPv6 range, for example `v=spf1 ip6:2001:db8:25::/48 -all`, and that DKIM signs every message.
- Resend the rejected messages slowly once the volume drops.
Checks that apply
- Reverse DNS (PTR) Checks that your IPv6 sending address has a PTR record, which Microsoft expects of any IPv6 sender.
- SPF Check Confirms the SPF record includes your IPv6 prefix so the mail authenticates while you rebuild reputation.
- AAAA Record Verifies the AAAA record for your mail host so forward and reverse DNS agree.
FAQ
- Why does Microsoft count a whole /64 instead of my one address?
- Any host can pick from billions of addresses in a /64, so per address limits would be useless. Grouping by range stops senders from dodging limits by rotation.
- Should I just turn off IPv6 for outbound mail?
- For Microsoft destinations that is a common and acceptable workaround, as long as your IPv4 setup has good reverse DNS and SPF.