550 5.7.606: Microsoft banned sending IP
550 5.7.606Access denied, banned sending IPPermanent: retrying will not helpFrom Microsoft 365 and Outlook.com
550 5.7.606 Access denied, banned sending IP [203.0.113.60]
What it means
Codes 5.7.606 through 5.7.649 all mean the same thing: Exchange Online refused the connection because the sending IP is on Microsoft’s own block list. The NDR names the IP in brackets and normally points to the self service delist portal.
This list protects every Microsoft 365 tenant, so one listing blocks your mail to all of them at once. It is separate from the recipient’s own block list (5.7.513) and from Outlook.com consumer blocks, which show S3150 or S3140 codes.
The fix belongs to whoever controls the IP: your own mail server, your hosting company, or your ESP.
Likely causes
- Spam or phishing went out from the IP, often through a compromised account or website.
- The IP belongs to a hosting range with a poor overall record.
- You started sending large volumes from a fresh IP without warming it.
- High complaint or spam trap hit rates from a mailing list.
How to fix it
- Find and stop the source of bad mail before you ask for removal, otherwise the IP is listed again quickly.
- Go to sender.office.com, enter your email address and the IP from the NDR, confirm via the link Microsoft emails, and submit the delist request.
- Wait for the removal to take effect; it is usually within a day.
- Check public DNSBLs and fix reverse DNS, SPF, and DKIM so the IP looks like a legitimate mail server.
- If the portal refuses or the ban returns, open a support case with Microsoft and include the full NDR.
Checks that apply
- Blacklist Check Shows whether the same IP is listed elsewhere, which usually means there is still abuse to clean up.
- Reverse DNS (PTR) Confirms the IP has a sensible reverse DNS name, a basic signal Microsoft looks at.
- Microsoft Compliance Checks your domain against Microsoft sender requirements so mail is accepted once the IP is clear.
FAQ
- How long does a Microsoft delisting take?
- After you confirm the request at sender.office.com, removal often takes effect within a few hours and Microsoft says up to 24 hours.
- I’m on Microsoft 365 myself, why am I blocked?
- If you send through your own server or a third party, its IP is judged separately from Microsoft’s own outbound pool.