550 5.7.708: Microsoft refuses traffic from this IP
550 5.7.708Access denied, traffic not accepted from this IPPermanent: retrying will not helpFrom Microsoft 365 and Outlook.com
550 5.7.708 Service unavailable. Access denied, traffic not accepted from this IP
What it means
With 5.7.708 Microsoft is refusing traffic from a specific IP that is sending through or into Exchange Online on behalf of a tenant. The wording typically reads "Access denied, traffic not accepted from this IP". It most often appears for organizations that relay on premises or third party mail through Microsoft 365 with an inbound connector.
Unlike 5.7.705, the decision centres on the IP, and unlike 5.7.606 the delist portal is not the documented way out. Microsoft’s pages describe it as a result of most traffic from that source being suspicious, and new tenants with little history meet it more often.
The tenant admin is responsible for the relay path and has to deal with Microsoft directly.
Likely causes
- An on premises server relays mail through an inbound connector and part of that mail looked like spam.
- A new tenant started relaying a large volume from a server IP Microsoft had no history for.
- A compromised device or app behind the relay IP sent junk.
How to fix it
- Confirm which IP was refused and which connector it uses in the Exchange admin center.
- Check that the relay only accepts mail from your own systems and requires authentication.
- Make sure every domain the relay sends as is an accepted domain in the tenant and has SPF including both Microsoft and the relay IP.
- Open a Microsoft support case and ask for the IP to be allowed again, describing the cleanup you did.
Checks that apply
- SPF Check Checks that your SPF covers the relay IP and `include:spf.protection.outlook.com`, so relayed mail authenticates.
- Blacklist Check Shows whether the relay IP has a public abuse history that matches Microsoft’s view.
- SMTP Diagnostics Tests your relay host from outside to confirm it is not an open relay.
FAQ
- How is 5.7.708 different from 5.7.705?
- 5.7.705 blocks the whole tenant; 5.7.708 refuses a particular IP’s traffic, often a relay feeding the tenant.
- Will waiting a day clear it?
- Do not rely on that. This code normally needs a Microsoft support case after the relay is cleaned up.