Fixing "550 5.7.606 Access denied, banned sending IP" from Microsoft

Microsoft 365 and Outlook.com return 550 5.7.606 (and the related 5.7.607/5.7.608) when the IP you are sending from is on their block list. Unlike the 5.7.515 authentication error, this is a reputation decision about the connecting IP — no DNS record change alone will clear it.

What it means

Microsoft has decided the sending IP is untrustworthy. It usually follows spam complaints, mail to spam-traps, a compromised account sending through your server, or a shared/hosting IP that a neighbour tainted. The three codes differ only in nuance; the remedy is the same: fix the cause, then request delisting.

Why it happens

The most common trigger is a compromised mailbox or web form quietly sending spam from your IP, followed by a sudden volume spike from a cold IP. Missing reverse DNS and unauthenticated mail make Microsoft quicker to distrust the source.

Diagnose it

Start with the blocklist check on the exact IP in the bracket — it tells you whether public lists (Spamhaus, Barracuda) also list you, which usually explains the Microsoft block too. Then confirm the IP has valid reverse DNS with the PTR tool.

Fix it

1. Stop the source: secure any compromised account, lock down open web forms, and confirm your outbound volume is normal.

2. Clear any public listings (see the Spamhaus guide) and set correct rDNS + SPF/DKIM/DMARC.

3. Enroll the IP in Microsoft SNDS and JMRP, then submit the delisting/mitigation request at the URL in the bounce.

4. Do not re-request repeatedly — fix the cause first, or the IP simply re-lists.