Microsoft sending-IP reputation block
Fix Outlook 550 5.7.511 banned sender IP
Microsoft uses 5.7.511 when the sending IP is banned. Stop the source of abusive traffic, secure the system, and then use Microsoft's current delisting route with the full NDR and IP.
The NDR reports:
550 5.7.511 Access denied, banned sender
The 550 response is permanent for each blocked attempt. Do not continue unchanged traffic.
Before delisting
- Stop compromised users, forms, APIs, and open relays.
- Inspect outbound queues and unusual recipients.
- Rotate credentials and revoke malicious tokens.
- Confirm list consent, bounce suppression, and complaint handling.
- Identify shared-IP responsibility with the provider.
Recovery sequence
- Record the full NDR and exact sending IP privately.
- Remove the root cause and drain malicious queues.
- Verify legitimate traffic meets Microsoft sender practices.
- Use Microsoft's current delist portal or documented support route.
- Resume gradually and monitor for recurrence.
Frequently asked questions
What does Microsoft 5.7.511 mean?
Microsoft banned the IP address used to send the message.
Should I request delisting immediately?
First stop the abusive or compromised traffic. Delisting without remediation can lead to another block.
Can changing SPF remove the IP ban?
No. Microsoft controls the block and its delisting process.
Related email diagnostics
Primary source: Microsoft Exchange Online NDR reference.