MailFixIt

Outlook SMTP delivery response

Resolve Outlook 550 5.7.606–649: Sending IP banned

Microsoft is refusing mail from the connecting IP because that IP is on its sending block list.

Problem description

A representative response is:

550 5.7.606 Access denied, banned sending IP [IP].
Is this temporary or permanent?

Do not keep retrying at normal volume. Correct the cause and use the documented Microsoft delisting process.

What this response means

Microsoft documents 5.7.606–649 Access denied, banned sending IP for an IP on its sending block list. The affected IP is the one Microsoft saw connecting, which may belong to your server, relay, or email provider.

Fix it

  1. Copy the blocked IP and complete diagnostic code from the NDR; do not assume it is your website address.
  2. Identify who controls that outbound IP. If it is shared, open a case with the email provider.
  3. Stop compromised accounts, open relay behavior, unsolicited traffic, and invalid-recipient retries.
  4. Verify a stable HELO name, forward-confirmed reverse DNS, and passing SPF, DKIM, and DMARC where applicable.
  5. After correcting the cause, use Microsoft’s current self-service delisting portal or provider support process and submit the full evidence.
  6. Resume slowly and monitor new NDRs; a delisting request without remediation can fail or be reversed.

What MailFixIt can check

MailFixIt can inspect public authentication and DNS identity, but it cannot measure Microsoft reputation or delist an IP.

Use the sender-requirements guide to verify the configuration before requesting delisting.

Frequently asked questions

What does Outlook 550 5.7.606–649 sending IP banned mean?

Microsoft banned the connecting sending IP. The IP owner must correct compromise or poor sending practice before requesting removal.

Can MailFixIt prove this entire bounce from public DNS?

No. The current checker can evaluate selected public DNS configuration, but it cannot recreate recipient state, credentials, reputation, message content, or a historical provider SMTP decision.

Related email diagnostics

Outlook 550 5.7.515: Access denied, sending domain does not meet the required authentication levelDiagnose Outlook 550 5.7.515 email rejection safely. Check SPF, DKIM and DMARC DNS, interpret the receiver report, and identify the next configuration step. Outlook.com requirements for high-volume sendersCheck Outlook.com high-volume sender requirements for SPF, DKIM and DMARC alignment, then review sending-IP PTR as separate infrastructure evidence.

Primary sources: Microsoft 365 non-delivery reports.