550 5.7.606 — Access denied, banned sending IP (Microsoft 365)
Retrying will not help. The message will not be delivered.
The reply
550 5.7.606 Access denied, banned sending IP [IP].The Microsoft 365 side of an IP ban. Distinct from the consumer S3140 block and cleared through the same sender support form, but it affects every Microsoft 365 tenant at once, so it is the more expensive of the two to sit on.
What it means
Microsoft's Exchange Online Protection maintains its own IP reputation for the business side of the service. A ban here means no Microsoft 365 organisation receives your mail — which for business-to-business senders is most of the addressable world. The delisting route is the same form used for consumer Outlook.com, and the same caveat applies: delisting without fixing the cause buys a short reprieve.
Why it happens
- Spam complaints or spam-trap hits from mail sent through this IP.
- A new IP in a range Exchange Online Protection distrusts.
- A compromised account or script sending through your infrastructure.
- High volumes of mail to addresses that do not exist across many tenants.
- An open relay or a misconfigured server that let somebody else send through it.
What to do
- Find out what was actually sent from the IP before requesting delisting. A ban with an unfixed cause returns quickly.
- Submit the delisting request at sendersupport.olc.protection.outlook.com/pm/.
- Confirm reverse DNS, SPF, DKIM and DMARC are all correct before you ask.
- Audit for compromised accounts and make sure the server is not relaying for anybody else.
- Clean the list — unknown-recipient volume across tenants is a strong signal here.
- Enrol in SNDS and JMRP so the next reputation slide is visible before it becomes a ban.
Questions
How is this different from S3140?
S3140 is consumer Outlook.com; 5.7.606 is Exchange Online Protection, which serves Microsoft 365 organisations. Both go through the same form, but the business-side ban blocks far more of your recipients.