550 5.7.606 Access Denied, Banned Sending IP (Microsoft 365)

• Common causes of 550 5.7.606
• How to fix 550 5.7.606, step by step
• Prevention going forward
• Frequently asked questions about 550 5.7.606
• Continue reading

550 5.7.606 Access denied, banned sending IP [x.x.x.x]. To request removal from this list please visit https://sender.office.com/pm/troubleshooter

Common causes of 550 5.7.606

1. Cumulative reputation degradation crossed Microsoft threshold. Microsoft SNDS tracks per-IP reputation continuously with Green, Yellow, and Red status categories. Sustained Red status for weeks eventually triggers 5.7.606. Unlike Spamhaus which requires specific abuse triggers, Microsoft threshold is aggregate reputation over time — a slow degradation without dramatic events can produce 5.7.606 as your IP crosses the internal threshold. This is why monitoring SNDS daily during any period of change is critical for Microsoft-heavy sending programs.
2. Complaint rate spike hit Microsoft internal SNDS Red. Microsoft complaint threshold for continued delivery is roughly 0.1 percent (much stricter than the 0.3 percent many senders assume). A campaign that produces 0.5 percent complaints for a few days can push SNDS to Red and eventually trigger 5.7.606. Consumer campaigns to unenthused audiences and cold outreach to unverified lists are the largest single causes. Complaints accumulate faster than reputation recovers, so a single bad campaign can create weeks of aftermath.
3. Suspicious sending pattern flagged by anti-spam algorithms. Microsoft anti-spam algorithms flag patterns that resemble botnet or compromised infrastructure: bursts of thousands of messages in seconds, sending to many recipients in rapid succession, connections from unusual IP geolocation. Legitimate senders occasionally trigger these patterns during peak campaigns, especially if the campaign involves unwarmed infrastructure or shared IP pools with a bad neighbor generating the pattern.
4. Repeat compromise, exploit, or historical incident accumulation. IPs previously listed for spam or malware infection accumulate Microsoft-side reputation debt even after remediation. Each successive incident adds to the ban likelihood non-linearly. IPs with three or more historical incidents in a year rarely recover reputation with Microsoft even after individual incidents are resolved. This is why cold IP recovery (documented in our cold IP recovery playbook) sometimes requires IP migration rather than remediation of the compromised IP.
5. Sudden volume from a new or under-warmed IP. New IPs sending at production volume from day one look statistically identical to compromised legitimate infrastructure or botnet nodes. Microsoft algorithms do not distinguish "well-intentioned but ignorant of warmup" from actual abuse — both look identical in the metric signal. Skipping the 30/60/90 warmup schedule is one of the fastest paths to 5.7.606 for otherwise legitimate senders.

How to fix 550 5.7.606, step by step

1. Stop sending from the banned IP immediately. Do not attempt to send from the banned IP during the recovery window. Every send attempt creates additional evidence for the Microsoft mitigation reviewers and can extend the review timeline or convert it to a denial. Pause all bulk campaigns from that IP entirely. Route only critical transactional mail (password resets, billing) through alternative infrastructure while you work on mitigation. Continuing to send from the banned IP is the single most damaging action you can take.
2. Submit the Microsoft Sender Support mitigation form. Microsoft provides a mitigation request form at sender.office.com/pm. Complete it in exhaustive detail: describe what triggered the ban if you know, list every remediation action you have taken, provide evidence of the fixes (SNDS status improvement, complaint rate reduction, list validation records). Vague requests get denied by default. Well-documented, honest requests with clear remediation history get processed even for complex cases.
3. Attach concrete evidence of remediation to the request. Include screenshots and data: SNDS dashboard showing metric improvement, complaint rate metrics from Gmail Postmaster and Yahoo FBL showing reduction, list-cleaning records via SMTPing or another validator, DMARC aggregate reports showing authentication success, incident postmortems if applicable. Microsoft mitigation team responds to concrete evidence, not to assertions of good intent. The more specific your evidence, the faster the review.
4. Wait 2 to 8 weeks for mitigation review. Timeline varies significantly by case complexity. Simple mitigations (single incident, clear remediation, no history of prior bans) can resolve in 1 to 2 weeks. Complex cases (repeat incidents, ambiguous root cause, shared IP concerns, or history of prior bans) can take 6 to 8 weeks or longer. Rushing the process by resubmitting or escalating typically extends the timeline rather than accelerating it. Once submitted, wait for the response — do not follow up sooner than 2 weeks.
5. Rebuild reputation slowly after mitigation approval. When Microsoft approves your mitigation, do not immediately resume full volume. Ramp to 10 to 25 percent of previous volume for the first 1 to 2 weeks, monitored daily via SNDS. Scale up gradually over 4 to 6 weeks if metrics stay clean. Rushing back to full volume looks like continued risk to Microsoft algorithms and can trigger a second ban that is significantly harder to appeal. Post-mitigation is a fragile trust period, not a return to normal operations.
6. Consider IP migration if mitigation is denied. Microsoft occasionally denies mitigation requests when the underlying pattern suggests continued risk, especially for IPs with history of multiple bans. In that case, IP migration to a fresh dedicated IP with proper warmup is the durable answer. A new IP with 6 to 8 weeks of careful warmup will earn better reputation than a mitigation-denied legacy IP would ever recover. Continue investigating and fixing the root cause on your infrastructure so the new IP does not follow the same path.

Prevention going forward

Frequently asked questions about 550 5.7.606