550 5.7.606: Microsoft banned the sending IP
550 5.7.606 is a Microsoft code that says the sending IP address is banned. Microsoft uses the range from 5.7.606 to 5.7.649 for banned IPs. Check the IP first and follow the Microsoft delisting steps if the ban is wrong.
- Bounce type
- Hard bounce (permanent)
- Usually caused on
- Your sending side
- Terlido report label
- Blocked by the provider
What the standard says
RFC 5321 defines 550 as "mailbox unavailable", which includes refusals for policy reasons. Subject 7 in RFC 3463 covers security or policy. The detail numbers 606 to 649 are not defined in an RFC. They are Microsoft's own range for banned sending IPs.
What the mailbox providers say
- Microsoft 365 / Outlook (5.7.606-649): “Access denied, banned sending IP [IP1.IP2.IP3.IP4]” Source
Common causes
- The sending IP sent spam or unwanted mail before, and Microsoft banned it.
- A shared IP at a provider where another customer caused the ban.
- A new server whose IP address was previously used by a spammer.
- A compromised server that sent mail without the owner knowing.
- An IP range that a hosting provider reassigned to you after another customer used it for abuse.
- Spam sent from your own network by an infected device or a hijacked account, without your knowledge.
How to fix it
- Find out which IP the message came from. The IP is written in the bounce text.
- Check the IP on common blocklists and fix the cause, such as a compromised account or an open relay.
- Microsoft says to use its delist portal if the ban is in error.
- If you send through a provider with shared IPs, contact the provider and ask them to deal with Microsoft.
- Ask your provider whether the IP is shared or new to you, and consider asking for a different one.
- After removal, send at a low volume first and watch for new refusals before you return to normal volume.
- Check outgoing mail logs for volume you did not expect, which often shows a hijacked account or device.
- If you send through Google or Microsoft mailboxes, you do not control the IP, so tell your provider about the ban.
Is it a deliverability problem?
Yes. A banned IP stops all mail to Microsoft addresses until the ban is lifted. Fix the cause before you ask for removal. Otherwise the IP can be banned again. Bans on IP level do not care about your domain. Even perfect authentication will not help while the IP is banned, so the IP itself must be fixed or replaced.
How Terlido handles it
When a bounce message for this code arrives in a connected mailbox, Terlido reads the status code. An enhanced code that starts with 5 is a hard bounce. In the campaign Reports tab this one is grouped as "Blocked by the provider".
On a hard bounce Terlido adds the address to the workspace blocklist with the reason "hard bounce", so no campaign emails it again. The lead stops in that campaign as bounced, its lead score goes down by 15, and the bounce counts toward the campaign's bounce rate.
Once a campaign has at least 20 sends, it pauses itself when hard bounces divided by sends goes over the campaign's maximum bounce rate. The default is 5%. If the cause was on your side and you fixed it, you can remove the entry on the Blocklist page of your account settings and try again.
Terlido treats every 5.x.x code as a hard bounce, so it blocklists the recipient even when the real cause is your own sending setup. After you fix the sending side, remove the entry from the blocklist if you want to contact that person again.
Check the domain behind the bounce
The free domain checker runs live SPF, DKIM, DMARC, MX and blocklist lookups and explains each result in plain English.
Free tools that help
- Email blocklist checkerCheck a bounded set of named public blocklists.
- Reverse DNS checkerCheck PTR and forward matching for a public IP.
Related error codes
- 550 5.7.708: Microsoft does not accept traffic from this IP
- 554 5.7.1: Relay access denied or client host rejected
- 550 5.7.25: Sending IP has no reverse DNS record