Fix Microsoft 365 Error 550 5.7.708: IP Blocked by EOP

The Error Message

When Microsoft 365 blocks your sending IP, the bounce message looks like this:

550 5.7.708 Service unavailable. Access denied, traffic not accepted from this IP.
For more information please go to http://go.microsoft.com/fwlink/?LinkId=526653

The 550 reply code is defined in RFC 5321, and the enhanced status code 5.7.708 follows the RFC 3463 format for mail system status codes (class 5.7.x — security/policy rejections).

This is a permanent rejection at the IP level. Microsoft's Exchange Online Protection (EOP) has determined that your IP address is not trustworthy, and every message you send to any Microsoft 365 recipient from this IP is rejected until the block is lifted.

Unlike SPF or DKIM failures (which are per-domain issues), the 5.7.708 error applies to your IP address itself. All domains sending from the blocked IP are affected.

The fix: identify and resolve the root cause (compromised account, spam, missing authentication), delist from public blacklists, then request delisting from Microsoft at sender.office.com.

What Exchange Online Protection Is

Exchange Online Protection (EOP) is Microsoft's cloud-based email filtering service. It processes all inbound email for Microsoft 365 mailboxes — including Outlook.com, Hotmail, Live, MSN, and every organization using Exchange Online for business email.

EOP maintains its own internal IP reputation system, separate from third-party blacklists like Spamhaus or Barracuda. An IP can be clean on every public blacklist and still be blocked by EOP, or listed on public blacklists but accepted by EOP. Microsoft uses a proprietary combination of signals including spam trap hits, complaint rates, sending patterns, and data from their SmartScreen and Defender ecosystems.

Because Microsoft 365 represents a massive share of global business email, being blocked by EOP is one of the most impactful deliverability problems you can encounter.

Why Your IP Was Blocked

Spam Sent From Your IP

The most common cause. If your mail server (or any machine sharing your IP) sent spam — whether intentionally or due to a compromised account — EOP's filters detected it. This includes:

• Compromised email accounts sending spam
• Malware on your network generating outbound spam
• A web application vulnerability exploited to send spam through your server
• A user sending bulk email without proper opt-in practices

Even a relatively small volume of spam triggers an EOP block if it hits Microsoft spam traps or generates a high complaint rate.

IP Listed on Third-Party Blacklists

While EOP maintains its own reputation system, it also references external blacklists. If your IP is listed on Spamhaus (SBL, XBL, or CBL), Barracuda BRBL, or other major lists, EOP blocks based on that listing even if the spam did not target Microsoft recipients. See How to Check If You're Blacklisted for the full delisting process.

Sudden Volume Spike

If your IP has little or no sending history with Microsoft and you suddenly send a large volume to Microsoft 365 recipients, EOP interprets this as a spam campaign and blocks the IP preemptively. This frequently happens when:

• Migrating to a new mail server or IP address
• Launching a marketing campaign to a list with many Microsoft recipients
• A new business starts sending from a fresh IP without warmup

Poor Sending Reputation

EOP tracks reputation metrics over time. Consistently high bounce rates, spam complaints, or sending to invalid addresses erodes your IP's reputation until it crosses the blocking threshold. The block may seem sudden, but the reputation damage accumulated gradually.

Compromised Server

If your server was compromised and used as an open relay, spam proxy, or botnet node, the volume of malicious traffic from your IP triggers an immediate block. This is often the case when the 5.7.708 error appears suddenly with no changes on your end.

How to Check Your IP Status

Step 1: Check Public Blacklists

Run the mxio Blacklist Check with your sending IP address. This checks your IP against dozens of public blacklists and shows which lists you appear on, if any. Being listed on public blacklists often correlates with EOP blocks, and you need to delist from those as well.

Step 2: Verify Your Sending IP

If you are not sure which IP is blocked, check the bounce message — it usually includes the connecting IP. You can also:

• Check your mail server logs for the SMTP session to Microsoft's MX servers
• Run an mxio MX Lookup on the recipient's domain to see which Microsoft servers you are connecting to
• Review the Received headers on recent successful deliveries to find your outbound IP

Step 3: Check Reverse DNS

Run a mxio PTR Lookup on your sending IP. Missing or misconfigured reverse DNS is a contributing factor to EOP blocks. Your IP should have a PTR record that:

• Resolves to a hostname under a domain you control
• The hostname resolves back to the same IP (forward-confirmed reverse DNS)
• Does not look like a generic residential or dynamic ISP address

Steps Before Requesting Delisting

Microsoft re-blocks your IP quickly if you delist without fixing the root cause. Before submitting a delisting request, complete these steps:

Fix the Root Cause

• Compromised accounts: Force password resets, enable MFA, review mail forwarding rules
• Malware: Scan all machines on the network, check for unauthorized outbound SMTP traffic
• Open relay: Verify your mail server only accepts authenticated submissions
• Bulk email issues: Ensure lists are opt-in, honor unsubscribes, remove invalid addresses

Delist From Other Blacklists First

If your IP is on Spamhaus, Barracuda, SpamCop, or other public lists, delist from those first. See How to Check If You're Blacklisted and Get Delisted for the process. EOP references these lists, so remaining on them undermines your Microsoft delisting request.

Verify PTR Records

Ensure your sending IP has a valid PTR record with forward-confirmed reverse DNS. This is a basic trust signal that EOP checks.

Verify SPF and DKIM

Confirm that your SPF record includes the blocked IP and that DKIM signing is active. Use the mxio SPF Checker to verify your SPF record is valid and includes the correct IP. Authentication failures compound reputation damage.

How to Request Delisting From Microsoft

The Microsoft Delist Portal

Microsoft provides a self-service delisting tool at sender.office.com.

1. Go to sender.office.com
2. Sign in with a Microsoft account (you may need to create one)
3. Enter the blocked IP address
4. Provide your contact information
5. Describe the steps you have taken to resolve the issue that caused the block
6. Submit the request

What to Include in Your Request

Be specific about what you have done to fix the problem:

• Describe the root cause you identified (compromised account, misconfiguration, etc.)
• List the remediation steps you took
• Mention if you have delisted from other blacklists
• Confirm that SPF, DKIM, and PTR records are correctly configured
• If applicable, note the volume and nature of legitimate email you send to Microsoft recipients

Expected Timeline

• Acknowledgment: Usually within a few hours
• Review: Microsoft's team typically processes requests within 24-48 hours
• Resolution: If approved, the block is lifted and email delivery resumes
• Rejection: If Microsoft determines the issue is not resolved, they deny the request with instructions on what else needs to be fixed

If your request is denied, address the specific feedback Microsoft provides and resubmit. Do not submit multiple requests simultaneously — this does not speed up the process.

After Delisting

Once the block is lifted:

• Monitor closely for the first week. Send a moderate volume and watch for new bounces. A second block after delisting results in a longer hold time.
• Check bounce rates. High bounce rates indicate you are sending to invalid or inactive addresses, which damages reputation.
• Review DMARC reports. If you have DMARC reporting enabled, check your aggregate reports for unauthorized sending from your IP.
• Set up ongoing monitoring. Do not wait for delivery failures to discover a new listing. Run the mxio Blacklist Check regularly, or set up domain health monitoring to get alerted when your IP appears on a blacklist — before it affects deliverability.

Prevention

IP Warmup

When deploying a new sending IP, warm it up gradually. Start with a small volume of email to engaged recipients and increase over 2-4 weeks. This builds positive reputation with EOP before you send at full volume.

Authentication Baseline

Maintain complete email authentication:

• SPF: Include all sending IPs, stay under the 10-lookup limit
• DKIM: Sign all outbound email with a 2048-bit key
• DMARC: Publish a policy (at minimum p=none with reporting) and work toward p=reject
• PTR: Valid reverse DNS on every sending IP

List Hygiene

• Remove addresses that hard-bounce immediately
• Suppress addresses that have been inactive for extended periods
• Never purchase email lists
• Use confirmed opt-in (double opt-in) for new subscribers

Security

• Enforce strong passwords and MFA on all email accounts
• Monitor outbound email volume for anomalies
• Keep all server software patched and up to date
• Restrict outbound SMTP to designated mail servers only

Related Issues

• How to Check If You're Blacklisted and Get Delisted — Comprehensive blacklist checking and delisting guide
• Fix Microsoft 365 Error 550 5.7.23: SPF Validation Failed — SPF failures specific to Microsoft
• Missing PTR Record — Reverse DNS setup and best practices
• Email Bounce Codes — Complete SMTP error code reference
• Emails Going to Spam — Broader deliverability troubleshooting