SMTP 550 5.1.8
bad outbound sender (Microsoft 365)
SMTP 550 5.1.8 means Microsoft 365 has blocked your own account from sending. The error reads "Access denied, bad outbound sender": the account went over sending limits or sent mail that looked like spam, which Microsoft says usually means it was compromised. It is not about the recipient.
Should you remove the address?
Keep the address; fix the sending side
Keep every address. Your account is blocked, not the recipients.
Block. Retrying changes nothing until the cause on your side is fixed.
How it appears
550 5.1.8 Access denied, bad outbound sender
Remote Server returned '550 5.1.8 Access denied, bad outbound sender'
What causes it
- The account was compromised and used to send spam.
- The account sent more mail than Exchange Online's sending limits allow, for example a bulk send from a normal mailbox.
- A script or app using the account's credentials sent a burst of mail.
How to fix it
In order — try the first one first.
- Secure the account first: reset the password, review sign-ins and remove any forwarding rules or apps you did not set up.
- An admin then releases the user from the Restricted entities page in Microsoft Defender. Microsoft says this usually takes effect within an hour.
- Send bulk or cold mail through a dedicated sending service, not a Microsoft 365 mailbox.
- Do not remove any recipients because of 5.1.8. Nothing is wrong with them.
Who sends it
Microsoft 365 and Exchange Online.
Microsoft 365
Reply text Access denied, bad outbound sender
Microsoft says the account was blocked for sending too much spam, typically because it was compromised.
Common questions
- What does SMTP 550 5.1.8 mean?
- SMTP 550 5.1.8 means Microsoft 365 has blocked your own account from sending. The error reads "Access denied, bad outbound sender": the account went over sending limits or sent mail that looked like spam, which Microsoft says usually means it was compromised. It is not about the recipient.
- Should I retry a 550 5.1.8 error?
- No. 550 is a permanent failure, so the message will never be delivered no matter how many times you try. Remove the address — repeated sends to permanent failures are one of the main signals mailbox providers use to throttle a sender.
- How do I fix SMTP 550 5.1.8?
- Secure the account first: reset the password, review sign-ins and remove any forwarding rules or apps you did not set up.
- Is 550 5.1.8 a hard bounce or a soft bounce?
- 550 5.1.8 is a block rather than a classic hard or soft bounce. The rejection is about your sending (authentication, reputation, content or the recipient's policy), not about whether the address exists. Retrying changes nothing until the cause on your side is fixed.
- Should I remove the address after a 550 5.1.8 bounce?
- Keep every address. Your account is blocked, not the recipients.
- Will verifying my list prevent 550 5.1.8?
- Not for this block. If bulk sending from the mailbox led here, verifying before future sends keeps bounces from adding to the problem.
Clean the list before the next send.
A bounce report only tells you about the addresses you already mailed. The rest of the list has the same kinds of dead mailboxes in it, and each one becomes a hard bounce recorded against your domain the moment you send.
- A real SMTP mailbox check on every row, before anything is sent
- Dead and mistyped addresses split out, so they never reach your sending tool
- Catch-all, disposable and role addresses flagged alongside
Plans from $9 a month, cancel anytime, no contract. Sign in with Google and your first 100 email checks are free, no card. The free tools stay free either way.
More Microsoft replies: every Outlook and Microsoft 365 SMTP error, and the 550 5.7.515 bulk sender rules.
Other 550 replies
- 550 5.1.1 — mailbox does not exist
- 550 5.7.1 — message refused by policy
- 550 5.4.1 — recipient address rejected, access denied
- 550 5.2.1 — mailbox disabled, not accepting messages
- 550 — mailbox unavailable
- 550 5.1.0 — address rejected, other address status
- 550 5.1.10 — recipient not found (Microsoft 365)
- 550 5.4.5 — daily sending limit exceeded (Gmail)
- 550 4.4.7 — message expired in the queue
- 550 5.7.25 — no PTR record for sending IP (Gmail)
- 550 5.7.26 — blocked, sender unauthenticated (Gmail)
- 550 5.7.27 — SPF authentication failed (Gmail)
- 550 5.7.28 — unusual rate of unsolicited mail (Gmail)
- 550 5.7.23 — SPF violation (Microsoft 365)
- 550 5.7.124 — sender not in allowed senders list (Microsoft 365)
- 550 5.7.509 — DMARC failed, policy reject (Microsoft 365)
- 550 5.7.606-649 — banned sending IP (Microsoft)
- 550 5.7.705 — tenant has exceeded threshold (Microsoft 365)
- 550 5.7.708 — traffic not accepted from this IP (Microsoft 365)
- 550 5.7.750 — blocked from sending from unregistered domains (Microsoft 365)
- 550 5.7.515 — authentication required for high-volume senders (Outlook.com)
- 550 5.7.1 S3140 — IP range on Outlook.com block list
- 550 5.5.0 — Mailbox unavailable (Outlook.com, Hotmail)
- 550 5.7.12 — Sender not authenticated by organization (Microsoft 365)
- 550 5.7.513 — Blocked by the recipient's own block list (Microsoft 365)
Sources
- Source: Microsoft Learn: Email non-delivery reports and SMTP errors in Exchange Online
- Source: RFC 3463: Enhanced Mail System Status Codes
Provider wording is quoted only where the provider publishes it.
Last reviewed 2026-10-22