What 550 5.7.606 means
Microsoft documents the whole range 5.7.606–5.7.649 as 'Access denied, banned sending IP [IP]': the IP you're sending from has been banned. The exact number within the range doesn't change what you need to do.
The ban is on the IP, not your domain or the recipient. If you send through a shared provider, other customers' traffic can get the IP banned.
What the bounce looks like
The wording providers document for this code. Your bounce may add an IP address, a session ID or a help link after it.
550 5.7.606 Access denied, banned sending IP [IP]Any code from 5.7.606 to 5.7.649 carries this text.
Why cold emailers see 550 5.7.606
- Spam complaints or spam-trap hits from mail sent through that IP.
- A compromised account or open relay on the server, sending spam you didn't write.
- A shared or recently reassigned IP with a bad history.
- Ramping volume to Microsoft domains too quickly from a new IP.
How to fix 550 5.7.606
- Stop sending to Microsoft domains from that IP.
- Fix the cause first: secure compromised accounts, close open relays, clean the list.
- Request delisting through Microsoft's delist portal (sender.office.com) with the IP from the bounce.
- If the IP belongs to your SMTP provider, send them the bounce; they need to delist or move you.
- After delisting, resume at low volume and ramp slowly.
Retry or suppress?
Don't suppress the recipients, but stop sending from that IP until it's delisted. Retries will keep failing.
Reading the code
The basic code 550 means "Mailbox unavailable or message refused (permanent)" under RFC 5321. In 5.7.606, the 5 is the class (permanent failure) and the 7 is the subject (security or policy). The detail number 606 isn't in the RFC 3463 / IANA registry; it's specific to the provider, so the text after the code carries the meaning.
- Class 5
- Permanent failure
- Resending the same message won't work. Something about the message, the recipient or the sender has to change first.
- Subject 7
- Security or policy
- A security or policy decision: spam filtering, authentication, blocklists, permissions.
- Detail 5.7.606
- Provider-specific
Check the rest of your setup
Paste the headers of a message that did get through into the email header analyzer to confirm SPF, DKIM and DMARC pass, and check your domain with the SPF, DKIM & DMARC checker. The deliverability checklist covers the rest of a healthy sending setup.
Got a different bounce? Paste it into the SMTP error code lookup to decode it.