Microsoft 365 / Outlook
Microsoft 365 550 5.1.8 — "Access denied, bad outbound sender"
550 5.1.8
Microsoft 365 blocked the sending account because it sent too much spam. Microsoft notes this usually happens because the account was compromised through phishing or malware and used to send spam. The account can still receive mail, but every message it tries to send outside the organization bounces with this code until an administrator releases it. Releasing the account before securing it will just get it blocked again.
How to fix it
- 1
Secure the account first
Reset the password, sign the user out of all sessions, and turn on multifactor authentication if it isn't already required. Check recent sign-ins for unfamiliar locations or apps.
- 2
Remove what the attacker left behind
Look for inbox rules that delete, hide or forward mail, mailbox forwarding to external addresses, and app permissions the user didn't grant. Attackers add these to keep access and hide replies to their spam. Also scan the user's devices for malware.
- 3
Release the account from Restricted entities
An admin removes the block in the Microsoft Defender portal under Email & collaboration → Review → Restricted entities. Only do this once the account is secure. Microsoft may limit how often an account can be released in a period.
- 4
Check your domain afterwards
Spam sent from your domain can hurt its reputation elsewhere. Run the blacklist checker on your domain and outbound IPs, and watch DMARC reports and bounce rates over the next few days.
Meaning current as of 2026-10-24, cross-checked against the provider's own documentation. Providers do occasionally redefine codes — if this doesn't match what you're seeing, the source link is the authoritative reference.