550 5.7.708 "Access denied, traffic not accepted from this IP" — Decoded
5.7.708 is the Microsoft 365 / Exchange Online cousin of S3140 — but the cause is often a shared sending pool, not your domain. Here's how to diagnose and fix it.
If you're seeing this bounce from a Microsoft 365 recipient, it's a different beast from the classic Outlook.com S3140:
550 5.7.708 Service unavailable. Access denied, traffic not accepted from this IP.
For more information please go to http://go.microsoft.com/fwlink/?LinkID=526654
5.7.708 is issued by Exchange Online Protection (EOP) — the filter sitting in front of every Microsoft 365 tenant. It's an IP-level reject, but the reputation signal is calculated separately from Outlook.com's SNDS data.
What Triggers 5.7.708
EOP throws 5.7.708 when the sending IP is on its own internal reputation block list. Common causes:
- Shared sending pool with a bad neighbor. Your ESP put you on an IP that another customer abused. This is the #1 cause for senders on shared infrastructure.
- Sudden volume spike from a previously low-volume IP.
- Authentication consistently failing — SPF / DKIM mismatches at scale.
- Listing on a major DNSBL Microsoft consumes (Spamhaus SBL/PBL).
- Confirmed spam reports from Microsoft 365 admins (the "Report message" add-in).
Unlike S3140, there is no public delisting form for 5.7.708. The remediation path is different.
How to Confirm It's a Real Block (Not Throttling)
Microsoft 365 sometimes returns 4.7.500 / 4.7.501 (temporary defer) that looks similar but is recoverable. 5.7.708 is permanent — your retry queue will not clear it.
Check:
- Bounce class —
550permanent vs421/450temporary. - Volume scope — is every Microsoft 365 recipient bouncing, or just one tenant? If just one, it's a tenant-level block, not an IP block.
- Other providers — are Gmail, Yahoo, etc. still accepting? If yes, the issue is Microsoft-specific (which 5.7.708 always is).
Step 1: Open a Delisting Request via the Microsoft Portal
There's no automated form. You open a support case through:
- For senders on your own infrastructure: contact the Microsoft 365 admin of an affected recipient tenant and ask them to file an internal escalation. They have a different channel than public senders.
- For ESP-hosted senders: your ESP must file the case. Contact their deliverability team and provide the bounce string verbatim plus a sample message header.
In both cases the request asks for:
- The blocked IP(s).
- A description of sending practices.
- Authentication setup (SPF/DKIM/DMARC).
- Volume and recipient acquisition method.
Resolution time: 3–7 business days is typical.
Step 2: Fix the Underlying Reason
While the case is open:
- Run Domain Health on every sending domain. SPF, DKIM, DMARC all green and aligned.
- Verify the IP isn't on Spamhaus or other DNSBLs with Blacklist Checker. If it is, delist there first — 5.7.708 often clears automatically once upstream listings drop.
- If you're on a shared pool, ask your ESP for the IP's reputation history. If it's been hot for weeks, request a different pool or move to a dedicated IP.
- Throttle aggressive volume. Microsoft 365 throttling looks like 4.7.500 first and escalates to 5.7.708 if you keep pushing.
Step 3: After Unblock
Resume sending slowly. EOP re-evaluates reputation on a rolling window. Hitting your previous volume on day one of unblock is the fastest way to a second block.
Recommended ramp:
| Day | % of normal volume |
|---|---|
| 1–2 | 10% |
| 3–4 | 25% |
| 5–7 | 50% |
| 8–10 | 75% |
| 11+ | 100% |
5.7.708 vs S3140 — Quick Reference
| Symptom | 5.7.708 | S3140 |
|---|---|---|
| Filter | EOP (Microsoft 365) | Outlook.com filter |
| Recipients affected | M365 tenants | Outlook.com / Hotmail / Live |
| Public delisting form? | No | Yes (sender.office.com) |
| Path to fix | Support case via tenant or ESP | sender.office.com form |
| Typical resolution | 3–7 business days | 24–48 hours |
FAQ
Can a single sender be blocked by EOP but not Outlook.com? Yes — the two systems share signals but score independently. It's common to be S3140-clean but 5.7.708-blocked, especially on a shared IP pool.
Will switching IPs fix 5.7.708? Yes, immediately, if the new IP has a clean EOP reputation. But unless you fix the underlying cause, the new IP will earn 5.7.708 within weeks.
Does DMARC enforcement help?
Substantially. EOP weights DMARC-aligned mail much more favourably than p=none. If you're on p=none, move to p=quarantine with the DMARC Generator.