550 5.1.8 is a permanent SMTP reply meaning access denied, bad outbound sender (microsoft 365). Microsoft says this typically happens because the account was compromised by phishing or malware and then used to send spam. The block is on your own account, so every message from it bounces.
What 550 5.1.8 means
Microsoft says this typically happens because the account was compromised by phishing or malware and then used to send spam. The block is on your own account, so every message from it bounces.
Common causes
The mailbox was compromised
Most commonA stolen password or token let someone send spam from the account.
A script or app sent bulk mail through the account
CommonBulk or cold email sent through a normal Microsoft 365 mailbox looks like spam to Microsoft.
A mail rule forwarded large volumes
Less commonAn inbox rule set up by an attacker forwarded or sent mail automatically.
How to fix 550 5.1.8
- 1
Secure the account first
Reset the password, sign out all sessions, turn on MFA, and remove unknown inbox rules, forwarding and app consents.
- 2
Remove the account from Restricted entities
In the Microsoft Defender portal, an admin can release the user from the restricted users list after the account is secure.
- 3
Send bulk mail from a proper service
Use a sending service and separate domains for campaigns, not a normal Microsoft 365 mailbox.
Confirm your domain is set up correctly
Most delivery failures — permanent or temporary — trace back to authentication or reputation. Run a free EmailHealth check to confirm SPF, DKIM, DMARC, blacklist status, and TLS are all healthy for your sending domain. If you send in volume, free daily monitoring will alert you before a small issue becomes a flood of bounces.