Company domain on Microsoft black list

Question

My company's domain has been blacklisted by Microsoft. How do I remove my company domain from the Microsoft blacklist?

Answer 1

To remove a company domain or sending IP from a Microsoft email blacklist, follow the supported delisting process based on the error/NDR being received.

1. Collect the Non-Delivery Report (NDR)
   • When messages to Microsoft 365 or Outlook.com recipients are rejected, an NDR is generated.
   • Identify the SMTP error code and text, for example:
     • 550 5.7.1 or
     • 550 5.7.511 Access denied, banned sender [xxx.xxx.xxx.xxx].
2. If seeing 550 5.7.511 Access denied, banned sender (or similar banned‑sender text)
   • Microsoft indicates the sending IP or source is on a blocked senders list.
   • As described in the NDR, send an email to delist@microsoft.com and include:
     • The full NDR text.
     • The blocked IP address and affected domain.
   • Microsoft will review and respond with next steps, typically within 48 hours.
   • For consumer Outlook.com senders, the delisting form is also available (see “More information” in the referenced article).
3. If seeing 550 5.7.1 in Exchange Online
   • For Exchange Online recipients, the admin can:
     • Forward the NDR to delist@microsoft.com to request removal of the restriction on the sender’s source email system.
     • Review and fix any domain configuration issues that may contribute to reputation problems:
       1. Confirm the domain is fully enrolled and healthy in Microsoft 365:
          • In the Microsoft 365 admin center, go to Settings > Domains and verify the domain shows as Healthy.
       2. Validate MX records:
          • Ensure the MX record for the domain is correct with the expected Microsoft 365 syntax (for domains hosted in Exchange Online): _ <domain> _.mail.protection.outlook.com or _ <domain> _.subdomain.mx.microsoft.
       3. Use Microsoft tools to check mail flow configuration:
          • Run the Advanced diagnostics > Exchange Online test in Microsoft Support and Recovery Assistant to detect MX or configuration issues.
          • Use Microsoft Remote Connectivity Analyzer to verify Inbound SMTP Email and Outbound SMTP Email for Office 365.
4. If the issue is with Microsoft Defender for Office 365 recipients
   • The same delisting and configuration checks apply, because Defender for Office 365 enforces policies on top of Exchange Online mail flow.
   • Ensure the sending domain has correct DNS (SPF, DKIM, DMARC if configured) and no misconfiguration in MX or routing that could affect reputation (checked via the tools above).
5. If the domain itself is blocklisted in a Microsoft advertising or security context (not mail flow)
   • For Microsoft advertising/anti‑malvertising blocklists, submit a request via the Microsoft Customer Support form:
     • Choose Anti-Malvertising as Request Type.
     • Provide:
       • Domain owner details, main business website, business address.
       • Direct contact for the domain owner.
       • Justification for why the domain should be removed from the blocklist.
   • Microsoft will contact the owner and determine whether the domain can be removed from the blocklist.
6. General best practices while waiting for delisting
   • Ensure the domain and IP are not sending spam or unwanted bulk mail.
   • Confirm outbound mail is authenticated and correctly routed.
   • Monitor further NDRs to verify when the block is lifted.

---

References:

• External senders - Use the delist portal to remove yourself from the blocked senders list and address 5.7.511 Access denied errors
• Fix NDR error "550 5.7.1" in Exchange Online
• Microsoft Invest - Sherlock: Creative quality control