Removing a user, domain, or IP address from a block list after sending spam email

If a user continuously sends email messages from Office 365 that is classified as spam, they will be blocked from sending any more messages. The user will be listed in the service as a bad outbound sender and will receive a Non-Delivery Report (NDR) that states:

  • Your message couldn't be delivered because you weren't recognized as a valid sender. The most common reason for this is that your email address is suspected of sending spam and it's no longer allowed to send messages outside of your organization. Contact your email admin for assistance. Remote Server returned '550 5.1.8 Access denied, bad outbound sender'

You can configure your outbound spam policy settings so that you get a notification when an Office 365 user is blocked from sending email. After the problem with the user's mailbox is resolved, you can remove the block on that sender.

Unblock a blocked Office 365 email account

You complete this task in the Office 365 Security & Compliance Center (SCC). Go to the Office 365 Security & Compliance Center for more details about SCC.

  1. Using a work or school account that has Office 365 global administrator privileges, sign into the Office 365 Security and Compliance Center and in the list on the left, expand Threat Management, choose Review, and then choose Restricted Users.

    Tip

    To go directly to the Restricted Users page (formerly known as the Action Center) in the Security & Compliance Center, use this URL: > https://protection.office.com/?hash=/restrictedusers

  2. This page will contain the list of users that have been blocked from sending mail to outside of your organization. Find the user you wish to remove restrictions on and then click on Unblock.

  3. Click Yes to confirm the change.

Note

There's a limit to the number of times that an account can be unblocked by the tenant admin. If the limit for a user has been exceeded, an error message appears. You will then need to contact Support to unblock the user.

Third-party block lists

Exchange Online Protection also uses third-party block lists to help make decisions in spam filtering. Users, websites, domains, and IP addresses can be added to block lists just for appearing in a spam message. As the Office 365 admin, you should try to get these objects removed from the third-party list providers if they belong to you.

Note

If someone outside Office 365 cannot send messages to your Office 365 account, their account may be on the external blocked senders list. Users outside Office 365 can try to remove themselves by using the self-service delisting portal.

For more information

Responding to a compromised email account

Configure the outbound spam policy

High-risk delivery pool for outbound messages