550 5.7.705 vs 5.7.708: tenant ban or low-reputation IP?
Exchange Online 5.7.705 means your tenant sent too much spam or bulk mail and is blocked. 5.7.708 means the sending IP has a low reputation. Both need an admin.
On this page(8 sections)
If your Microsoft 365 users get 5.7.705 Access denied, tenant has exceeded threshold or 5.7.708 Access denied, traffic not accepted from this IP, Exchange Online is blocking your outbound mail before it leaves. The two codes look alike but have different causes: 705 is about what your tenant has been sending, and 708 is about the reputation of the IP address the mail goes out from.
Neither one is fixed from an Outlook client or by editing your DNS. This guide explains what Microsoft says each code means, how to tell them apart in a bounce, and what to check before you contact support.
What do 5.7.705 and 5.7.708 mean?
Both are permanent 550 rejections generated by Exchange Online on the sending side. Microsoft documents them together on its page for NDR error codes 550 5.7.703, 5.7.705, 5.7.708, and 5.7.750.
| Code | Text in the bounce | Microsoft's stated cause |
|---|---|---|
| 5.7.705 | Access denied, tenant has exceeded threshold |
The organization sends too much spam or bulk mail, so Exchange Online blocks outgoing mail |
| 5.7.708 | Access denied, traffic not accepted from this IP |
The message was sent from an IP address with a low reputation |
Microsoft adds that 708 is more likely to hit new customers, such as those on a Microsoft 365 trial subscription. A tenant is your organization's own Microsoft 365 account, so a 705 block applies to every sender in it, not just one mailbox.
Is it a tenant ban or an IP block?
Read the text after the code, then check who is sending. The wording alone usually decides it.
tenant has exceeded thresholdis 705. Something in your tenant produced a spike of spam or bulk mail.traffic not accepted from this IPis 708. The IP, not your volume, is the problem.- If many unrelated users fail at once and nothing about your sending changed, suspect 705 or a tenant-wide cause.
- If you are on a trial or a freshly created tenant and nothing has been sent yet at volume, suspect 708.
Note that people often paste these codes next to the ones Microsoft uses when your mail is rejected by a recipient at Outlook.com. This page covers the Exchange Online outbound codes only. For DMARC-related rejections at Microsoft, see 550 5.7.509 vs 5.7.515.
Why does a tenant get a 5.7.705 block?
Microsoft names two common ways spam or bulk mail passes through an organization and trips the threshold:
- A compromised on-premises server that routes mail to Exchange Online.
- A compromised admin account that was used to create connectors.
It also notes a rarer case: if you renew an expired Exchange Online subscription, you might be blocked from sending while the renewal processes, typically for no longer than one day.
In practice a block like this is a symptom. Something sent mail you did not intend to send, so finding that source matters more than getting the block lifted, because lifting it without a fix invites the next block.
What should an admin check first?
Work through this list before you open a support request. It follows Microsoft's guidance on compromise and connectors.
- Look for connectors you did not create. Attackers sometimes add inbound connectors to send spam, and Microsoft's page on validating connectors shows how to review them.
- Check for a compromised account: unexpected sign-ins, forwarding rules, or a sent folder full of mail nobody wrote. Follow Microsoft's steps for responding to a compromised email account.
- Turn on multifactor authentication for every account, starting with admins.
- Review any on-premises server or application that relays through Exchange Online, and confirm it is not an open relay.
- Look at the outbound spam policy and message trace for the time the block started, so you can say what was sent.
Only when that is done, contact Microsoft Support to have the block removed. Microsoft's page says to do it after you address the underlying cause, and support is the route it names for 705.
What can you do about a 5.7.708?
For a trial tenant, Microsoft's instruction is specific: an admin should contact Microsoft Support and request an IP address exception until you assign Exchange Online licenses. That is the documented fix for the trial case.
For a tenant that is not on a trial, Microsoft's page does not list a separate self-service step. Treat the IP reputation as the thing to check, since 708 is defined by it:
- If you send through Exchange Online directly, the IPs are Microsoft's, so you cannot change them. Raise it with support and describe what you send.
- If a third-party service or your own server relays mail into Exchange Online, check where that mail originates and whether that source is listed. Our guides to domain versus IP reputation and the blocklist delisting playbook cover how to look and what to ask for.
How do 705 and 708 differ from 5.7.750?
5.7.750 (Client blocked from sending from unregistered domain) is a third code on the same Microsoft page, and it points to a domain problem rather than reputation. Microsoft says it is typically generated when a large volume of mail is sent from a domain that is not an accepted domain, and the most common fix is to add and validate every domain you send from in Microsoft 365. A less common cause is incorrectly configured connectors.
Quick comparison:
| 5.7.705 | 5.7.708 | 5.7.750 | |
|---|---|---|---|
| What is blocked | Tenant outbound mail | Mail from a low-reputation IP | Mail from an unregistered domain |
| First thing to check | Compromised accounts, connectors, relays | Trial status, source IP | Accepted domains list |
| Who fixes it | Tenant admin, then support | Tenant admin, via support | Tenant admin |
How do you avoid a repeat?
The blocks respond to behavior, so prevention is mostly hygiene:
- Keep sending domains validated and authenticated with SPF, DKIM and DMARC, so mail is attributable to you.
- Do not let applications send marketing or high-volume mail through ordinary user mailboxes. Use a service built for it. Microsoft's high-volume sender rules for Outlook.com are a useful baseline either way.
- Alert on unusual outbound volume from any one account, and review connectors on a schedule.
- Keep a documented way to disable a compromised account quickly.
If you move transactional or bulk mail off Microsoft 365, Koltrix's API and SMTP relay run on verified custom domains with SPF, DKIM and DMARC records, so the mail does not depend on your Microsoft tenant's reputation. That does not remove the need to fix whatever caused the block.
Bottom line
5.7.705 means your tenant looked like a spam source, and 5.7.708 means the sending IP has a low reputation, often on a new or trial tenant. Both are admin problems that you cannot solve from a client. Find and close the cause first (compromised accounts, rogue connectors, open relays), then contact Microsoft Support to lift the block, or request an IP exception if you are on a trial. If the bounce also mentions an unregistered domain, that is 5.7.750 and the fix is to validate the domain.
Start with Koltrix
Your domain, one inbox, and an API that sends.
A team inbox where AI sorts and drafts (nothing is sent without your click), plus the transactional API and SMTP relay your product sends with. 7 days free, no card.
