550 5.7.1 Service unavailable, Client host blocked using Spamhaus (S3140, S3150)
Microsoft refused the connection because the sending IP is on a blocklist. Outlook.com replies with an S31xx code in brackets: S3140 and S3150 mean the IP is on Microsoft's own list, S3130 that it is on Spamhaus. The wording "Unfortunately, messages from [ip] weren't sent. Please contact your Internet service provider since part of their network is on our block list" is the consumer Outlook.com version of the same thing.
What the server replies
550 5.7.1 Service unavailable; Client host [203.0.113.10] blocked using Spamhaus. To request removal from this list see https://www.spamhaus.org/query/ip/203.0.113.10 (AS3130). [AM0PR06CA0012.eurprd06.prod.outlook.com]
- Sent by
- Outlook.com and Microsoft 365
- Type
- PermanentRetry fails
- About
- Reputation and blocklists
- Enhanced code
- 5.7.1
Who sends it
Exchange Online Protection (for Microsoft 365 tenants) and Outlook.com inbound servers, at connection or MAIL FROM, before any content is read. The AM0PR, DB8PR, SN1PR style hostname at the end identifies the receiving server.
Why it happens
- The IP is listed on Spamhaus ZEN (SBL, XBL or PBL) because of spam from it, a malware infection, or because it sits in a residential range that should not send mail directly.
- The IP is on Microsoft's internal blocklist after Outlook.com users reported mail from it.
- A neighbouring IP in the same /24 was sending spam and Microsoft blocked the range.
- The IP was recently assigned to you and carries its previous owner's reputation.
How to fix it
Look the IP up
Check the IP at check.spamhaus.org. A PBL listing means the range is marked as not meant to send mail; relay through your ISP or a provider instead. An SBL or XBL listing names a reason you have to fix before removal.
Stop the cause before delisting
If a host on your network is infected or an account is compromised, delisting without fixing it gets you re-listed within days. Rotate the credentials, patch the host, confirm the outbound queue is clean.
Request removal
Spamhaus listings are removed through their lookup page once the problem is gone. For S3140 and S3150, use Microsoft's sender support form; replies normally arrive within one to two business days.
Ask for a PTR and authenticate
Microsoft weighs reverse DNS, SPF and DKIM when deciding how much to trust a newly delisted IP. Have all three in place before the retry.
Check it yourself
These free tools show the records and connections behind this code for your own domain or server.
Related codes
- 550 5.7.606 Access denied, banned sending IPThe sending IP is on Microsoft's blocklist for Microsoft 365 recipients.
- 550 5.7.708 Service unavailable, access denied, traffic not accepted from this IPMicrosoft is declining all traffic from the sending IP, a softer cousin of the 5.7.606 ban.
- 554 5.7.1 Service unavailable; Client host blocked using zen.spamhaus.orgThe receiving server checked your IP against a DNS blocklist and found it listed.
- 553 5.7.1 [BL21] Connections will not be accepted from IP because the IP is in Spamhaus's listYahoo refused the connection because the sending IP is on a Spamhaus list.
Sources
Fewer bounces to look up.
Faivelo sends from authenticated, warmed infrastructure, turns permanent bounces into one clean event for your application and keeps the address out of future sends.
Free tier included. No card needed.
Questions people ask
Other free tools
All tools- Email DNS checkerCheck MX, SPF, DKIM, DMARC and reverse DNS for any domain and get the exact records to add or fix.
- DMARC checkerLook up a domain's DMARC record, read every tag in plain words and see what to tighten next.
- DMARC record generatorBuild a valid DMARC record from a few choices and copy the host and value into your DNS.
- DMARC report analyzerDrop in a DMARC aggregate report and see who is sending as your domain and whether they pass.
- SMTP connection testerConnect to any SMTP server, check TLS and the login step, and see each stage with its timing.
- Email header analyzerPaste raw headers to see every hop, where the delay was, and whether SPF, DKIM and DMARC passed.
- Email address validatorCheck whether an address is well formed, whether its domain accepts mail, and whether it is disposable or a role account.