4.7.850–899: temporary restriction on the sending IP

What it means

Microsoft documents codes from 4.7.850 to 4.7.899 for a temporary restriction placed on the connecting IP address after suspicious activity was seen from it. Like the 4.7.500 range, it is a deferral: the message stays in the sender's queue and is retried. Microsoft says that if the activity is valid the restriction is lifted shortly. Where the 4.7.500 to 4.7.699 range is described in terms of sending patterns, this range is described in terms of the IP itself, so check what else uses that address.

Common causes

• The IP address sent traffic that Microsoft judged suspicious, such as a sudden burst or a spam-like pattern.
• Another sender on the same shared IP produced the suspicious traffic.
• A compromised account or server is sending from the IP.

How to fix it

1. 01Let the server keep retrying at a normal pace; the deferral is temporary.
2. 02Check the IP for unexpected traffic, such as a compromised mailbox or an open relay, and stop it.
3. 03If deferrals continue for days, check the IP on public blacklists and review recent volume and content sent from it.

Sources

What this page rests on, checked on 20 Oct 2026. The explanation is ours; the reply text is the server's.

• Email nondelivery reports and SMTP errors in Exchange Onlinelearn.microsoft.com

Further reading

• Blacklist checker