5.7.1: IP listed on both a connector and the IP Allow list
An outside server's IP is set on both an inbound connector and the IP Allow list, which hides the real blocklist that refused it.
- Microsoft
- Provider
- Permanent (5xx)
- Class
- Sources checked
- Author
At a glance
- Code
- 5.7.1
- Temporary or permanent
- PermanentRefused for good: the message comes back to the sender, and resending it gets the same answer.
- Who has to act
- The recipient's side. Their mail admin has to change something; you can tell them.
- What the server says
5.7.1 Unable To Relay: Blocked by Customer Allow list
What it means
Microsoft documents this message for a specific misconfiguration. An external server cannot connect to Microsoft 365 because its IP address is on a blocklist, but because the same address was added to an inbound connector and to the IP Allow list in connection filtering, the bounce says Blocked by Customer Allow list instead of naming the real-time blocklist (RBL) that matched. Removing the address from the IP Allow list makes the bounce name the blocklist, which tells the sender what to fix.
Common causes
- An external server's IP was added both to an inbound connector and to the IP Allow list.
- That IP is also on a real-time blocklist used by Microsoft 365.
How to fix it
- 01Admins of the receiving tenant: remove the external IP from the IP Allow list in connection filtering.
- 02Have the sender try again and read the new bounce, which names the blocklist.
- 03The sender then requests removal from that blocklist.
- 04Keep IP addresses in connector settings for your own on-premises servers only.
Sources
What this page rests on, checked on 20 Oct 2026. The explanation is ours; the reply text is the server's.
- 5.7.1 Unable to Relay: Blocked by Customer Allow Listlearn.microsoft.com
Related codes
- 5.7.1Unable to relay.The receiving system refused to pass the message on because it is not the final destination for the recipient domain.
- 5.7.1Sending IP on the Microsoft 365 blocklist.Microsoft 365 refused the message because the sending IP address is on its own blocklist, named Blocklist 1 in the bounce.
5.7.1 at other providers
- 550 5.7.1Blocked by a domain policy.A rule set by the recipient's or the sender's Google Workspace admin blocks this message, so Gmail rejected it under that policy.
- 550 5.7.1Relay IP does not match the sending domain.Google's SMTP relay knows your IP, but the mail's sending domain is not one that IP is registered to relay for in your Workspace account.
- 550 5.7.1Blocked as likely spam.Gmail's filters judged this message likely to be spam and rejected it outright, instead of delivering it to the spam folder.
- 550 5.7.1IPv6 sender without PTR or authentication.Gmail rejected mail that arrived over IPv6 because the sending address lacks a matching PTR record, or the message failed authentication.
- 550 5.7.1Blocked for low IP reputation.Gmail permanently rejected the message because the IP it came from has a very low reputation with Gmail.
- 550 5.7.1Blocked for low domain reputation.Gmail permanently rejected the message because the domain it comes from has a very low reputation with Gmail.
Further reading
All 111 Microsoft codesEvery code in the wikiPaste your own bounce