550 5.7.705: tenant blocked for sending spam

What it means

When most of the traffic from a tenant is detected as suspicious, Exchange Online bans the tenant from sending and returns 5.7.705. Microsoft names two common ways spam ends up flowing through an organization: a compromised on-premises server that routes mail through Exchange Online, and a compromised admin account used to create connectors. It also notes a rare case, an expired subscription being renewed, which can block sending for typically no longer than a day. Once the cause is fixed, an admin contacts Microsoft Support to remove the block.

Common causes

• A compromised on-premises server relays spam through Exchange Online.
• A compromised admin account was used to create connectors for sending spam.
• Compromised mailboxes or an open relay send bulk mail through the tenant.
• The tenant is renewing an expired Exchange Online subscription.

How to fix it

1. 01Find and stop the spam source: check on-premises servers, connectors and recently changed admin accounts.
2. 02Follow Microsoft's steps for responding to a compromised account, and turn on multifactor authentication for admins.
3. 03Review your tenant security settings, for example against Microsoft Secure Score.
4. 04Contact Microsoft Support to have the block removed once the cause is resolved.

Sources

What this page rests on, checked on 20 Oct 2026. The explanation is ours; the reply text is the server's.

• Fix NDR error codes 550 5.7.703, 550 5.7.705, 550 5.7.708, and 550 5.7.750learn.microsoft.com
• Email nondelivery reports and SMTP errors in Exchange Onlinelearn.microsoft.com

Further reading

• The standard meaning of 550: mailbox unavailable