Users may be unable to send or receive email messages, and receive an NDR with a 550 or 554 error code when sending.
ID	Workload Feature	Title	Classification	Severity	Start Time	Last Updated
EX703958	Exchange Online E-Mail timely delivery All clients	Some users may be unable to send or receive email messages, and receive a Non-Delivery Report (NDR) when sending	advisory		24-Dec-2023 16:00	12-Feb-2024 15:05
Update: 12-Feb-2024 15:05 A post-incident report has been published. Update: 07-Feb-2024 15:24 A post-incident report has been published. Update: 07-Feb-2024 15:24 A post-incident report has been published. Update: 05-Feb-2024 16:00 Title: Some users may be unable to send or receive email messages, and receive a Non-Delivery Report (NDR) when sending User Impact: Users were unable to send or receive email messages, and received an NDR with a 550 or 554 error code when sending. More Info: This issue only occurred if either the sender or user who was receiving the message was utilizing a specific third-party anti-spam service. Senders received the NDR which stated that the message was rejected due to a 550 or 554 error code and that their host IP address was listed on the third-party anti-spam service. The error messages stated "550 5.7.350 Remote server returned message detected as spam", "554 5.7.1 Service unavailable; Client host xxx.xxx.xxx.xxx blocked", or "‎550 5.7.1 This email was rejected because it violates our security policy." We recommend that users retry sending email messages that previously returned NDRs, as this should now prove successful. Final Status: We've confirmed after extensive monitoring that our work to unblock affected IP addresses has successfully reduced the rate of impacted mail flow to pre-incident thresholds, mitigating impact for users. Scope of Impact: This issue may have affected any user's mail flow if the recipient was leveraging a specific third-party antispam service to filter email messages. Start Time: Thursday, December 25, 2023, at 12:00 AM UTC End Time: Monday, February 5, 2024, at 10:13 PM UTC Root Cause: Due to significantly higher than normal amount of Spam/Phishing emails being sent from organizations that leverage the Exchange Online service, a third-party anti-spam service blocked a significant portion of Microsoft's email IP address ranges to protect organizations that use their services. The third-party applied blocks of 24 hours, and then would unblock the IP address ranges. However, the increased volume of Spam/Phishing continued and would trigger another block. Once we had implemented multiple optimizations within our anti-spam systems to address the volume of outbound Spam/Phishing, the third-party anti-spam service removed the blocks. Next Steps: - For a comprehensive list of next steps and actions, please refer to the Post Incident Review document. Update: 01-Feb-2024 14:35 Title: Some users may be unable to send or receive email messages, and receive a Non-Delivery Report (NDR) when sending User Impact: Users may be unable to send or receive email messages, and receive an NDR with a 550 or 554 error code when sending. More Info: This issue only occurs if either the sender or user who is receiving the message is utilizing a specific third-party anti-spam service. Senders receive the NDR which states that the message has been rejected due to a 550 or 554 error code and that their host IP address is listed on the third-party anti-spam service. The error messages state "550 5.7.350 Remote server returned message detected as spam", "554 5.7.1 Service unavailable; Client host xxx.xxx.xxx.xxx blocked", or "‎550 5.7.1 This email was rejected because it violates our security policy." We recommend that users retry sending email messages that previously returned NDRs, as this may now prove successful. Current Status: Our monitoring telemetry continues to indicate a positive trajectory, signaling relief for many users. As previously mentioned, efforts are ongoing to explore additional rule optimizations so we can ensure that impact for residually affected users is effectively minimized. Scope of Impact: This issue may affect any user's mail flow if the recipient is leveraging a specific third-party antispam service to filter email messages. Start Time: Thursday, December 25, 2025, at 12:00 AM UTC Preliminary Root Cause:Outbound spam associated with some Microsoft IP addresses is causing all mail from these addresses to be blocked by a specific third-party antispam service. Next Update By: Tuesday, February 6, 2024, at 12:00 AM UTC Update: 30-Jan-2024 14:48 Title: Some users may be unable to send or receive email messages, and receive a Non-Delivery Report (NDR) when sending User Impact: Users may be unable to send or receive email messages, and receive an NDR with a 550 or 554 error code when sending. More Info: This issue only occurs if either the sender or user who is receiving the message is utilizing a specific third-party anti-spam service. Senders receive the NDR which states that the message has been rejected due to a 550 or 554 error code and that their host IP address is listed on the third-party anti-spam service. The error messages state "550 5.7.350 Remote server returned message detected as spam", "554 5.7.1 Service unavailable; Client host xxx.xxx.xxx.xxx blocked", or "‎550 5.7.1 This email was rejected because it violates our security policy." Current Status: We're continuing to see positive trends in our monitoring telemetry, and we're confident that a large percentage of users are no longer affected by this issue. As our mitigative changes take effect, we recommend that users retry sending email messages that previously returned NDRs, as this may now prove successful. In parallel, we're performing some additional rule optimizations to remediate impact for any users who may be residually affected by this problem. Scope of Impact: This issue may affect any user's mail flow if the recipient is leveraging a specific third-party anti-spam service to filter email messages. Start Time: Thursday, December 25, 2025, at 12:00 AM UTC Preliminary Root Cause:Outbound spam associated with some Microsoft IP addresses is causing all mail from these addresses to be blocked by a specific third-party antispam service. Next Update By: Friday, February 2, 2024, at 12:00 AM UTC Update: 29-Jan-2024 15:10 Title: Some users may be unable to send or receive email messages, and receive a Non-Delivery Report (NDR) when sending User Impact: Users may be unable to send or receive email messages, and receive an NDR with a 550 or 554 error code when sending. More Info: This issue only occurs if either the sender or user who is receiving the message is utilizing a specific third-party anti-spam service. Senders receive the NDR which states that the message has been rejected due to a 550 or 554 error code and that their host IP address is listed on the third-party anti-spam service. The error messages state "550 5.7.350 Remote server returned message detected as spam", "554 5.7.1 Service unavailable; Client host xxx.xxx.xxx.xxx blocked", or "‎550 5.7.1 This email was rejected because it violates our security policy." Current Status: We've performed some rule optimizations to minimize outbound spam and, while we're continuing to monitor for new reports of impact, our signals indicate a decrease in addresses blocked by the third-party antispam service. We've also confirmed that many formerly blocked IP addresses have since been delisted automatically, providing relief for many users. We'll continue monitoring telemetry for an extended period to ensure that this positive trend persists before confirming resolution. Scope of Impact: This issue may affect any user's mail flow if the recipient is leveraging a specific third-party anti-spam service to filter email messages. Start Time: Thursday, December 25, 2025, at 12:00 AM UTC Preliminary Root Cause:Outbound spam associated with some Microsoft IP addresses is causing all mail from these addresses to be blocked by a specific third-party antispam service. Next Update By: Wednesday, January 31, 2024, at 12:00 AM UTC Update: 26-Jan-2024 12:36 Title: Some users may be unable to send or receive email messages, and receive a Non-Delivery Report (NDR) when sending User Impact: Users may be unable to send or receive email messages, and receive an NDR with a 550 or 554 error code when sending. More Info: This issue only occurs if either the sender or user who is receiving the message is utilizing a specific third-party anti-spam service. Senders receive the NDR which states that the message has been rejected due to a 550 or 554 error code and that their host IP address is listed on the third-party anti-spam service. The error messages state "550 5.7.350 Remote server returned message detected as spam", "554 5.7.1 Service unavailable; Client host xxx.xxx.xxx.xxx blocked", or "‎550 5.7.1 This email was rejected because it violates our security policy." Current Status: Our efforts to collaboratively delist affected IPs with the third-party antispam service are continuing on a case-by-case basis as we identify additional blocked addresses. In parallel, we're examining IP block patterns we've identified via our telemetry so we can pinpoint the most efficacious rule changes and optimizations to reduce outbound spam and alleviate impact. Scope of Impact: This issue may affect any user's mail flow if the recipient is leveraging a specific third-party anti-spam service to filter email messages. Next Update By: Tuesday, January 30, 2024, at 12:00 AM UTC Update: 24-Jan-2024 10:38 Title: Some users may be unable to send or receive email messages, and receive a Non-Delivery Report (NDR) when sending User Impact: Users may be unable to send or receive email messages, and receive an NDR with a 550 or 554 error code when sending. More Info: This issue only occurs if either the sender or user who is receiving the message is utilizing a specific third-party anti-spam service. Senders receive the NDR which states that the message has been rejected due to a 550 or 554 error code and that their host IP address is listed on the third-party anti-spam service. The error messages state "550 5.7.350 Remote server returned message detected as spam", "554 5.7.1 Service unavailable; Client host xxx.xxx.xxx.xxx blocked", or "‎550 5.7.1 This email was rejected because it violates our security policy." Current Status: We're continuing our collaboration with the third-party anti-spam service to delist affected IP addresses that are being blocked. In parallel, we're investigating any additional workstreams that can further reduce the impact of this issue. This may include further rule changes intended to reduce outbound spam patterns. We understand the impact an issue like this can have on your organization, and we appreciate your partnership and patience as we work to remediate the issue. Scope of Impact: This issue may affect any user's mail flow if the recipient is leveraging a specific third-party anti-spam service to filter email messages. Next Update By: Friday, January 26, 2024, at 9:30 PM UTC Update: 22-Jan-2024 10:22 Title: Some users may be unable to send or receive email messages, and receive a Non-Delivery Report (NDR) when sending User Impact: Users may be unable to send or receive email messages, and receive an NDR with a 550 or 554 error code when sending. More Info: This issue only occurs if either the sender or user who is receiving the message is utilizing a specific third-party anti-spam service. Senders receive the NDR which states that the message has been rejected due to a 550 or 554 error code and that their host IP address is listed on the third-party anti-spam service. The error messages state "550 5.7.350 Remote server returned message detected as spam", "554 5.7.1 Service unavailable; Client host xxx.xxx.xxx.xxx blocked", or "‎550 5.7.1 This email was rejected because it violates our security policy." Current Status: We've implemented additional rule changes intended to further reduce outbound spam patterns, which has produced a reduction in the number of blocked instances. We're continuing our collaboration with the third-party service to delist affected IP addresses that are being blocked on the third-party's anti-spam service. Scope of Impact: This issue may affect any user's mail flow if the recipient is leveraging a specific third-party anti-spam service to filter email messages. Next Update By: Wednesday, January 24, 2024, at 7:30 PM UTC Update: 19-Jan-2024 10:23 Title: Some users may be unable to send or receive email messages and receive a Non-Delivery Report (NDR) User Impact: Users may be unable to send or receive email messages and receive a NDR with a 550 or 554 error code. More Info: This issue only occurs if either the sender or user who is receiving the message is utilizing a specific third-party anti-spam service. Senders receive the NDR which states that the message has been rejected due to a 550 or 554 error code and that their host IP address is listed on the third-party anti-spam service. The error messages state "550 5.7.350 Remote server returned message detected as spam", "554 5.7.1 Service unavailable; Client host xxx.xxx.xxx.xxx blocked", or "‎550 5.7.1 This email was rejected because it violates our security policy." Current Status: We continue to collaborate with the third-party service to delist additional IP addresses that are being blocked on the third-party's anti-spam service. In parallel, we continue to analyze outbound spam patterns and implement targeted rules and optimizations for these patterns, which has produced a reduction in the number of blocked instances. Scope of Impact: This issue may affect any user's mail flow if the recipient is leveraging a specific third-party anti-spam service to filter email messages. Next Update By: Monday, January 22, 2024, at 7:30 PM UTC Update: 18-Jan-2024 11:23 Title: Some users may be unable to send or receive email messages and receive a Non-Delivery Report (NDR) User Impact: Users may be unable to send or receive email messages and receive a NDR with a 550 or 554 error code. More Info: This issue only occurs if either the sender or user who is receiving the message is utilizing a specific third-party anti-spam service. Senders receive the NDR which states that the message has been rejected due to a 550 or 554 error code and that their host IP address is listed on the third-party anti-spam service. The error messages state "550 5.7.350 Remote server returned message detected as spam", "554 5.7.1 Service unavailable; Client host xxx.xxx.xxx.xxx blocked", or "‎550 5.7.1 This email was rejected because it violates our security policy." Current Status: We're continuing to work closely with the third-party service to delist additional IP addresses that are being blocked on the third-party's anti-spam service. Since introducing anti-spam optimization changes, we've observed a reduction in the total number of blocked instances and we're continuing to implement additional anti-spam optimization changes to mitigate impact further. Scope of Impact: This issue may affect any user's mail flow if the recipient is leveraging a specific third-party anti-spam service to filter email messages. Next Update By: Friday, January 19, 2024, at 7:30 PM UTC Update: 17-Jan-2024 15:10 Title: Some users may be unable to send or receive email messages and receive a Non-Delivery Report (NDR) User Impact: Users may be unable to send or receive email messages and receive a NDR with a 550 or 554 error code. More Info: This issue only occurs if either the sender or user who is receiving the message is utilizing a specific third-party anti-spam service. Senders receive the NDR which states that the message has been rejected due to a 550 or 554 error code and that their host IP address is listed on the third-party anti-spam service. The error messages state "550 5.7.350 Remote server returned message detected as spam", "554 5.7.1 Service unavailable; Client host xxx.xxx.xxx.xxx blocked", or "‎550 5.7.1 This email was rejected because it violates our security policy." Current Status: We've deployed some anti-spam optimization changes and have seen positive results in terms of reduced counts related to delisted IPs. We're continuing to internally validate additional anti-spam optimization changes, as well as work in conjunction with the third-party service to delist IP addresses which are blocked on the third-party's anti-spam service. Scope of Impact: This issue may affect any user's mail flow if the recipient is leveraging a specific third-party anti-spam service to filter email messages. Next Update By: Thursday, January 18, 2024, at 7:30 PM UTC Update: 11-Jan-2024 14:26 Title: Some users may be unable to send or receive email messages and receive a Non-Delivery Report (NDR) User Impact: Users may be unable to send or receive email messages and receive a NDR with a 550 or 554 error code. More Info: This issue only occurs if either the sender or user who is receiving the message is utilizing a specific third-party anti-spam service. Senders receive the NDR which states that the message has been rejected due to a 550 or 554 error code and that their host IP address is listed on the third-party anti-spam service. The error messages state "550 5.7.350 Remote server returned message detected as spam", "554 5.7.1 Service unavailable; Client host xxx.xxx.xxx.xxx blocked", or "‎550 5.7.1 This email was rejected because it violates our security policy." Current Status: We're continuing to work in conjunction with the third-party service to delist IP addresses which are blocked on the third-party's anti-spam service, In parallel, we're continuing to develop the anti-spam optimizations for long-term mitigation, which we'll provide a timeline for deployment to the affected environment when available. Scope of Impact: This issue may affect any user's mail flow if the recipient is leveraging a specific third-party anti-spam service to filter email messages. Next Update By: Wednesday, January 17, 2024, at 11:30 PM UTC Update: 09-Jan-2024 14:57 Title: Some users may be unable to send or receive email messages and receive a Non-Delivery Report (NDR) User Impact: Users may be unable to send or receive email messages and receive a NDR with a 550 or 554 error code. More Info: This issue only occurs if either the sender or user who is receiving the message is utilizing a specific third-party anti-spam service. Senders receive the NDR which states that the message has been rejected due to a 550 or 554 error code and that their host IP address is listed on the third-party anti-spam service. The error messages state "550 5.7.350 Remote server returned message detected as spam", "554 5.7.1 Service unavailable; Client host xxx.xxx.xxx.xxx blocked", or "‎550 5.7.1 This email was rejected because it violates our security policy." Current Status: We're working in conjunction with the third-party service to delist a number of the IP addresses which are blocked on the third-party's anti-spam service. While this has successfully mitigated the issue for a majority of users, we're developing a series of anti-spam system optimizations to further address the issue. We'll share more details regarding the timeline for these optimizations once they become available. Scope of Impact: This issue may affect any user's mail flow if the recipient is leveraging a specific third-party anti-spam service to filter email messages. Next Update By: Thursday, January 11, 2024, at 11:30 PM UTC Update: 08-Jan-2024 14:57 Title: Some users may be unable to send or receive email messages and receive a Non-Delivery Report (NDR) User Impact: Users may be unable to send or receive email messages and receive a NDR with a 550 or 554 error code. More Info: This issue only occurs if either the sender or user who is receiving the message is utilizing a specific third-party anti-spam service. Senders receive the NDR which states that the message has been rejected due to a 550 or 554 error code and that their host IP address is listed on the third-party anti-spam service. The error messages state "550 5.7.350 Remote server returned message detected as spam", "554 5.7.1 Service unavailable; Client host xxx.xxx.xxx.xxx blocked", or "‎550 5.7.1 This email was rejected because it violates our security policy." Current Status: We're continuing to evaluate the traffic patterns and are working with the third-party service to determine the correct course of action to remediate the impact. Scope of Impact: This issue may affect any user's mail flow if the recipient is leveraging a specific third-party anti-spam service to filter email messages. Next Update By: Tuesday, January 9, 2024, at 11:30 PM UTC Update: 05-Jan-2024 13:45 Title: Some users may be unable to send or receive email messages and receive a Non-Delivery Report (NDR) User Impact: Users may be unable to send or receive email messages and receive a NDR with a 550 or 554 error code. More Info: This issue only occurs if either the sender or user who is receiving the message is utilizing a specific third-party anti-spam service. Senders receive the NDR which states that the message has been rejected due to a 550 or 554 error code and that their host IP address is listed on the third-party anti-spam service. The error messages state "550 5.7.350 Remote server returned message detected as spam", "554 5.7.1 Service unavailable; Client host xxx.xxx.xxx.xxx blocked", or "‎550 5.7.1 This email was rejected because it violates our security policy." Current Status: Our collaborative analysis with the third-party service has confirmed that some of the third-party's blocks were intentional; however, we're continuing to work with the provider to ensure legitimate mail is delivered as expected. We're also reviewing anti-spam changes that could be implemented on our side to further resolve the issue. Scope of Impact: This issue may affect any user's mail flow if the recipient is leveraging a specific third-party anti-spam service to filter email messages. Next Update By: Monday, January 8, 2024, at 11:00 PM UTC Update: 04-Jan-2024 14:59 Title: Some users may be unable to send or receive email messages and receive a Non-Delivery Report (NDR) User Impact: Users may be unable to send or receive email messages and receive a NDR with a 550 or 554 error code. More Info: This issue only occurs if either the sender or user who is receiving the message is utilizing a specific third-party anti-spam service. Senders receive the NDR which states that the message has been rejected due to a 550 or 554 error code and that their host IP address is listed on the third-party anti-spam service. The error messages state "550 5.7.350 Remote server returned message detected as spam", "554 5.7.1 Service unavailable; Client host xxx.xxx.xxx.xxx blocked", or "‎550 5.7.1 This email was rejected because it violates our security policy." Current Status: We've received reports that some users may be unable to send or receive email messages due to a third-party anti-spam service listing our IP addresses within their service. We're working with the third-party anti-spam service to better understand why our IP addresses have been listed and what actions need to be taken to resolve this issue. Scope of Impact: This issue may affect any user's mail flow if the recipient is leveraging a specific third-party anti-spam service to filter email messages. Next Update By: Friday, January 5, 2024, at 11:00 PM UTC