How to resolve 550 5.1.8 Access denied, bad outbound sender AS(42004)

If a Microsoft 365 account has been compromised and a bad actor has begun sending mass malicious emails, when emails are sent they may be returned with an NDR that the message can't be sent. The following will show how to resolve 550 5.1.8 Access denied, bad outbound sender AS(42004) NDR messages that are returned when sending emails.

Delivery has failed to these recipients or groups:
email@domain.com
This message couldn't be delivered because the sending email address was not recognized as a valid sender. The most common reason for this error is that the email address is, or was, suspected of sending spam. Contact the organization's email admin for help and give them this error message.

Diagnostic information for administrators: Generating server: XXXXXXXXXXXXX.xxxxxx00.prod.outlook.com
email@domain.com
Remote server returned '550 5.1.8 Access denied, bad outbound sender AS(42004)'

This is because Microsoft 365 has determined that the mailbox has been sending suspiscious emails and then restricts the mailbox which will prevent sending any new emails until the compromise has been resolved.

When an email address is flagged as spam, it is added to the blocked sender's list, causing the mentioned error. Microsoft 365 has a recipient limit for sending emails, and this issue can arise if the number of recipients exceeds this limit. See this link for more details on sending limits.

Being blocked can have several implications:

1. Email Delivery Failure: Your emails will not reach the intended recipients, resulting in delivery errors.
2. Communication Disruption: Important messages may be missed, affecting personal or business communication.
3. Reputation Impact: Being flagged as a spam sender can harm your reputation and trustworthiness.
4. Administrative Intervention: You may need to contact your email administrator to resolve the issue and get unblocked.
5. Limited Functionality: You might face restrictions on sending emails until the block is lifted.

To Resolve 550 5.1.8 Access denied, bad outbound sender AS(42004)

As an administrator, the block can be removed. Once submitted, the unblock process will take roughly 1 hour before mail can again be sent.

To unblock a restricted user/mailbox:

Go to https://security.microsoft.com/

On the left, click Email & collaboration and then click Review

Then, click on Restricted Entities

Select the Entity that has been blocked, then click Unblock

Review the details and then click Next

Take action, if necessary, then click Submit