Fix "550 5.7.1 [ESA] Sender Blocked"

A permanent outbound block placed after repeated abuse from your account. How to find the cause, secure the account and get the block lifted.

550 5.7.1 [ESA] Sender Blocked means WebGee has permanently blocked outbound mail from your account. Applies to shared, reseller and cPanel hosting.

It is not a first response. The block follows repeated temporary blocks that did not stop the traffic causing them — spam, bulk sending, high complaint rates, or large volumes of mail to invalid recipients.

Assume the account is compromised until you have established otherwise. Almost every account that reaches a permanent block is sending mail its owner did not send, usually through a stolen mailbox password or a vulnerable script.

1. Find out what was sent

Log in to cPanel.
Open Track Delivery.
Review recent outbound messages.

Look for mail you do not recognise, unfamiliar recipient addresses, and large runs of failures — a long list of rejections to invalid addresses is the signature of a spam run using a purchased list.

Note which mailbox the traffic came from. That is what needs securing.

2. Secure the account

Change the password on the affected mailbox immediately, and on any other mailbox that shares it. Use a long, unique password containing upper and lower case letters, numbers and symbols, generated rather than invented.

Then close the way in:

If a mailbox password leaked, changing it is enough — but change every place that password was reused.
If a script was exploited, the password change will not help. Update WordPress core, themes and plugins, and scan the account for malware. See Cleaning a compromised website.
Check for mail-sending cron jobs you did not create.

3. Request removal

Contact WebGee support and ask for the block to be lifted. Tell them what you found and what you changed — a request that only asks for unblocking, with no account of the cause, will be slower.

Do not ask for the block to be removed before securing the account. If the traffic resumes, the account is blocked again, and repeated cycles put the hosting account itself at risk.

Preventing a repeat

Use a unique password per mailbox.
Keep applications patched.
Send application mail through SMTP with authentication, so every outbound message is attributable to a mailbox.
Move campaigns to a marketing service — see Email sending limits.