Microsoft SMTP identity rejection

Outlook 550 5.7.506: Access Denied, Bad HELO

Microsoft documents 5.7.506 as Bad HELO. The server that connects to Microsoft is announcing an invalid or unacceptable SMTP identity; correct that outbound MTA or relay rather than changing unrelated email authentication records.

Problem description

The Microsoft NDR can contain:

550 5.7.506 Access denied, bad HELO

Diagnostic availability: MailFixIt does not currently accept a HELO hostname or inspect an SMTP session. Use the sending server's logs and configuration.

Is this temporary or permanent?

The 550 response is permanent for this attempt. Correct the announced identity and send a new message.

Probable causes

The MTA announces localhost, a bare label, an IP literal in an unacceptable form, or a nonexistent name.
A NAT, gateway, or relay uses an unexpected hostname.
The hostname has no coherent forward/reverse DNS relationship.
A tenant connector expects a different sending identity.

Manual resolution

Find the final outbound server in delivery logs.
Record the exact EHLO/HELO value it sent.
Configure a stable fully qualified hostname owned by the operator.
Publish correct forward DNS and coordinate reverse DNS with the IP owner where applicable.
Check connector restrictions, then send a new test.

Frequently asked questions

What is HELO or EHLO?

It is the identity a sending SMTP server announces when opening a mail session.

Should HELO be my visible From domain?

Not necessarily. It should normally be a stable fully qualified hostname for the actual sending server with coherent DNS.

Does MailFixIt currently validate HELO?

No. The current checker has no HELO input or SMTP-session observation.

Related email diagnostics

Outlook 550 5.7.515: Access denied, sending domain does not meet the required authentication levelDiagnose Outlook 550 5.7.515 email rejection safely. Check SPF, DKIM and DMARC DNS, interpret the receiver report, and identify the next configuration step. DNS record not detected after saving the provider-issued valueDiagnose a DNS record that is not detected after saving it. Compare the exact TXT, CNAME or MX value, identify a duplicated hostname, and avoid unsafe DNS changes.

Primary sources: Microsoft Exchange Online NDR reference, RFC 5321 SMTP.