MailFixIt

Outlook and Exchange Online DMARC rejection

Outlook 550 5.7.509: Access denied, sending domain does not pass DMARC verification and has a DMARC policy of reject

Microsoft rejected the message because the visible From domain failed DMARC and asks receivers to reject such mail.

Problem description

The Microsoft response contains:

550 5.7.509 Access denied, sending domain [example.com] does not pass DMARC verification and has a DMARC policy of reject.

Run this automated test on my domain

Enter your domain. MailFixIt checks the relevant DNS records automatically and shows the evidence.
Is this temporary or permanent?

SMTP 550 is permanent for this message. Retrying it unchanged will normally fail again.

Fix an authorized sender

  1. Save the message headers and full rejection.
  2. Identify the visible From domain, Return-Path domain, sending IP, and each DKIM d= domain and s= selector.
  3. Check whether SPF passed for the Return-Path domain and whether that domain aligns with From.
  4. Check whether DKIM passed and whether its d= domain aligns with From.
  5. Configure the sending service so at least one of those paths both passes and aligns.
  6. Send a new message through that exact service.

Common fixes are a custom aligned Return-Path, an aligned DKIM signing domain, correct SPF authorization, or a repaired DKIM key. Do not add an unknown sender just because it appears in a bounce.

Frequently asked questions

Should I change DMARC from p=reject to p=none?

Not as the first fix. Make the legitimate sender pass aligned SPF or DKIM. Keep a valid reject policy protecting the domain.

Could this rejection be correct?

Yes. If the message did not come from an authorized service, DMARC is working as intended.

Related email diagnostics

Outlook 550 5.7.515: Access denied, sending domain does not meet the required authentication levelDiagnose Outlook 550 5.7.515 email rejection safely. Check SPF, DKIM and DMARC DNS, interpret the receiver report, and identify the next configuration step. DMARC policy for the visible From subdomain is unexpectedFind the effective DMARC policy for a visible From subdomain. See whether p, sp, np or test mode applies before changing DMARC DNS. Gmail 550 5.7.26: This email has been blocked because the sender is unauthenticatedDiagnose Gmail 550 5.7.26 safely. Separate unauthenticated-mail, SPF hard-fail and DMARC-policy branches before changing email DNS.

Primary sources: Microsoft Exchange Online NDR reference, RFC 9989: Domain-based Message Authentication, Reporting, and Conformance.