Outlook / Microsoft 365 email rejection
Outlook 550 5.7.515: Access denied, sending domain does not meet the required authentication level
An Outlook or Microsoft 365 rejection with 550 5.7.515 means the receiving service reported an authentication problem. It is a useful symptom, not proof that one particular SPF, DKIM or DMARC record is the only cause.
Mail from your domain bounces with the following error message:
550 5.7.515 Access denied, sending domain example.com does not meet the required authentication level.
Run this automated test on my domain
Enter your domain. MailFixIt checks the relevant DNS records automatically and shows the evidence.
550 is permanent for this delivery attempt. Retrying the unchanged message is not expected to work; verify the authentication path and send a fresh message after correction.
What to check first
- Confirm the sending domain. Check the public domain used by the sending service, rather than a website URL or a recipient address.
- Read the receiver report as context. MailFixIt recognizes the Outlook code and only exposes a safe, structured symptom, not the raw bounce text.
- Review SPF, DKIM and DMARC together. SPF authorizes the envelope sender, DKIM signs with a selector and signing domain, and DMARC checks alignment for the visible From domain.
- Use problem-message headers when available. The free check can extract reported SPF, DKIM and DMARC outcomes, DKIM selectors and safe domain identities from Authentication-Results, Return-Path and From. These observations are not independent verification of the message.
Common safe fixes
There is no universal record to paste for this error. The appropriate correction depends on the evidence:
- If the receiver reported
spf=fail, verify that the actual sending service and envelope domain are still authorized by the one selected SPF record. - If it reported
dkim=fail, use the DKIM selector and signing domain from the message to check the published public key and the sender's signing configuration. - If it reported
dmarc=fail, compare the visible From domain with the authenticated SPF and DKIM domains. A policy record alone does not make a message aligned. - If DNS looks correct but the symptom remains, the sending provider may need configuration changes. Public DNS cannot prove message signing, sending reputation or recipient-specific filtering.
Need a scoped application plan?
After a fresh check identifies a supported DNS warning or error, the one-time $5 Email Fix Pack can prepare a domain-specific plan. It includes records to preserve, a rollback path, three rechecks within seven days and an option to request assistance after granting temporary least-privilege DNS access.
See the Email Fix Pack or start the diagnostic.
Frequently asked questions
What does Outlook 550 5.7.515 mean?
It is a receiver-reported authentication rejection. It indicates that Outlook did not accept the message under its authentication requirements, but the reply alone does not identify a single DNS record to change.
Will adding DMARC alone fix Outlook 550 5.7.515?
Not necessarily. A DMARC record can be valid while a particular message still lacks aligned SPF or DKIM. Check the actual sending service, envelope domain, DKIM selector and the receiver’s reported results before changing policy.
Should I replace my SPF record to fix an Outlook rejection?
No. First inventory legitimate senders. A replacement that omits one service can create new delivery failures. SPF must remain a single selected record while preserving authorised senders.
Related email diagnostics
Primary sources: Microsoft Support: Outlook.com 550 5.7.515, RFC 7208 SPF, RFC 9989 DMARC.