Bounce codes › Microsoft 365
550 5.7.509: Sending domain does not pass DMARC verification
Your domain publishes a DMARC record that says "reject mail that fails". This message failed, so Microsoft did what your own record asked.
Fix your sending setup Your email failed authentication
The message failed DMARC, and your domain’s own DMARC policy says to reject such mail.
- Sent by: Microsoft 365 / Outlook
- Permanent (hard bounce). Sending the same message again fails again.
How Microsoft 365 words it (source):
Access denied, sending domain does not pass DMARC verification and has a DMARC policy of reject.
Why it happens
- You send through a service that is not set up with DKIM for your domain, and is not in your SPF record.
- SPF or DKIM passes, but for a different domain than the one in your From address (no "alignment").
- The message was forwarded or changed on the way, which broke SPF and DKIM.
- Someone else is faking your domain. Then the reject is the system working as intended.
What to do
- Check your domain with the SPF, DMARC and DKIM checker.
- In every service that sends as your domain, turn on DKIM signing with your own domain.
- Add each sending service to your SPF record.
- While you fix it, you can relax DMARC to
p=quarantineorp=none, then go back top=reject.
Don't confuse it with
550 5.7.23 is an SPF failure alone. 550 5.7.26 is Gmail's code for the same kind of problem.
Questions
Will removing bounced addresses help?
No. Every Microsoft address will refuse the message until authentication is fixed.
My DMARC record is correct. Why does it fail?
DMARC needs SPF or DKIM to pass for the same domain as the From address. A pass for your email service's domain does not count.
Got a different bounce?
Paste the whole message into the bounce code lookup. It reads the code and the words and tells you whose move it is.
Related codes
550 5.7.23Rejected because of Sender Policy Framework violation (Microsoft 365)550 5.7.26This email has been blocked because the sender is unauthenticated (Gmail)