Skip to content
inboxprobe

Checkers

Generators

Guides

Bounce error codes · Outlook.com, Hotmail and Live

550 5.7.515 Access denied: how to fix it

Outlook.com refused your message because the domain in your From address didn't meet Microsoft's authentication requirements for high-volume senders.

The exact error text

  • 550 5.7.515 Access denied, sending domain <domain> does not meet the required authentication level.

Quoted from Microsoft — Fix NDR error 550 5.7.515 in Outlook.com

Check your domain

Find out which record is missing or failing. The check runs in your browser and takes a few seconds.

What 5.7.515 means

Microsoft rejects mail to its consumer services (Outlook.com, Hotmail, Live.com, MSN) from domains that send in volume but don't authenticate properly. The check is on the domain in the visible From address (Microsoft calls it the 5322.From or P2 sender), not on your IP address or your content.

It's a 5xx code, so it's permanent: your server won't retry, and sending the same message again gets the same answer until DNS or the sending service is fixed.

Who gets it

Microsoft's April 2025 announcement covers domains sending more than 5,000 emails per day to its consumer services. Its 5.7.515 support page describes the trigger as 5,000 or more messages that all use the same From domain. Once you're over that line, Microsoft expects every message from the domain to meet the requirements.

The rejection started on May 5, 2025. Microsoft first planned to send non-compliant mail to Junk, then changed this in an update on April 29, 2025: failing messages are rejected with 550 5.7.515. Recipients can't override it: Microsoft says the Safe Senders list won't be honored.

Why your domain failed

All three of these must hold for every message:

  • SPF passes. The server that sent the message is listed in the SPF record of the envelope sender (Return-Path) domain.
  • DKIM passes. The message carries a valid DKIM signature.
  • DMARC is published and passes. At least p=none, and SPF or DKIM passes for a domain aligned with the From address. Microsoft prefers both to align.
Common causeWhat the headers showFix
No DMARC recorddmarc=nonePublish v=DMARC1; p=none at _dmarc (record below).
A sending service signs with its own domaindkim=pass header.d=<the service's domain> and dmarc=failTurn on custom-domain DKIM in that service so d= is your domain.
SPF over 10 DNS lookupsspf=permerrorRemove unused includes. The SPF checker shows what each one costs.
Mail sent from a system missing from SPFspf=fail or softfailAdd that service's include to your one SPF record (SPF generator).

Fix it step by step

  1. Read the headers. Open a message from the failing system and find Authentication-Results, or paste the headers into the email header analyzer. It shows which domain SPF and DKIM passed for and whether they align with From.
  2. Check the records. Run the check above. It flags a missing DMARC record, an SPF record over the lookup limit, and missing or weak DKIM keys.
  3. Publish DMARC if it's missing. p=none is enough for this requirement. The DMARC generator builds the record with a report address.
  4. Fix each sending service. Microsoft's own checklist for third-party senders: the envelope sender uses your domain, DKIM signs with your domain, your SPF record includes the service, and DMARC is evaluated for your domain.
  5. Test. Send to an Outlook.com address. If it arrives, the fix worked for that system. Repeat for every service that sends as your domain.

Microsoft's minimum DMARC record

Type
TXT
Host / name
_dmarc
Value
v=DMARC1; p=none

Microsoft 365 or Google Workspace customer? The setup guides for Microsoft 365 and Google Workspace list the exact records, including the DKIM step that's easy to skip.

Questions

Is 550 5.7.515 caused by my message content?

No. It's about authentication of the From domain. A message with perfect content still bounces if SPF, DKIM or DMARC doesn't pass.

Can the recipient whitelist me to get around it?

No. Microsoft says adding a sender to the Safe Senders list doesn't bypass this enforcement. Only fixing authentication does.

I send fewer than 5,000 emails a day. Why did I get it?

Microsoft counts mail to its consumer services per From domain, so all systems sending as your domain add up: newsletters, invoices, CRM mail. If you're really below the threshold, check that you're reading 5.7.515 and not a different code.

Does 5.7.515 apply to Microsoft 365 business mailboxes?

Microsoft documents it for Outlook.com and its other consumer services. Business recipients on Microsoft 365 apply their organisation's settings and reply with different codes, for example 550 5.7.509 when your own DMARC policy says reject.

Is p=none really enough?

For this rule, yes: Microsoft's example record is v=DMARC1; p=none. DMARC still has to pass, which means aligned SPF or DKIM. Moving on to quarantine and reject is what stops others spoofing your domain.

Sources

Last reviewed: