550 5.7.509 is Microsoft's way of saying: your message failed DMARC, and your own domain told receivers to reject mail that fails. Microsoft (Outlook.com, Hotmail and Microsoft 365) did exactly that.

The full message looks like this:

550 5.7.509 Access denied, sending domain example.com does not pass DMARC verification and has a DMARC policy of reject.

The key point: the instruction to reject came from your domain's DMARC record. Microsoft is following it. For other codes, see our guide to SMTP bounce codes.

What it means

Your domain publishes a DMARC record with p=reject. DMARC passes only when the message passes SPF or DKIM for a domain that matches the From address (this is called alignment). Your message did not, so the receiver applied your policy.

In 2023 Microsoft started following p=reject more strictly in Outlook.com and Microsoft 365; before that, many failing messages went to junk instead. That is why some senders see this bounce suddenly, for a setup that "always worked".

The usual causes

  1. A service sends as your domain without being set up. A CRM, a newsletter tool, a helpdesk, an invoicing system or a printer/scanner sends with your address in From, but it is not in your SPF record and does not sign with DKIM for your domain.
  2. SPF passes, but for the wrong domain. Many platforms pass SPF for their own bounce domain (for example bounces.platform.com). That is not aligned with your From domain, so it does not count for DMARC. Only DKIM signed with your domain fixes this.
  3. SPF is broken: more than 10 DNS lookups, two SPF records, or a typo.
  4. Forwarding. A mailbox that forwards your message to Outlook can break SPF. DKIM normally survives forwarding, which is one more reason to sign everything with DKIM.
  5. Someone is spoofing your domain. If the bounce is for a message you never sent, DMARC is doing its job. You only see the bounce because the forger used a reply address that reaches you.

How to fix it

  1. Find which service sent the message. Look at the bounced copy: its headers show the sending server and the platform. Paste them into the email header analyzer to see each server and which domain DKIM and SPF passed for. Our guide to DMARC failures goes through each possible cause.
  2. Set up DKIM for that service with your domain. Every serious sending platform offers this: you add one or two DNS records they give you. Check the result with the DKIM checker.
  3. Add the service to your SPF record if it sends from its own servers, while staying under 10 lookups. Check it with the SPF and DMARC checker.
  4. If you need time, relax the policy temporarily. Changing p=reject to p=quarantine or p=none stops the rejections while you fix the senders, but it also lets spoofed mail through. Use DMARC reports (rua=) to see every service that sends as your domain, then go back to p=reject. The DMARC record generator builds the record for you.
  5. Send again once SPF or DKIM passes aligned for that service.

Since May 2025, Outlook.com, Hotmail and Live also require domains that send 5,000 or more messages a day to their users to pass SPF, DKIM and DMARC. Mail that does not meet that bar can be rejected with:

550 5.7.515 Access denied, sending domain example.com does not meet the required authentication level.

The fix is the same: SPF and DKIM passing, and a DMARC record (at least p=none) aligned with your From domain. Gmail and Yahoo have similar rules; see our sender requirements checklist. Gmail's version of this bounce is 550 5.7.26.

Frequently asked questions

Is 550 5.7.509 a problem with the recipient's address?

No. The address is fine. The receiver refused the message because it failed your domain's DMARC policy. Removing the address from your list does not help.

Why does it only happen with Microsoft?

Every major provider applies DMARC, but they do not all reject in the same way or say it with the same code. Microsoft's code makes the reason very explicit, so it is often where senders first notice an unauthenticated service.

Should I just remove my DMARC record?

No. Without DMARC, anyone can send mail that looks like yours, and Gmail, Yahoo and Outlook expect bulk senders to have one. Fix the services instead, and use a softer policy only for a short time while you do it.

Sources