What the message looks like
550 5.7.509 Access denied, sending domain example.com does not pass DMARC verification and has a DMARC policy of reject550 5.7.515 Access denied, sending domain example.com doesn't meet the required authentication level
What it means
Microsoft's servers, used by Outlook.com, Hotmail and Microsoft 365, rejected the email because it failed DMARC, and the sending domain's DMARC policy is p=reject. Microsoft is following the domain owner's own instructions.
The related 550 5.7.515 error means the sending domain didn't meet Microsoft's authentication requirements for high-volume senders, which ask for SPF, DKIM and DMARC to all be in place.
Common causes
- The email was sent through a service that isn't set up with SPF or DKIM for the sending domain.
- DKIM signs with a different domain to the one in the From address, so DMARC alignment fails.
- The domain is being spoofed.
- The email was forwarded or changed on the way, such as a mailing list adding a footer, which broke its DKIM signature.
If you're the recipient
There's nothing to change on your side. If it's someone you know, let them know their emails to you are being rejected.
If you're the sender
Check your DMARC reports to see which services are failing. For each service that sends as your domain, set up DKIM signing with your own domain and add it to your SPF record. If you're not sure everything is covered yet, move your DMARC policy to p=quarantine or p=none while you fix it.
If you use addy.io
addy.io forwards emails from its own domain with its own DKIM signature, so forwarding through addy.io doesn't cause this error. If you see it when replying or sending from an alias with your own domain, check that domain's SPF, DKIM and DMARC records match the ones shown on your Domains page.