550 5.7.1: delivery not authorized, message refused
A security or policy setting refused your message. You may not be allowed to send to that recipient, to relay through that server, or your mail was judged as spam.
What 550 5.7.1 means
RFC 3463 defines X.7.1 as "Delivery not authorized, message refused": the sender is not authorized to send to the destination, as a result of per-host or per-recipient filtering. It's only useful as a permanent error. Because "filtering" covers almost anything, 550 5.7.1 is one of the broadest codes you'll see.
Microsoft's guide for 550 5.7.1 says it typically means a security setting in your organization or the recipient's is preventing delivery: you don't have permission to send to the recipient or a group, you don't have permission to send through a server between you and the recipient, or the message was routed to the wrong server. Its NDR table also lists "Unable to relay" and "Client was not authenticated" under 5.7.1. Gmail uses 550 5.7.1 for admin policies, likely unsolicited mail, low IP or domain reputation, and messages that break RFC 5322 header rules.
So read the text after the code. The common branches are permission (groups, external senders), relaying (your app or server isn't allowed to send through that host), and filtering (reputation, content or a blocklist).
Likely causes
- The recipient, or a group, only accepts mail from certain or internal senders.
- A mail flow or transport rule on the receiving side rejected the message.
- Relay denied: the server you connected to won't pass mail on to another domain for you.
- Spam filtering based on IP reputation, a blocklist, content or authentication.
- The recipient domain's MX record points to a server that doesn't host it.
How to fix it
If you sent the message
- Read the full error text: it usually names the reason (policy, relay, reputation or blocklist).
- If you're sending to a group, ask its owner to allow you.
- If your app or device got it, check it's authenticating to the right server.
- Check your sending IP on blocklists and confirm SPF, DKIM and DMARC pass.
If you're the recipient or their admin
- Check group delivery restrictions, mail flow rules and block lists for the sender.
- Confirm your domain's MX record points to the service that hosts your mailboxes.
Frequently asked questions
Can I fix 550 5.7.1 myself?
Sometimes. If the text points to your IP reputation, a blocklist or authentication, you or your admin can fix it. If it's a permission setting on the recipient's side, as Microsoft notes, the recipient or their admin has to change it.
What does 'unable to relay' mean with 5.7.1?
The server you connected to won't pass your message on to another domain. Your app or server is either not authenticating, or it's connecting to a server that doesn't handle mail for that recipient.
Is 550 5.7.1 the same at every provider?
The standard meaning is the same, delivery not authorized, but each provider attaches its own reasons and text. Search the full line in the lookup to see provider-specific entries.
Sources
- RFC 3463: Enhanced Mail System Status Codes
- Fix NDR error "550 5.7.1" in Exchange Online (Microsoft Learn)
- Gmail SMTP errors and codes (Google Workspace Admin Help)
Provider messages are quoted as the provider publishes them. Servers can change their wording, so the bounce you received may differ slightly.
Related codes
- 550 5.7.1 550 5.7.1: Gmail blocked likely unsolicited mail or low reputation
- 550 5.7.1 550 5.7.1 Service unavailable; client host blocked using a blocklist
- 451 4.7.1 451 4.7.1: delivery not authorized, try again later
- 554 SMTP 554: transaction failed
- 550 5.7.133-136 550 5.7.133 to 5.7.136: sender not authenticated for this recipient
- 550 5.7.124 550 5.7.124: sender not in the group's allowed senders list
Related guides
How do you safely whitelist a sender in Microsoft 365 and Google Workspace?
Safely allow (whitelist) a sender in Microsoft 365 and Google Workspace without opening a spoofing hole: Tenant Allow/Block List, approved senders and gateways.
9 min read Running email day to dayHow to get your domain or IP removed from an email blacklist
How to check if your mail server IP or domain is on a DNS blocklist, find the real cause, and request removal from Spamhaus, SpamCop, Barracuda and Microsoft.
9 min read Running email day to dayWhy did this email go to spam or quarantine?
Why an email went to the spam folder or quarantine, what each spam verdict means, how to find the reason in the headers, and how to fix or release the message.
9 min read