5.7.12: sender was not authenticated by organization
The recipient address is set up in Microsoft 365 to reject mail from outside its organization, so your external message was refused. Only the recipient's admin can change it.
Sender was not authenticated by organization
Microsoft's description for 5.7.12, as listed in its Exchange Online NDR reference.
What 550 5.7.12 means
Microsoft's NDR reference lists 5.7.12 "Sender was not authenticated by organization": the message is rejected because the recipient address is set up to reject messages sent from outside its organization. Microsoft adds that only an email administrator for the recipient's organization can change this configuration.
This setting is common on internal groups and on mailboxes such as payroll or all-staff lists that should never receive outside mail, and it's a sound defense against phishing aimed at those addresses. The NDR goes to the external sender. Nothing is wrong with the sender's server, SPF or DMARC; the recipient's own policy refused them.
If you're the sender and you really need to reach that address, contact the person another way and ask them to give you an address that accepts external mail, or ask their admin to allow you. If you're the recipient's admin, decide whether the address should accept outside mail at all. In Exchange Online, the setting that requires senders to be authenticated, and related delivery management options, control this for groups and mailboxes. Allowing specific external senders is safer than opening the address to everyone.
Likely causes
- The recipient address is set to accept mail only from senders inside its organization.
- A distribution group or mailbox has sender authentication required, for example an internal all-staff list.
- A partner or customer was given an internal-only address by mistake.
How to fix it
If you sent the message
- Don't resend: the same message will be refused again.
- Contact the recipient another way and ask for an address that accepts external mail.
- Forward the full NDR to the recipient's IT team if you need that address opened to you.
If you're the recipient or their admin
- Admins: check the group's or mailbox's setting that requires senders to be authenticated, and its delivery management options.
- Allow specific external senders rather than turning the restriction off for everyone.
Frequently asked questions
Can I fix 5.7.12 from the sending side?
No. Microsoft says only an email administrator in the recipient's organization can change the setting. Your server and authentication are fine; the recipient's address simply refuses outside mail.
What's the difference between 5.7.12 and 5.7.133?
Both mean the recipient only accepts authenticated, usually internal, senders. 5.7.133 is the variant Microsoft uses for groups, while 5.7.12 is described more generally as a sender not authenticated by the organization.
Sources
- Email nondelivery reports (NDRs) and SMTP errors in Exchange Online (Microsoft Learn)
- Create and manage distribution lists in Exchange Online (Microsoft Learn)
Provider messages are quoted as the provider publishes them. Servers can change their wording, so the bounce you received may differ slightly.
Related codes
- 550 5.7.133-136 550 5.7.133 to 5.7.136: sender not authenticated for this recipient
- 550 5.7.124 550 5.7.124: sender not in the group's allowed senders list
- 550 5.7.1 550 5.7.1: delivery not authorized, message refused
- 550 5.7.501-503 5.7.501 to 5.7.503: access denied, spam abuse detected or banned sender
- 550 5.7.510 5.7.510: access denied, recipient domain does not accept email over IPv6
- 550 5.7.512 5.7.512: access denied, message must be RFC 5322 section 3.6.2 compliant
- 550 5.7.703 550 5.7.703: messages blocked by your organization using Tenant Allow Block List
Related guides
How do you restrict who can email a distribution list?
Stop outside spam reaching all@ and staff@ lists: restrict senders on Microsoft 365 distribution groups and Google Groups, and allow trusted partners safely.
8 min read Running email day to dayMicrosoft 365 NDR: why wasn't my message delivered, and how do I fix it?
Read a Microsoft 365 non-delivery report (NDR): who rejected the message, what codes like 5.1.1, 5.7.1 and 5.7.509 mean, and how to fix each bounce.
11 min read Running email day to dayHow do you protect a shared mailbox from spam and phishing?
Protect shared mailboxes such as sales@ and accounts@: name an owner, limit access, decide who reviews held mail, add payment checks and test every address.
9 min read