550 5.7.367: remote server returned not permitted to relay

Microsoft documents 5.7.367 for intermittent failures when Microsoft 365 autoforwards or relays email. When Exchange Online forwards or relays a message on behalf of an external sender, it chooses an outbound delivery pool. To prevent abuse such as spoofing and phishing, it may send the message from a relay pool instead of its standard outbound IP ranges, and it's more likely to do so when email authentication failed when the message entered Microsoft 365.

The relay pool isn't published, isn't part of Microsoft 365's SPF record, and isn't in its outbound IP ranges. Microsoft says destinations don't consider Microsoft 365 the sender of mail from the relay pool, so downstream gateways often block or restrict it, and the result is a "relay denied" error. The symptom Microsoft describes: the message trace shows OutboundIpPoolName RegularRelayOutboundPool, and SPF was fail or softfail when the message arrived.

Microsoft says a forwarded or relayed message avoids the relay pool if the sender is in an accepted domain of the tenant, or if SPF passes when the message enters Microsoft 365. A common reason SPF fails on arrival: your MX points to another filtering service or an on-premises server, so Exchange Online evaluates SPF against that gateway's IP. Microsoft's fix is Enhanced Filtering for Connectors, which lets Exchange Online check SPF against the original sender's IP.