# 550 5.7.367: remote server returned not permitted to relay URL: https://iblockspam.com/smtp-errors/550-5-7-367 Last updated: 2026-10-22 Code: 550 5.7.367 (permanent failure, the message bounced) Provider: Microsoft 365 / Outlook.com Microsoft 365 forwarded or relayed a message through its relay pool because the message failed authentication on arrival, and the downstream mail gateway refused to relay it. What the bounce says: ``` 550 5.7.367 Remote server returned not permitted to relay -> 554 5.7.1 Relaying denied ``` Example NDR text from Microsoft's article on 5.7.367 relay pool issues. Microsoft documents 5.7.367 for intermittent failures when Microsoft 365 autoforwards or relays email. When Exchange Online forwards or relays a message on behalf of an external sender, it chooses an outbound delivery pool. To prevent abuse such as spoofing and phishing, it may send the message from a relay pool instead of its standard outbound IP ranges, and it's more likely to do so when email authentication failed when the message entered Microsoft 365. The relay pool isn't published, isn't part of Microsoft 365's SPF record, and isn't in its outbound IP ranges. Microsoft says destinations don't consider Microsoft 365 the sender of mail from the relay pool, so downstream gateways often block or restrict it, and the result is a "relay denied" error. The symptom Microsoft describes: the message trace shows OutboundIpPoolName RegularRelayOutboundPool, and SPF was fail or softfail when the message arrived. Microsoft says a forwarded or relayed message avoids the relay pool if the sender is in an accepted domain of the tenant, or if SPF passes when the message enters Microsoft 365. A common reason SPF fails on arrival: your MX points to another filtering service or an on-premises server, so Exchange Online evaluates SPF against that gateway's IP. Microsoft's fix is Enhanced Filtering for Connectors, which lets Exchange Online check SPF against the original sender's IP. ## Common causes - Mail is forwarded or relayed through Microsoft 365 for an external sender, and SPF failed or soft-failed on arrival. - The domain's MX points to a separate gateway or on-premises server, and Enhanced Filtering for Connectors isn't configured. - Multiple hops and autoforwarding chains break authentication. - The downstream gateway only accepts relay from Microsoft 365's published ranges. ## How to fix it (sender) - If the MX record points to another service or server, turn on Enhanced Filtering for Connectors on the inbound connector. - If the original sender's domain is yours, add it as an accepted domain in Microsoft 365. - Avoid multi-hop relay and autoforwarding chains where you can. - Check the message trace for OutboundIpPoolName to confirm the relay pool was used. ## How to fix it (recipient or admin) - If you run the downstream gateway, review why it denies relay from the connecting IP before allowing it. **Q: What is the Microsoft 365 relay pool behind 5.7.367?** A set of IP addresses Exchange Online can use to forward or relay messages that failed authentication on arrival. Microsoft doesn't publish it and it isn't in Microsoft 365's SPF record, so downstream gateways often refuse mail from it. **Q: Why does a filtering service in front of Microsoft 365 lead to 5.7.367?** Without Enhanced Filtering for Connectors, Exchange Online checks SPF against the filtering service's IP, so SPF fails. Forwarded copies of those messages can then go out through the relay pool. Microsoft recommends enabling Enhanced Filtering on the inbound connector. Sources: - 5.7.367 Microsoft 365 relay pool issues in downstream gateways (Microsoft Learn): https://learn.microsoft.com/en-us/troubleshoot/exchange/email-delivery/ndr/forwarded-message-rejected-5-7-367-ndr - Enhanced Filtering for Connectors in Exchange Online (Microsoft Learn): https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/use-connectors-to-configure-mail-flow/enhanced-filtering-for-connectors - Email nondelivery reports (NDRs) and SMTP errors in Exchange Online (Microsoft Learn): https://learn.microsoft.com/en-us/troubleshoot/exchange/email-delivery/ndr/non-delivery-reports-in-exchange-online --- Source: iBlockSpam, https://iblockspam.com/smtp-errors/550-5-7-367 (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt