5.7.510: access denied, recipient domain does not accept email over IPv6
Your server delivered the message to Microsoft 365 over IPv6, but the recipient's domain doesn't accept email over IPv6. Sending the message over IPv4 fixes it.
Access denied, [contoso.com] does not accept email over IPv6
Microsoft's text for 5.7.510 in its Exchange Online NDR reference, where contoso.com stands for the recipient's domain.
What 550 5.7.510 means
Microsoft's NDR reference lists 5.7.510 "Access denied, [contoso.com] does not accept email over IPv6": the sender tried to send to the recipient over IPv6, but the recipient doesn't accept email messages over IPv6. Microsoft's mail flow documentation explains why: Microsoft 365 supports receiving anonymous inbound email over IPv6, but it might not be enabled in the recipient's organization. It shows the same refusal in another form, "550 5.2.1 Service unavailable, [contoso.com] does not accept email over IPv6".
The sender sees this when their server has IPv6 connectivity and prefers it. Many mail servers try IPv6 first whenever the destination publishes an IPv6 address. Mail to other Microsoft 365 domains may work while mail to this one fails, which makes the problem look random.
The fix is on the sending server. Configure it to deliver over IPv4, either everywhere or for this destination. Postfix, for example, has a setting that controls which IP protocols it uses for outbound connections. If you do send over IPv6, Microsoft's requirements for domains that accept it are a valid PTR record for the sending IPv6 address and a pass for SPF or DKIM; otherwise you get 450 4.7.25 or 450 4.7.26 instead.
Likely causes
- Your mail server prefers IPv6 when the destination publishes an IPv6 address.
- The recipient's Microsoft 365 domain only accepts inbound mail over IPv4.
- A recent network change gave your mail server IPv6 connectivity.
How to fix it
If you sent the message
- Configure your mail server to use IPv4 for outbound delivery, at least for this destination.
- Resend the message once the server delivers over IPv4.
- If you keep IPv6 for other destinations, give each IPv6 sending address a PTR record and authenticate your mail.
If you're the recipient or their admin
- Admins who want to receive mail over IPv6 can opt in to anonymous inbound IPv6 support by opening a Microsoft support request, as Microsoft describes.
Frequently asked questions
Why do only some Microsoft 365 recipients return 5.7.510?
Microsoft says inbound email over IPv6 might not be enabled in every Microsoft 365 organization. Organizations that have it take your IPv6 mail; those that don't refuse it, so the error depends on the recipient.
Should I turn off IPv6 on my mail server to stop 5.7.510?
You don't have to turn it off for the whole server, but outbound mail must reach these domains over IPv4. Many admins send all outbound mail over IPv4, which also avoids stricter IPv6 checks at other receivers.
Sources
- Email nondelivery reports (NDRs) and SMTP errors in Exchange Online (Microsoft Learn)
- Mail flow in EOP: support for anonymous inbound email over IPv6 (Microsoft Learn)
Provider messages are quoted as the provider publishes them. Servers can change their wording, so the bounce you received may differ slightly.
Related codes
- 550 5.7.25 550 5.7.25: reverse DNS validation failed
- 550 5.7.1 550 5.7.1: delivery not authorized, message refused
- 550 5.7.509 5.7.509 Access denied: sending domain does not pass DMARC
- 550 5.7.501-503 5.7.501 to 5.7.503: access denied, spam abuse detected or banned sender
- 550 5.7.512 5.7.512: access denied, message must be RFC 5322 section 3.6.2 compliant
- 550 5.7.12 5.7.12: sender was not authenticated by organization
- 550 5.7.236 550 5.7.236: daily limit for external mail from onmicrosoft.com domains
- 550 5.7.506 5.7.506: access denied, bad HELO
Related guides
IPv6 email deliverability: what you need before sending over IPv6
Sending mail over IPv6? What Gmail and Microsoft require, why IPv6 gets less benefit of the doubt, SPF ip6 syntax, IPv6 PTR checks and forcing IPv4 in Postfix.
9 min read Running email day to dayReverse DNS and PTR records for mail servers
What a PTR record is, why Gmail, Yahoo and others require forward-confirmed reverse DNS for sending IPs, who can set it, and how to check yours is right.
8 min read Email security basicsWhat is a mail transfer agent (MTA)?
What a mail transfer agent does, how it differs from the MUA, MSA and MDA, how MTAs queue, retry and relay mail, and where spam filtering sits in the path.
9 min read