5.7.512: access denied, message must be RFC 5322 section 3.6.2 compliant
Microsoft 365 rejected the message because it was sent without a valid email address in the From header, which RFC 5322 section 3.6.2 requires.
Access denied, message must be RFC 5322 section 3.6.2 compliant
Microsoft's text for 5.7.512, as listed in its Exchange Online NDR reference.
What 550 5.7.512 means
Microsoft's NDR reference lists 5.7.512 "Access denied, message must be RFC 5322 section 3.6.2 compliant": the message was sent without a valid From email address. Microsoft notes it applies to Office 365 only, that each message must contain a valid email address in the From header field, and that proper formatting includes angle brackets around the address, for example security@contoso.com. Without an address in that format, Microsoft 365 rejects the message.
RFC 5322 section 3.6.2 defines the originator fields, From, Sender and Reply-To. The From field names the author of the message. A display name on its own, an address with no domain, or a From header that's missing entirely all fail the check.
The usual sources are homemade scripts, website forms, monitoring tools and old devices that build headers themselves. A common pattern is a From value such as "Website" or "root" with no address at all. Set a full sender address in the application, or send through a mail library that formats the header for you, then send a test.
Likely causes
- The From header is missing from the message.
- From contains only a display name, or an address without a domain.
- A script or device formats the From address incorrectly.
- An app builds raw headers instead of using a mail library.
How to fix it
If you sent the message
- Set a complete From address in the application, form or device, such as Website <noreply@yourdomain.com>.
- Use a maintained mail library or SMTP plugin that formats headers for you.
- Send a test to a Microsoft 365 mailbox and check the From header in the received message.
If you're the recipient or their admin
- No action needed by recipients: the sending system must include a valid From address.
Frequently asked questions
What does 'RFC 5322 section 3.6.2 compliant' mean in a Microsoft 365 bounce?
Section 3.6.2 of RFC 5322 defines the From header. Microsoft requires every message to include a valid email address in From, formatted with angle brackets, for example security@contoso.com.
Why does my scanner or script get 5.7.512 from Microsoft 365?
It is probably sending a From value without a real address, such as just a device name. Set a full sender address in the device or script settings, then send a test.
Sources
- Email nondelivery reports (NDRs) and SMTP errors in Exchange Online (Microsoft Learn)
- RFC 5322, section 3.6.2: Originator fields
Provider messages are quoted as the provider publishes them. Servers can change their wording, so the bounce you received may differ slightly.
Related codes
- 550 5.1.20 550 5.1.20: multiple From addresses are not allowed without Sender address
- 550 5.7.1 Gmail 550 5.7.1: message is not RFC 5322 compliant
- 553 5.1.7 553 5.1.7: the sender address is not a valid RFC 5321 address
- 550 5.7.510 5.7.510: access denied, recipient domain does not accept email over IPv6
- 550 5.7.501-503 5.7.501 to 5.7.503: access denied, spam abuse detected or banned sender
- 550 5.7.506 5.7.506: access denied, bad HELO
- 550 5.7.236 550 5.7.236: daily limit for external mail from onmicrosoft.com domains
Related guides
Why are my website form emails going to spam?
Why WordPress and contact form emails land in spam or vanish: PHP mail(), the From address, SPF and DKIM for the sender, and switching to authenticated SMTP.
9 min read Running email day to dayHow do you set up WordPress SMTP with SPF and DKIM?
Send WordPress email through authenticated SMTP: Microsoft 365, Google and host settings, a no-plugin code option, and the SPF, DKIM and DMARC records to add.
10 min read Setup guidesHow do you set up scan to email and app SMTP with Microsoft 365?
Set up a printer, scanner or app to send through Microsoft 365: SMTP AUTH on port 587, a relay connector, Direct Send or HVE, and the Basic auth retirement.
11 min read Running email day to dayHow to read email headers
Read email headers step by step: the Received chain from the bottom up, Authentication-Results, ARC, Return-Path, Message-ID and Microsoft 365 anti-spam fields.
10 min read