# 550 5.7.515: sending domain does not meet the required authentication level URL: https://iblockspam.com/smtp-errors/550-5-7-515 Last updated: 2026-10-09 Code: 550 5.7.515 (permanent failure, the message bounced) Provider: Microsoft 365 / Outlook.com Outlook.com rejected your message because your From domain sends high volumes to Microsoft consumer mailboxes and didn't meet Microsoft's SPF, DKIM and DMARC requirements. What the bounce says: ``` 550 5.7.515 Access denied, sending domain does not meet the required authentication level. The sender's domain in the 5322.From address doesn't meet the authentication requirements defined for the sender. ``` The full error as given in Microsoft's article on 550 5.7.515 in Outlook.com. Microsoft announced new requirements for high-volume senders to Outlook.com on April 2, 2025. They apply to its consumer service, which covers hotmail.com, live.com and outlook.com addresses (Microsoft's support article also names MSN). An update on April 29, 2025 said messages that don't meet the requirements would be rejected with 5.7.515, starting May 5, 2025. This is a consumer Outlook.com rule, separate from how Microsoft 365 business tenants filter mail. Microsoft's announcement defines high-volume senders as domains sending more than 5,000 emails per day; its support article puts it as 5,000 or more messages to Microsoft consumer email services, all using the same domain in the 5322.From address (the From address people see). Once you reach that threshold, Microsoft expects every message from the domain to meet three requirements. SPF and DKIM records must be published, and both checks must pass. A DMARC record must be published, at least p=none. And messages must pass DMARC, which means SPF or DKIM (at least one) must align with the From domain. The usual culprit is a service sending as your domain without authenticating as your domain: an email marketing platform or app that uses its own bounce domain and its own DKIM signature. SPF can pass for the service's domain and still not align with yours. Microsoft's fix is to check the message header for the SPF, DKIM and DMARC results, then make each sending service use your domain in the envelope (return-path) address, sign with your DKIM key, and appear in your SPF record. Microsoft also says adding the sender to a recipient's Safe Senders list won't bypass the check. ## Common causes - DKIM is missing or fails, or the message is signed only with the sending service's own domain. - SPF fails, or passes only for a bounce domain that doesn't align with your From domain. - The From domain has no DMARC record. - A third-party sending service isn't set up to authenticate as your domain. ## How to fix it (sender) - Open a bounced or delivered message's header and read the SPF, DKIM and DMARC results in the Authentication-Results field. - Publish a DMARC record at _dmarc.; Microsoft's minimum example is v=DMARC1; p=none. - Turn on DKIM signing with your own domain in every service that sends as you. - Add each service to your SPF record, and use a custom return-path domain where the service offers one so SPF aligns. - Send a test to an Outlook.com address and confirm SPF, DKIM and DMARC all pass before resuming bulk sends. ## How to fix it (recipient or admin) - There's nothing a recipient can change: Microsoft says Safe Senders isn't honored for this check. Let the sender know so they can fix their authentication. **Q: Does 5.7.515 apply if I send fewer than 5,000 messages a day?** Microsoft's announcement says the requirements target domains sending more than 5,000 emails per day to its consumer email services. Microsoft says all senders benefit from SPF, DKIM and DMARC anyway, because strong authentication protects your reputation. **Q: Do I need DMARC set to reject to avoid 5.7.515?** No. Microsoft's minimum is a published DMARC record with p=none, as long as messages pass DMARC through aligned SPF or DKIM. Microsoft recommends moving gradually toward p=reject once all your legitimate sources are aligned. **Q: Can the recipient add me to Safe Senders to get around 5.7.515?** No. Microsoft says the Safe Senders list won't be honored for this enforcement. The fix has to happen in your domain's DNS records and your sending services. Sources: - Fix NDR error "550 5.7.515" in Outlook.com (Microsoft Support): https://support.microsoft.com/en-us/outlook/fix-ndr-error-550-5-7-515-in-outlook-com - Strengthening Email Ecosystem: Outlook's New Requirements for High-Volume Senders (Microsoft Tech Community): https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/strengthening-email-ecosystem-outlook%E2%80%99s-new-requirements-for-high%E2%80%90volume-senders/4399730 - Set up DMARC to validate email in Microsoft 365 (Microsoft Learn): https://learn.microsoft.com/en-us/defender-office-365/email-authentication-dmarc-configure - Anti-spam message headers (Microsoft Learn): https://learn.microsoft.com/en-us/defender-office-365/message-headers-eop-mdo --- Source: iBlockSpam, https://iblockspam.com/smtp-errors/550-5-7-515 (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt