550 5.7.520: access denied, your organization does not allow external forwarding
Microsoft 365 blocked a message that a mailbox tried to forward automatically to an address outside the organization, because the outbound spam filter policy doesn't allow automatic external forwarding.
5.7.520 Access denied, Your organization does not allow external forwarding. Please contact your administrator for further assistance. AS(7555)
The NDR text as published in Microsoft's article on controlling external email forwarding.
What 550 5.7.520 means
Microsoft says that when Exchange Online detects a message is being forwarded automatically, and an outbound spam filter policy blocks that activity, the message is returned to the sender in an NDR with this text. Automatic forwarding means one of two things: an Inbox rule that a user set up, or mailbox forwarding (also called SMTP forwarding) that an admin configured. Forwarding between users inside the same organization isn't affected by this policy.
The control is the Automatic forwarding rules setting in outbound spam policies. It has three values: "Automatic - System-controlled" (the default), "On - Forwarding is enabled" and "Off - Forwarding is disabled". Microsoft says that in 2021 the default changed to behave like Off for new organizations and for existing ones that weren't actively using it. Because the behavior can differ by organization, Microsoft recommends choosing On or Off explicitly. That's why many tenants block external auto-forwarding even though nobody remembers switching it off.
Who sees the bounce depends on the forwarding method. Microsoft's outbound spam policy documentation says NDRs are generated for messages from external senders for every forwarding method, but for internal senders only when the method is mailbox forwarding. So the 5.7.520 bounce often reaches someone outside the company who simply emailed a person whose mailbox forwards elsewhere.
The block exists for a reason. Microsoft notes that users can set up forwarding rules deliberately or as a result of a compromised account, and forwarding can disclose information to attackers. Check that a forwarding rule is genuine before you allow it.
Likely causes
- The recipient's mailbox has an Inbox rule or mailbox (SMTP) forwarding that sends mail to an outside address.
- The organization's outbound spam policy has automatic forwarding set to Off, or to Automatic - System-controlled, which behaves like Off in many tenants.
- An attacker who took over a mailbox added a rule that forwards mail to an outside address.
How to fix it
If you sent the message
- If you're an outside sender who got this NDR, your message went to a mailbox that tries to forward it elsewhere, and the forwarded copy was blocked. Contact the recipient another way and share the bounce.
- If you set up the forwarding yourself, ask your email admin. Users can't override the outbound spam policy.
If you're the recipient or their admin
- Find the mailboxes that forward externally with the Auto forwarded messages report in the Exchange admin center.
- Confirm each forwarding rule is legitimate. An unknown rule that forwards to an outside address is a common sign of a compromised account.
- To allow forwarding only for people who need it, create a custom outbound spam policy for those users or a group, set Automatic forwarding rules to "On - Forwarding is enabled", and keep the default policy set to Off.
- To limit destinations, use remote domains to allow automatic forwarding only to chosen domains. Microsoft says that when one setting allows forwarding and another blocks it, the block typically wins.
Frequently asked questions
Who receives the 5.7.520 bounce: the original sender or the forwarding user?
Microsoft says the message is returned to the sender. Its outbound spam policy documentation adds that NDRs are generated for external senders with every forwarding method, and for internal senders only when mailbox forwarding is used. An Inbox rule that forwards an internal sender's message produces no NDR.
Why did external forwarding stop working when nobody changed the policy?
The default setting, Automatic - System-controlled, changed in 2021 to behave like Off for new organizations and for existing ones that weren't actively using it. Microsoft recommends setting On or Off explicitly so the behavior is predictable.
Is it safe to turn external auto-forwarding back on for everyone?
Microsoft describes forwarding as a potential disclosure risk, and attackers add forwarding rules to compromised mailboxes. A narrower approach is a custom outbound spam policy that allows forwarding only for the users who need it, plus remote domain settings that limit where mail can go.
Sources
- Control external email forwarding and fix 5.7.520 errors (Microsoft Learn)
- Configure outbound spam policies (Microsoft Learn)
- Email nondelivery reports (NDRs) and SMTP errors in Exchange Online (Microsoft Learn)
Provider messages are quoted as the provider publishes them. Servers can change their wording, so the bounce you received may differ slightly.
Related codes
Related guides
Why email forwarding breaks SPF and DMARC, and how ARC helps
Why forwarding and mailing lists break SPF and sometimes DKIM, how that fails DMARC, and how SRS, ARC and trusted ARC sealers in Microsoft 365 help fix it.
9 min read Phishing & threatsSigns your business email account has been compromised, and what to do
The warning signs of a hacked business mailbox, from hidden inbox rules to MFA prompts, and the step-by-step response for Microsoft 365 and Google Workspace.
10 min read Phishing & threatsHow to prevent business email compromise (BEC)
What business email compromise is, what the FBI's 2025 IC3 figures show, and the payment checks and technical controls that stop BEC fraud at small firms.
9 min read