# 550 5.7.520: access denied, your organization does not allow external forwarding

URL: https://iblockspam.com/smtp-errors/550-5-7-520
Last updated: 2026-10-09

Code: 550 5.7.520 (permanent failure, the message bounced)
Provider: Microsoft 365 / Outlook.com

Microsoft 365 blocked a message that a mailbox tried to forward automatically to an address outside the organization, because the outbound spam filter policy doesn't allow automatic external forwarding.

What the bounce says:

```
5.7.520 Access denied, Your organization does not allow external forwarding. Please contact your administrator for further assistance. AS(7555)
```
The NDR text as published in Microsoft's article on controlling external email forwarding.

Microsoft says that when Exchange Online detects a message is being forwarded automatically, and an outbound spam filter policy blocks that activity, the message is returned to the sender in an NDR with this text. Automatic forwarding means one of two things: an Inbox rule that a user set up, or mailbox forwarding (also called SMTP forwarding) that an admin configured. Forwarding between users inside the same organization isn't affected by this policy.

The control is the **Automatic forwarding rules** setting in outbound spam policies. It has three values: "Automatic - System-controlled" (the default), "On - Forwarding is enabled" and "Off - Forwarding is disabled". Microsoft says that in 2021 the default changed to behave like Off for new organizations and for existing ones that weren't actively using it. Because the behavior can differ by organization, Microsoft recommends choosing On or Off explicitly. That's why many tenants block external auto-forwarding even though nobody remembers switching it off.

Who sees the bounce depends on the forwarding method. Microsoft's outbound spam policy documentation says NDRs are generated for messages from external senders for every forwarding method, but for internal senders only when the method is mailbox forwarding. So the 5.7.520 bounce often reaches someone outside the company who simply emailed a person whose mailbox forwards elsewhere.

The block exists for a reason. Microsoft notes that users can set up forwarding rules deliberately or as a result of a compromised account, and forwarding can disclose information to attackers. Check that a forwarding rule is genuine before you allow it.

## Common causes

- The recipient's mailbox has an Inbox rule or mailbox (SMTP) forwarding that sends mail to an outside address.
- The organization's outbound spam policy has automatic forwarding set to Off, or to Automatic - System-controlled, which behaves like Off in many tenants.
- An attacker who took over a mailbox added a rule that forwards mail to an outside address.

## How to fix it (sender)

- If you're an outside sender who got this NDR, your message went to a mailbox that tries to forward it elsewhere, and the forwarded copy was blocked. Contact the recipient another way and share the bounce.
- If you set up the forwarding yourself, ask your email admin. Users can't override the outbound spam policy.

## How to fix it (recipient or admin)

- Find the mailboxes that forward externally with the Auto forwarded messages report in the Exchange admin center.
- Confirm each forwarding rule is legitimate. An unknown rule that forwards to an outside address is a common sign of a compromised account.
- To allow forwarding only for people who need it, create a custom outbound spam policy for those users or a group, set Automatic forwarding rules to "On - Forwarding is enabled", and keep the default policy set to Off.
- To limit destinations, use remote domains to allow automatic forwarding only to chosen domains. Microsoft says that when one setting allows forwarding and another blocks it, the block typically wins.

**Q: Who receives the 5.7.520 bounce: the original sender or the forwarding user?**
Microsoft says the message is returned to the sender. Its outbound spam policy documentation adds that NDRs are generated for external senders with every forwarding method, and for internal senders only when mailbox forwarding is used. An Inbox rule that forwards an internal sender's message produces no NDR.

**Q: Why did external forwarding stop working when nobody changed the policy?**
The default setting, Automatic - System-controlled, changed in 2021 to behave like Off for new organizations and for existing ones that weren't actively using it. Microsoft recommends setting On or Off explicitly so the behavior is predictable.

**Q: Is it safe to turn external auto-forwarding back on for everyone?**
Microsoft describes forwarding as a potential disclosure risk, and attackers add forwarding rules to compromised mailboxes. A narrower approach is a custom outbound spam policy that allows forwarding only for the users who need it, plus remote domain settings that limit where mail can go.

Sources:
- Control external email forwarding and fix 5.7.520 errors (Microsoft Learn): https://learn.microsoft.com/en-us/defender-office-365/outbound-spam-policies-external-email-forwarding
- Configure outbound spam policies (Microsoft Learn): https://learn.microsoft.com/en-us/defender-office-365/outbound-spam-policies-configure
- Email nondelivery reports (NDRs) and SMTP errors in Exchange Online (Microsoft Learn): https://learn.microsoft.com/en-us/troubleshoot/exchange/email-delivery/ndr/non-delivery-reports-in-exchange-online

---

Source: iBlockSpam, https://iblockspam.com/smtp-errors/550-5-7-520 (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt