550 5.7.57: client was not authenticated to send anonymous mail
An application or device tried to send through Microsoft 365's smtp.office365.com without authenticating with a valid mailbox's credentials.
Client was not authenticated to send anonymous mail during MAIL FROM
Microsoft's description for 5.7.57 in its Exchange Online NDR reference.
What 550 5.7.57 means
Microsoft explains that when you connect to the smtp.office365.com endpoint to submit (relay) messages through Microsoft 365, you need to authenticate with the credentials of a user who has an Exchange Online mailbox. A 5.7.57 bounce means there's a problem in the configuration of the connecting application or device.
Microsoft's fix has two checks: verify that the credentials in the application or device are correct, and verify that the application or device can negotiate TLS, because TLS is required in order to authenticate. Microsoft adds that the line between end user and admin is blurred for this error, because the problem lies in the device's configuration.
This typically hits scanners, printers, line-of-business apps and website contact forms. Microsoft's guide for devices says client SMTP submission needs TLS 1.2 or later. A device that can't do that won't be able to authenticate; for those, Microsoft documents other options, such as relaying through a connector.
Likely causes
- The device or app has no username and password set, or they're wrong.
- TLS is turned off, or the device can't negotiate a TLS version Microsoft 365 accepts.
- The account used has no Exchange Online mailbox.
How to fix it
If you sent the message
- Check the server (smtp.office365.com), port, username and password in the device's email settings.
- Turn on TLS/STARTTLS in the device; update its firmware if it can't negotiate TLS.
- Use an account that has an Exchange Online mailbox.
If you're the recipient or their admin
- No action needed: the failure happens before the message leaves the sender.
Frequently asked questions
Why does my scanner get 5.7.57 when the password is right?
Microsoft requires TLS before authentication. If the scanner can't negotiate TLS, or TLS is off in its settings, sign-in fails even with the right password.
Does the sending account need a license?
Microsoft says you must authenticate with the credentials of a user who has an Exchange Online mailbox.
Sources
- Fix NDR error "550 5.7.57" in Exchange Online (Microsoft Learn)
- How to set up a multifunction device or application to send email using Microsoft 365 (Microsoft Learn)
- Email nondelivery reports (NDRs) and SMTP errors in Exchange Online (Microsoft Learn)
Provider messages are quoted as the provider publishes them. Servers can change their wording, so the bounce you received may differ slightly.
Related codes
Related guides
Is my email encrypted in transit? STARTTLS, MTA-STS and DANE explained
What STARTTLS does for email, why opportunistic TLS can be downgraded, how MTA-STS and DANE enforce it, what Gmail's lock icons mean, and where TLS stops.
9 min read SPF, DKIM & DMARCSPF record syntax and examples
SPF record syntax explained: mechanisms, qualifiers and modifiers, with copy-ready examples for Microsoft 365, Google Workspace, subdomains and parked domains.
9 min read Setup guidesHow to use an external spam filter with Microsoft 365 and Enhanced Filtering for Connectors
How to run an MX-level spam filter in front of Exchange Online: Partner connector, Enhanced Filtering for Connectors, why not SCL -1, headers and rollback.
10 min read Phishing & threatsMicrosoft 365 user restricted from sending (550 5.1.8): how do you investigate and unblock it?
Fix 550 5.1.8 Access denied, bad outbound sender: why Microsoft 365 restricts users, how to check for compromise, unblock on Restricted entities, prevent it.
9 min read Phishing & threatsSigns your business email account has been compromised, and what to do
The warning signs of a hacked business mailbox, from hidden inbox rules to MFA prompts, and the step-by-step response for Microsoft 365 and Google Workspace.
10 min read