Microsoft 550 5.7.124 "Sender Not in Allowed-Senders List": You Mailed a Restricted Group
550 5.7.124 means you sent to a Microsoft 365 distribution group that only accepts mail from people on its allowed-senders list, and you aren't on it. Nothing on your side fixes that. For cold or marketing email, suppress the address. If it's a real contact who needs your mail, ask for a personal address or ask them to have their admin allow you.
Source: Microsoft Learn, Fix NDR error 5.7.124 in Exchange Online (updated 10 August 2026) and the Exchange Online NDR table, read 3 November 2026.
What Microsoft says
- The NDR appears "when the sender isn't specified in the group's allowed senders list (directly or as a member of a group)".
- "Depending how the group is configured, even the group's owner might need to be in the group's allowed senders list."
- Senders inside the organisation can try joining the group. Outside senders have to ask the group owner to add them.
- To add an outside sender, the admin must first create a mail contact or mail user to represent them.
- Groups with more than 5,000 members automatically restrict senders to members and send messages to a moderator for approval.
The code page for 550 5.7.124 lists it alongside the other Microsoft codes.
Why lists hit it
Distribution groups often look like ordinary role addresses: sales@, info@, team@, allstaff@, a department name. They get onto lists through website scraping, old CRM records and data vendors. Admins lock them to internal senders precisely to keep out the mail you're sending. Our post on role-based email addresses covers why these are poor targets anyway.
It's a close cousin of recipients who only accept internal mail (the mailbox-level version of the same idea) and different from 5.1.10 recipient not found, where the address doesn't exist.
What to do
- Confirm the code. Look for "5.7.124" and "allowed-senders" in the bounce; the bounce message analyzer reads it for you.
- Marketing or cold list: suppress it. Add it to your suppression list in every tool that sends.
- Real relationship: change the address. Ask your contact for their own mailbox, or forward them the bounce so their admin can add you. On Microsoft's side, that's Delivery management in the Exchange admin center, with you created as a mail contact first.
- Look for siblings. If one group address on a domain is restricted, other role addresses at the same company often are. Filter them with the role-based email filter before the next send.
Limits
A verifier can't see a group's sender restrictions. The check asks whether the address exists, and a group address does, so it can come back valid or accept-all. That's why role addresses on Microsoft 365 domains deserve a separate decision before sending, whatever the verification result. Use the Microsoft 365 email checker to see which of your domains are on Microsoft.
Where SimpleVerifier fits
Verification returns the mailbox result and flags role addresses separately, so you can decide on sales@ and team@ before they bounce, and checks the person-addresses properly. Upload the list at /verify; the first 100 checks are free with a Google sign-in. Pro is $39 a month with the first 100,000 checks a month at full speed, then slower, never cut off. See pricing.
Common questions
What does 550 5.7.124 mean?
Microsoft's description is "Sender not in allowed-senders list": you don't have permission to send to that distribution group because you aren't on its allowed senders list.
How do I fix 550 5.7.124?
As an outside sender, you can't. The group's owner or admin would have to add you, which for an external sender means first creating a mail contact or mail user for you, or open the group to people inside and outside the organisation.
Should I remove an address that returns 5.7.124?
For marketing and cold email, yes. The group is set up to refuse outside mail; resending just adds failures to your bounce rate.
Why did the address pass verification?
Because the group exists. Many servers accept the address during the check and apply the sender restriction later, or apply it differently to different senders.
Check your list before you send
Real mailbox checks over SMTP, and nothing is sent to the address. Sign in with Google and your first 100 email checks are free, no card. Plans for bigger lists are on the pricing page.