Permanent failure — do not retry
SMTP 550 5.7.509
DMARC failed, policy reject (Microsoft 365)
SMTP 550 5.7.509 means Microsoft 365 rejected the message because the domain in its From header failed DMARC, and that domain publishes p=reject. The text reads "Access denied, sending domain does not pass DMARC verification and has a DMARC policy of reject." The fix is your domain's authentication.
How it appears
550 5.7.509 Access denied, sending domain example.com does not pass DMARC verification and has a DMARC policy of reject.
What causes it
- SPF and DKIM both failed, or neither aligned with the From domain.
- A third-party tool sends as your domain without DKIM signing.
- Someone is spoofing your domain, and the rejection is working as intended.
How to fix it
In order — try the first one first.
- Find which service sent the failing message and set up aligned DKIM for it.
- Make sure the SPF domain or the DKIM signing domain matches the From domain.
- Read your DMARC aggregate reports to find every source sending as your domain.
- If the message was not yours, nothing needs fixing. DMARC stopped a spoof.
Common questions
- What does SMTP 550 5.7.509 mean?
- SMTP 550 5.7.509 means Microsoft 365 rejected the message because the domain in its From header failed DMARC, and that domain publishes p=reject. The text reads "Access denied, sending domain does not pass DMARC verification and has a DMARC policy of reject." The fix is your domain's authentication.
- Should I retry a 550 5.7.509 error?
- No. 550 is a permanent failure, so the message will never be delivered no matter how many times you try. Remove the address — repeated sends to permanent failures are one of the main signals mailbox providers use to throttle a sender.
- How do I fix SMTP 550 5.7.509?
- Find which service sent the failing message and set up aligned DKIM for it.
Other 550 replies
- 550 5.1.1 — mailbox does not exist
- 550 5.7.1 — message refused by policy
- 550 5.4.1 — recipient address rejected, access denied
- 550 5.2.1 — mailbox disabled, not accepting messages
- 550 — mailbox unavailable
- 550 5.1.0 — address rejected, other address status
- 550 5.1.10 — recipient not found (Microsoft 365)
- 550 5.1.8 — bad outbound sender (Microsoft 365)
- 550 5.4.5 — daily sending limit exceeded (Gmail)
- 550 4.4.7 — message expired in the queue
- 550 5.7.25 — no PTR record for sending IP (Gmail)
- 550 5.7.26 — blocked, sender unauthenticated (Gmail)
- 550 5.7.27 — SPF authentication failed (Gmail)
- 550 5.7.28 — unusual rate of unsolicited mail (Gmail)
- 550 5.7.23 — SPF violation (Microsoft 365)
- 550 5.7.124 — sender not in allowed senders list (Microsoft 365)
- 550 5.7.606-649 — banned sending IP (Microsoft)
- 550 5.7.705 — tenant has exceeded threshold (Microsoft 365)
- 550 5.7.708 — traffic not accepted from this IP (Microsoft 365)
- 550 5.7.750 — blocked from sending from unregistered domains (Microsoft 365)
- 550 5.7.515 — authentication required for high-volume senders (Outlook.com)
- 550 5.7.1 S3140 — IP range on Outlook.com block list
Last reviewed 2026-09-11