Microsoft 365 5.7.509
Access denied, sending domain [$SenderDomain] does not pass DMARC verification and has a DMARC policy of reject
Microsoft 365 5.7.509 means: access denied, sending domain [$SenderDomain] does not pass DMARC verification and has a DMARC policy of reject. It is a permanent failure, so do not retry it unchanged. The fix is in the sending or receiving configuration named above, not in the list. Fix that, then resend.
Microsoft 365’s exact wording
Quoted from Microsoft Learn: Email non-delivery reports and SMTP errors in Exchange Online, checked 2026-11-05. Placeholders are Microsoft 365’s own.
Provider's description
Access denied, sending domain [$SenderDomain] does not pass DMARC verification and has a DMARC policy of reject.
Possible cause
The sender's domain in the 5322.From address doesn't pass DMARC.
Provider's advice
. A user also receives this bounce message because it failed DMARC, and the DMARC policy is set to reject all failures. The user should contact their email administrator for more help.
| Who sends it | Microsoft 365, Exchange Online and Outlook.com |
|---|---|
| Basic code | Microsoft 365 lists the enhanced code only |
| Enhanced code | 5.7.509: Microsoft 365-specific, not in the IANA registry. Its subject digit puts it under 5.7.0 other or undefined security status. |
| Permanent or temporary | Permanent (5xx) |
| Verifying the list prevents it | No |
In practice
550 5.7.509 means the message failed DMARC for the From domain and that domain publishes p=reject, so Microsoft rejects it as the domain owner asked. If the From domain is yours, a sending service is using your domain without aligned SPF or DKIM. If it is not yours, you are sending as someone else's domain, which DMARC is designed to stop. Check DMARC reports for the domain to see which sources fail. Senders who use a third-party platform without custom DKIM are the most common case, because the platform signs with its own domain and SPF covers only its return-path.
What the sender should do
The fix is in the sending or receiving configuration named above, not in the list. Fix that, then resend.
Would verifying the list have prevented Microsoft 365 5.7.509?
No
This reply is about your sending setup, the message or the receiving system, not about whether the address exists, so verifying the list will not prevent it.
Common questions
- What does Microsoft 365 5.7.509 mean?
- Microsoft 365 5.7.509 means: access denied, sending domain [$SenderDomain] does not pass DMARC verification and has a DMARC policy of reject. It is a permanent failure, so do not retry it unchanged. The fix is in the sending or receiving configuration named above, not in the list. Fix that, then resend.
- Should I retry after Microsoft 365 5.7.509?
- No. It is a permanent (5xx) failure, so the same message to the same address will fail again. Fix the cause first. The fix is in the sending or receiving configuration named above, not in the list. Fix that, then resend.
- Would verifying my list have prevented Microsoft 365 5.7.509?
- No. This reply is about your sending setup, the message or the receiving system, not about whether the address exists, so verifying the list will not prevent it.
Sources
- Microsoft Learn: Email non-delivery reports and SMTP errors in Exchange Online (checked 2026-11-05)
Registry and provider wording is quoted exactly; guidance is written by the SimpleVerifier Team.
SimpleVerifier Team · Last checked against the sources 2026-11-05