Microsoft 365 5.7.520
Access denied, Your organization does not allow external forwarding
Microsoft 365 5.7.520 means: access denied, Your organization does not allow external forwarding. It is a permanent failure, so do not retry it unchanged. The fix is in the sending or receiving configuration named above, not in the list. Fix that, then resend.
Microsoft 365’s exact wording
Quoted from Microsoft Learn: Email non-delivery reports and SMTP errors in Exchange Online, checked 2026-11-05. Placeholders are Microsoft 365’s own.
Provider's description
Access denied, Your organization does not allow external forwarding. Please contact your administrator for further assistance. AS(7555)
Possible cause
When Exchange Online detects that a message is forwarded automatically, and an outbound spam filter policy blocks the forwarding activity, the message is restricted and this NDR is sent to the sender.
| Who sends it | Microsoft 365, Exchange Online and Outlook.com |
|---|---|
| Basic code | Microsoft 365 lists the enhanced code only |
| Enhanced code | 5.7.520: Microsoft 365-specific, not in the IANA registry. Its subject digit puts it under 5.7.0 other or undefined security status. |
| Permanent or temporary | Permanent (5xx) |
| Verifying the list prevents it | No |
In practice
550 5.7.520 means Exchange Online detected an automatically forwarded message and the outbound spam filter policy blocks external forwarding, which is Microsoft's default. Users who set up forwarding to a personal address see it. An administrator can allow forwarding for specific users in the outbound spam policy. The message never left Microsoft 365. Users can still forward manually; only automatic forwarding is blocked. If the forwarding was set up by an attacker, as often happens after a phishing compromise, remove the rule instead of allowing it.
What the sender should do
The fix is in the sending or receiving configuration named above, not in the list. Fix that, then resend.
Would verifying the list have prevented Microsoft 365 5.7.520?
No
This reply is about your sending setup, the message or the receiving system, not about whether the address exists, so verifying the list will not prevent it.
Common questions
- What does Microsoft 365 5.7.520 mean?
- Microsoft 365 5.7.520 means: access denied, Your organization does not allow external forwarding. It is a permanent failure, so do not retry it unchanged. The fix is in the sending or receiving configuration named above, not in the list. Fix that, then resend.
- Should I retry after Microsoft 365 5.7.520?
- No. It is a permanent (5xx) failure, so the same message to the same address will fail again. Fix the cause first. The fix is in the sending or receiving configuration named above, not in the list. Fix that, then resend.
- Would verifying my list have prevented Microsoft 365 5.7.520?
- No. This reply is about your sending setup, the message or the receiving system, not about whether the address exists, so verifying the list will not prevent it.
Sources
- Microsoft Learn: Email non-delivery reports and SMTP errors in Exchange Online (checked 2026-11-05)
Registry and provider wording is quoted exactly; guidance is written by the SimpleVerifier Team.
SimpleVerifier Team · Last checked against the sources 2026-11-05