Microsoft Outlook / Hotmail / Live / MSN / Exchange Online error guide

Microsoft Outlook / Hotmail / Live / MSN / Exchange Online SMTP 550 5.7.509: Dmarc Reject

Microsoft Outlook / Hotmail / Live / MSN / Exchange Online SMTP 550 5.7.509 usually means sender authentication. Learn whether to retry, suppress the recipient, or fix sender setup.

Quick summary

Primary code
550 5.7.509
Provider coverage
Microsoft Outlook / Hotmail / Live / MSN / Exchange Online
Primary action
Fix sender setup

How to handle 550 5.7.509

Match the provider, SMTP stage, endpoint, and diagnostic wording first, then use the checks below to decide whether to retry, suppress the recipient, or fix sender setup.

Microsoft mail servers 550 5.7.509

Sender authentication

Fix sender setup

The provider could not verify that the visible sender domain is authorized. SPF, DKIM, and DMARC alignment usually decide whether this clears.

Decision

Do not retry unchanged. Fix the sender setup first.

Confidence: high. Recipient validity: unknown.

Match this reply

SMTP stage
End of DATA
Endpoint
Inbound MX
DMARCpolicy of rejectdoes not pass

Start here

  1. 1

    Verify SPF, DKIM, and DMARC for the visible From domain.

  2. 2

    Make sure SPF or DKIM passes and aligns with DMARC for the provider that rejected the message.

Confirm the cause

  1. Check SPF for the visible From domain and make sure it includes the active sending IP or service.
  2. Check DKIM signing for the message and confirm the signing domain aligns with the visible From domain.
  3. Check DMARC policy and alignment; if policy is quarantine or reject, make SPF or DKIM pass with alignment before retrying.

App handling

  • Treat this as a sender setup incident, not a bad recipient.
  • Hold similar mail for the same sender domain or provider until the fix is verified.
  • Retry after a fresh single-recipient test succeeds.

Avoid

  • Do not retry unchanged in a loop.
  • Do not suppress the recipient unless the text explicitly says the mailbox is invalid.
  • Do not treat a permanent SMTP code as proof that the address is bad; policy and routing failures can also be permanent.
Common causes
  • SPF does not include the active sending IP or service.
  • DKIM is missing, failing, or signing with a domain that does not align.
  • DMARC policy is active, but neither SPF nor DKIM passes with alignment.
Developer details
Fields to log
raw SMTP replyremote MX or hostSMTP stagereply codeenhanced codeprovidermatched rule idrecipientsending domaindecisiontimestampSPF resultDKIM resultDMARC result
Classifier evidence
Specific cause
dmarc reject
Evidence
official
learn.microsoft.com source 1

Not sure this is the right match?

Paste the full SMTP reply into the lookup tool. The classifier uses provider, endpoint, SMTP stage, reply code, enhanced code, token, and diagnostic text.

Open lookup tool