550 5.7.509: Message failed DMARC with a reject policy

Microsoft 365SMTP

The error usually looks like this:

550 5.7.509 Access denied, sending domain example.com does not pass DMARC verification and has a DMARC policy of reject.

What it means

The message failed DMARC authentication, and the sending domain’s DMARC policy tells receivers to reject such messages.

Common causes

  • The sending server isn’t included in the domain’s SPF record and the message isn’t DKIM-signed by the domain.
  • The message was forwarded or modified in a way that broke SPF and DKIM.

How to fix it

  1. Add the sending service to your SPF record and enable DKIM signing for your domain.
  2. Check your domain’s records with our SPF, DKIM, and DMARC checker.

Tools to help diagnose it

SPF, DKIM, and DMARC checker

Check your domain’s email authentication DNS records, count SPF lookups and diagnose deliverability issues

SPF record generator

Build a valid SPF record for your domain from the email services you use

Email header analyzer

Trace your email’s delivery path and check SPF, DKIM, and DMARC authentication results

A free tool provided by Auth-Email

Auth-Email makes your Gmail, Outlook, or other OAuth 2.0 email account available to any IMAP, POP3, or SMTP email client — no app passwords or special configuration needed.

Read the docsTry Auth-Email →

← Look up another email error