SMTP 550 5.7.509

Common questions

What does SMTP 550 5.7.509 mean?

SMTP 550 5.7.509 means Microsoft 365 rejected the message because the domain in its From header failed DMARC, and that domain publishes p=reject. The text reads "Access denied, sending domain does not pass DMARC verification and has a DMARC policy of reject." The fix is your domain's authentication.

Should I retry a 550 5.7.509 error?

No. 550 is a permanent failure, so the message will never be delivered no matter how many times you try. Remove the address — repeated sends to permanent failures are one of the main signals mailbox providers use to throttle a sender.

How do I fix SMTP 550 5.7.509?

Find which service sent the failing message and set up aligned DKIM for it.

Is 550 5.7.509 a hard bounce or a soft bounce?

550 5.7.509 is a block rather than a classic hard or soft bounce. The rejection is about your sending (authentication, reputation, content or the recipient's policy), not about whether the address exists. Retrying changes nothing until the cause on your side is fixed.

Should I remove the address after a 550 5.7.509 bounce?

Keep it. DMARC is about your domain's authentication.

Will verifying my list prevent 550 5.7.509?

Not directly. This code is about your authentication, IP or domain reputation, so verification will not lift it. A clean list still matters, because mailbox providers weigh how often a sender hits addresses that don't exist.