Skip to content
ReputeCastReputeCast Docs

Outlook 550 5.7.515: authentication level not met

How-to guide
For:
Publishers and marketers, Workspace admins
Needs permission:
domains:managesensitive, providers:view
In the app:
Settings, then Senders

Outlook 550 5.7.515 is a permanent refusal from Microsoft’s consumer mail services (Outlook.com, Hotmail, Live.com, MSN): your From domain sends enough mail to count as a high-volume sender but doesn’t pass the authentication Microsoft requires of those senders. The fix is in your DNS records. This page lists Microsoft’s requirements and where ReputeCast checks each one.

What Microsoft means

Section titled “What Microsoft means”

The full error is:

550 5.7.515 Access denied, sending domain <domain> does not meet the required authentication level.

The sender’s domain in the 5322.From address doesn’t meet the authentication requirements defined for the sender.

Microsoft treats a domain as a high-volume sender when it sends 5,000 or more messages to Microsoft consumer email services, all with the same domain in the From address. From then on, mail from that domain must meet all of these requirements:

  1. SPF and DKIM records are published for the domain, and both SPF and DKIM checks pass.
  2. A DMARC record is published for the domain, at least v=DMARC1; p=none.
  3. The message passes DMARC: SPF or DKIM, at least one of them, aligns with the domain in the From address.

Source: Fix NDR error “550 5.7.515” in Outlook.com, Microsoft Support. Checked October 2026.

Why it happens

Section titled “Why it happens”
  • A sending provider on your route signs DKIM with its own domain instead of yours, so DKIM doesn’t align.
  • SPF fails for the return-path domain, for example after you added a sending provider without publishing its records.
  • The domain has no DMARC record.

How ReputeCast classifies it

Section titled “How ReputeCast classifies it”
  • Bounce class: policy_block, from the words “Access denied”. When a sending provider passes only the code without Microsoft’s text, the class is other.
  • Report row: Blocked · policy or reputation, or Other for the bare code.
  • Suppression: the refusal is about your domain, not the address. Most built-in adapters record it as a soft bounce; some sending providers report it as permanent, and then the address is suppressed. See when ReputeCast suppresses an address.
  • ReputeCast counts outlook.com, hotmail.com, live.com and msn.com, and their country domains, as the Outlook mailbox provider, so the live monitor and the report show these bounces under Outlook.

Where ReputeCast checks Microsoft’s requirements

Section titled “Where ReputeCast checks Microsoft’s requirements”
Microsoft requires Send Readiness, Authentication group
SPF passes Blocks the send when the domain has no SPF record or SPF doesn’t authorize a sending provider
DKIM passes Blocks the send when DKIM isn’t verified for a sending provider
A DMARC record, at least p=none Blocks the send when the DMARC record is missing or invalid
DMARC passes, with SPF or DKIM aligned Warns when less than 90% of mail aligned with DMARC over the last 7 days

Before you begin

Section titled “Before you begin”
  • domains:manage to see and check the DNS records of a sending domain.
  • Access to the DNS host of your domain.
  • providers:view to read the event log.

Meet Microsoft’s requirements

Section titled “Meet Microsoft’s requirements”
  1. Confirm the error. Open Sending providers, then Events & sync, search for an Outlook.com or Hotmail recipient and read Original code · diagnostic.
  2. Open Settings, then Senders and the domain in your From address. Its records page lists the DNS records each sending provider needs, each with a status.
  3. Publish every record that shows Missing or Pending: the DKIM records of every sending provider on your routes, the SPF record, and a DMARC record. Set up SPF, DKIM and DMARC has the steps for common DNS hosts.
  4. Where the sending provider supports a custom MAIL FROM (return path) domain, set it up so SPF aligns too.
  5. Open the next campaign’s Review & send and check that the Authentication group of Send Readiness passes.

Check that it worked

Section titled “Check that it worked”
  • Every record on the domain’s page shows Verified.
  • The next campaign’s report has no 550 5.7.515 in Original codes.

Troubleshooting

Section titled “Troubleshooting”
  • Only mail through one sending provider is refused. That provider’s DKIM records or SPF entry are missing. Check the domain’s records page for that provider.
  • DMARC passes in some reports and fails in others. Read your DMARC aggregate reports to find the sources that don’t align.
  • ReputeCast sends fewer than 5,000 messages to Microsoft. Microsoft counts messages per From domain, so mail that other systems send with the same From domain counts too.
Section titled “Related”
Report a problem with this pageReputeCast websiteHostReputeContent licensed under CC BY 4.0