Fix & Verify

Outlook.com · bounce code

550 5.7.515: “Access denied, sending domain does not meet the required authentication level”

Outlook.com returns this when a high-volume sender's domain does not pass the authentication Microsoft requires. The fix is in your DNS and in the settings of the services that send as your domain.

Check your domain — free

Who it applies to

Microsoft's postmaster policy: domains sending more than 5,000 emails per day to Outlook.com accounts must be fully compliant with SPF, DKIM and DMARC, effective 5 May 2025. Non-compliant messages are sent to the junk folder; if the issues remain, they may be rejected with:

550; 5.7.515 Access denied, sending domain [SendingDomain] does not meet the required authentication level.

What must pass

  • SPF must pass for the sending domain: the record lists every server and service that sends for it.
  • DKIM must pass: each sending service signs with a key published in your DNS.
  • DMARC must exist with at least p=none and align with SPF or DKIM (preferably both) — the domain in the From address must match the authenticated domain.

Most common causes

  1. A newsletter or CRM tool sends with its own domain. SPF and DKIM pass for the tool, but not for your From domain, so DMARC alignment fails. Set up the tool's domain authentication (its DKIM records).
  2. No DMARC record. Publish one at _dmarc.yourdomain, starting with p=none and a report address.
  3. SPF misses a sender or exceeds 10 DNS lookups. Either way SPF fails for some or all mail.
  4. DKIM never activated in Microsoft 365 or Google Workspace, so mailbox mail is unsigned.

DNS shows the records; whether a real message aligns shows in its Authentication-Results header. Start with the check below.

Check which part fails

Reads your domain's public DNS and shows SPF, DKIM and DMARC with the exact records to change. The domain is kept in memory for at most 10 minutes; see privacy policy, section 8.

What a fix cannot promise

Passing authentication is a requirement, not a guarantee: content, list quality and sender reputation also decide where mail lands. We do not promise inbox placement.

Sources

Fix & Verify: we work out the exact records for every service that sends as your domain, you publish them, we re-check independently.