550 5.7.509
Returned by Microsoft (Outlook.com, Exchange Online). The wording varies between operators and versions; the code is what identifies it.
Access denied, sending domain [yourdomain.com] does not pass DMARC verification and has a DMARC policy of reject.
What the receiving server did
This rejection is unusual in one important way: it is your own instruction being carried out. Microsoft found a DMARC record on the domain in your From address, that record said p=reject, and the message did not satisfy it — so Microsoft did what you asked.
DMARC is satisfied when SPF passes for a domain that aligns with the From domain, or DKIM passes for a domain that aligns with the From domain. Either one is enough. Both failing, or both passing for some unrelated domain, produces this code.
Alignment is where most legitimate mail fails. A forwarding service, a mailing list or an ESP can pass SPF for its own domain while your From header says something else entirely — the check passes, the alignment does not.
Why yours failed — in the order it is usually true
- 1
A sending service passes SPF under its own domain, not yours
Read the Authentication-Results header of a message that got through elsewhere. spf=pass smtp.mailfrom=bounces.provider.com next to a From address at your domain is exactly this case. The fix is DKIM signing with your domain, which providers usually call "domain authentication".
DMARC p=none is monitoring, not protection — how to reach enforcement - 2
The message was forwarded, which breaks SPF by design
A forwarded message arrives from the forwarder’s server, so SPF checks that server against your record and fails. Only DKIM survives forwarding intact, which is why a domain at p=reject needs DKIM working rather than SPF alone.
- 3
A subdomain is sending and inherits the policy
Without an sp= tag, subdomains inherit the organisational domain’s policy. Mail from a marketing subdomain with no records of its own is rejected under the parent’s p=reject.
DMARC sp= leaves your subdomains spoofable - 4
You moved to p=reject before the reports were clean
If aggregate reports were never collected, or were collected and never read, enforcement was switched on without knowing which senders would break. Stepping back to p=quarantine with pct= is the recovery, not a defeat.
DMARC with no rua= — you are flying blind
The record
Stepping down to quarantine at 25 percent restores delivery for most legitimate mail while the reports show what is actually failing. Move back up once every legitimate sender appears in the reports with SPF or DKIM passing in alignment.
Check what your domain publishes right now
Free, no signup. It counts your SPF lookups, tries 24 DKIM selectors and reads your DMARC policy, then tells you which of the causes above applies to you.