550 5.7.1 AuthRequired: Microsoft group needs auth
550 5.7.1Delivery restriction: authentication requiredPermanent: retrying will not helpFrom Microsoft 365 and Outlook.com
550 5.7.1 RESOLVER.RST.AuthRequired; authentication required
What it means
Exchange lets admins require that senders to a recipient are authenticated, meaning they are inside the organisation. The setting is RequireSenderAuthenticationEnabled, and it is on by default for new distribution groups. When an external sender writes to such a recipient, the resolver refuses the message with this 5.7.1 text.
This 5.7.1 is a delivery restriction inside the recipient tenant, not a spam verdict. Generic 5.7.1 bounces from other servers usually mean a policy block or a blocklist hit; here it is a simple permission switch. Newer Exchange Online NDRs use more specific codes such as 5.7.133 for the same group setting.
Likely causes
- An outside sender wrote to a distribution group that only accepts internal senders.
- A partner or vendor emailed a shared alias like sales@ that was created as a group with default settings.
- An internal app relays through a server that sends anonymously, so Exchange sees it as external.
- A Microsoft 365 group has external senders turned off.
How to fix it
- Sender: tell the recipient organisation the address bounces with AuthRequired; you cannot fix it from your side.
- Recipient admin: in the Exchange admin center open the group, Settings, and allow people outside the organisation to send to it.
- With PowerShell: Set-DistributionGroup sales -RequireSenderAuthenticationEnabled $false.
- For a Microsoft 365 group, enable the option to let people outside the organisation email the group.
- For internal apps, authenticate the relay or use a connector so Exchange treats the mail as internal.
Checks that apply
- MX Lookup Confirms the recipient domain is hosted on Exchange Online, so this group setting applies.
- MailFlow Monitor Sends an external test to the group after the change and confirms it now delivers.
FAQ
- Is my domain blocked?
- No. Any external sender gets the same bounce. It is a setting on the recipient group.
- Why did internal tests work?
- Internal senders are authenticated, so they pass the restriction. Only external mail is refused.