550 5.7.12: Microsoft sender not authenticated by org
550 5.7.12Sender was not authenticated by organizationPermanent: retrying will not helpFrom Microsoft 365 and Outlook.com
550 5.7.12 Sender was not authenticated by organization
What it means
A 5.7.12 from Exchange Online says the recipient is set to accept mail only from senders the organisation authenticates, and your message arrived from outside. It usually reads like the example. The recipient might be a mailbox, a mail enabled public folder, or a group with that restriction, and Microsoft documents it alongside the newer 5.7.13x codes.
Compared with the AuthRequired form of 5.7.1, this code says less about which object is restricted, but the fix is the same kind of setting change in the recipient tenant. It is not about SPF or DKIM; perfect authentication of your domain will not help because the check is about membership of the organisation, not about domain authentication.
Likely causes
- The recipient restricted its mailbox or group to internal senders only.
- Mail from a sister company in another tenant is treated as external because no cross tenant connector or trust exists.
- An app sends from an internal address but through an anonymous relay, so the message is not authenticated.
How to fix it
- Sender: contact the recipient by another channel and ask whether external mail to that address is intended.
- Recipient admin: find the object in the Exchange admin center and turn off the requirement that senders are authenticated.
- For two tenants that work together, set up a partner connector so mail between them is treated as trusted where appropriate.
- For internal apps, send through authenticated SMTP submission or a connector bound to your IP so mail counts as internal.
Checks that apply
- Email Header Analyzer Shows the X-MS-Exchange-Organization-AuthAs header on a delivered copy, which tells you whether Exchange saw the mail as Anonymous or Internal.
- MX Lookup Confirms the recipient domain is on Exchange Online, the system that applies this restriction.
FAQ
- Will fixing my SPF stop this bounce?
- No. SPF proves your domain, but this check is about being part of the recipient organisation. Only their admin can relax it.
- How is this different from 5.7.133?
- 5.7.133 names a group explicitly. 5.7.12 is the broader organisation authentication check; both are fixed in the recipient tenant.