550 5.7.133: Microsoft group rejects external senders
550 5.7.133Sender not authenticated for groupPermanent: retrying will not helpFrom Microsoft 365 and Outlook.com
550 5.7.133 RESOLVER.RST.SenderNotAuthenticatedForGroup; authentication required; Delivery restriction check failed because the sender was not authenticated when sending to this group
What it means
This is Exchange Online’s specific code for a distribution group or Microsoft 365 group that refuses unauthenticated senders. Your message came from outside the organisation, so the group’s delivery restriction stopped it. The NDR usually reads like the example and names the SenderNotAuthenticatedForGroup reason.
Microsoft uses a family of these codes: 5.7.133 for groups, 5.7.134 for mailboxes, 5.7.135 for public folders, and 5.7.136 for mail users. Older NDRs show the same condition as 5.7.1 AuthRequired. Group owners often leave the default in place without realising customers mail the alias.
Likely causes
- A new distribution group kept its default of internal senders only.
- A Microsoft 365 group was created without the option to let people outside the organisation email it.
- An alias such as support@ was moved from a mailbox to a group during a cleanup.
How to fix it
- Sender: tell the recipient their group address refuses outside mail; there is nothing to fix in your DNS.
- Recipient admin: open the group in the Exchange admin center, Settings, and allow external senders.
- For a distribution group: Set-DistributionGroup support -RequireSenderAuthenticationEnabled $false.
- For a Microsoft 365 group: Set-UnifiedGroup support -RequireSenderAuthenticationEnabled $false.
- Ask the sender to resend and confirm delivery.
Checks that apply
- MailFlow Monitor Sends an outside test to the group after the change so you can confirm it now accepts external mail.
- MX Lookup Confirms the domain routes to Exchange Online, the system enforcing the group restriction.
FAQ
- Is it safe to open a group to the internet?
- Yes for support or sales aliases that customers use. Keep internal only for staff lists that attract spam.
- Why do some colleagues get through?
- Signed in users in the same tenant are authenticated, so they are not affected by the restriction.