550 5.7.506: Microsoft rejects bad HELO name
550 5.7.506Access denied, bad HELOPermanent: retrying will not helpFrom Microsoft 365 and Outlook.com
550 5.7.506 Access Denied, Bad HELO
What it means
Every SMTP client opens with HELO or EHLO and names itself. RFC 5321 expects that name to be the client’s own fully qualified domain name. Exchange Online refuses the connection with 5.7.506 when your server introduces itself as the very server it is connecting to, or as something in the recipient’s or Microsoft’s namespace.
This is a protocol level rejection that happens before any message content is read, so SPF, DKIM, and DMARC never get evaluated. It is different from 5.7.25 style PTR problems, where reverse DNS is missing, and from banned IP codes like 5.7.606, where the IP itself has a bad record.
The person who must fix it is whoever runs the sending mail server or appliance. The recipient cannot whitelist around it.
Likely causes
- The MTA was configured with the recipient’s host name, for example `example-com.mail.protection.outlook.com`, as its own HELO name.
- A copier, scanner, or line of business app was set up with the target server name in the "local hostname" field.
- A template configuration copied from a Microsoft setup guide left the smart host name in the HELO setting.
- A load balancer or NAT device rewrites the greeting with a name it does not own.
How to fix it
- Find the HELO/EHLO name your server sends: in Postfix it is `smtp_helo_name` (defaulting to `myhostname`), in Exchange Server it is the FQDN on the send connector.
- Set it to a name you own that resolves to the sending IP, such as `mail.example.com`.
- Make sure that name has an A record pointing at the public sending IP and that the IP’s PTR points back to the same name.
- Restart or reload the mail service and send a test message to an Exchange Online mailbox.
Checks that apply
- Reverse DNS (PTR) Shows the reverse DNS name of your sending IP, which is the natural choice for the HELO name.
- A Record Confirms the HELO name you pick resolves forward to the same public sending address.
- SMTP Diagnostics Connects to your own mail host so you can see the banner and certificate name it presents, which usually matches what it should send in EHLO.
FAQ
- Why does Microsoft care what my server calls itself?
- Spoofing the recipient’s own host name in HELO is a classic spam trick, so Exchange Online treats it as a reason to drop the session outright.
- Will mail queue and retry after a 5.7.506?
- No. It is a 5xx reply, so the sending server gives up and bounces the message until you change the HELO name.