550 5.7.509: Microsoft DMARC reject
550 5.7.509Access denied, sending domain does not pass DMARC verificationPermanent: retrying will not helpFrom Microsoft 365 and Outlook.com
550 5.7.509 Access denied, sending domain example.com does not pass DMARC verification and has a DMARC policy of reject.
What it means
Microsoft checked the domain in your visible From header against its DMARC record, found that neither SPF nor DKIM passed in alignment with it, and saw `p=reject`. It therefore refused the message with 5.7.509, as RFC 7489 allows the receiver to do. The text usually reads like "sending domain does not pass DMARC verification and has a DMARC policy of reject".
This is the domain owner’s own policy being applied, which separates it from 5.7.1 "not authenticated" bounces or 5.7.23 SPF failures. Microsoft is doing what your DNS asked for.
If you own the From domain, you fix it. If you are a third party sending on someone else’s behalf, the domain owner has to authorize your service in SPF or DKIM.
Likely causes
- A new sending service (CRM, ticketing, newsletter tool) was added without DKIM signing for your domain.
- SPF passes only for the service’s bounce domain, so it does not align with your From domain.
- The message was forwarded or modified by a list, breaking DKIM while SPF fails at the new hop.
- Someone is spoofing your domain and the rejection is working as intended.
How to fix it
- Find which system sent the bounced message by reading its headers and the Authentication-Results line.
- Turn on DKIM for that service with your own domain as `d=`, publishing the CNAME or TXT records it gives you.
- If you rely on SPF, set a custom return path on your domain and include the service, for example `v=spf1 include:spf.protection.outlook.com include:_spf.example.net -all`.
- Watch DMARC aggregate reports for a week and only then keep `p=reject`; use `p=quarantine` meanwhile if many legitimate streams still fail.
Checks that apply
- DMARC Check Shows your published policy, alignment modes, and report addresses, which decide whether Microsoft rejects.
- DKIM Check Confirms the selector your service signs with is published and valid for your domain.
- Email Header Analyzer Parses the Authentication-Results of the failed message so you can see which check broke alignment.
- DMARC Report Analyzer Aggregate reports list every source sending as your domain and whether it aligns.
FAQ
- Did Microsoft start enforcing my DMARC record without telling me?
- Microsoft honours `p=reject` for inbound mail, and the policy is yours. If you published reject, failing mail bounces with this code.
- Is it safe to weaken my policy to stop the bounces?
- Only briefly. Fix alignment for the legitimate sender and then return to reject so spoofed mail keeps bouncing.