550 5.7.515: Outlook.com authentication requirements
550 5.7.515Access denied, sending domain does not meet the required authentication levelPermanent: retrying will not helpFrom Microsoft 365 and Outlook.com
550 5.7.515 Access denied, sending domain example.com does not meet the required authentication level.
What it means
In 2025 Microsoft began enforcing sender requirements for domains that send more than 5,000 messages a day to its consumer mailboxes (outlook.com, hotmail.com, live.com). Mail from such a domain must pass SPF, pass DKIM, and have a DMARC record of at least `p=none` that aligns with SPF or DKIM. Mail that falls short is rejected with 5.7.515.
This differs from 5.7.509, which applies your own DMARC reject policy. With 5.7.515 Microsoft is applying its policy, even if yours is relaxed. It is also stricter than a plain 5.7.1 "not authenticated" bounce, because all three mechanisms are expected.
The sending domain owner fixes it. Recipients cannot exempt you.
Likely causes
- Your domain has no DMARC record at all.
- One of your sending services does not sign with DKIM, or signs with its own domain instead of yours.
- SPF fails because the record misses a service or exceeds the 10 lookup limit.
- Neither SPF nor DKIM aligns with the visible From domain, so DMARC fails.
How to fix it
- Publish SPF that lists every sender, for example `v=spf1 include:spf.protection.outlook.com include:_spf.example.net -all`, and keep it under 10 DNS lookups.
- Enable DKIM for each sending service with your own domain as `d=`.
- Publish DMARC, starting with `v=DMARC1; p=none; rua=mailto:dmarc@example.com`.
- Use aggregate reports to confirm every source aligns, then tighten the policy.
- Also make sure you have a working unsubscribe link and valid From and Reply-To addresses, which Microsoft lists as expectations for bulk senders.
Checks that apply
- Microsoft Compliance Grades your domain against Microsoft’s bulk sender requirements in one pass.
- SPF Check Validates the record and counts DNS lookups so you do not fail on PermError.
- DKIM Check Checks that each selector your services use is published and parses.
- DMARC Check Confirms the DMARC record exists, its policy, and where reports go.
FAQ
- I send fewer than 5,000 messages a day, does 5.7.515 apply to me?
- The rule targets high volume senders, but Microsoft can apply it to any domain. Meeting the requirements costs little and protects you either way.
- Is `p=none` really enough?
- For this requirement, yes, as long as the record exists and messages align. A stricter policy is still a good idea.