550 5.7.520: Microsoft 365 blocks external forwarding
550 5.7.520Access denied, your organization does not allow external forwardingPermanent: retrying will not helpFrom Microsoft 365 and Outlook.com
550 5.7.520 Access denied, Your organization does not allow external forwarding. Please contact your administrator for further assistance.
What it means
Microsoft 365 blocks automatic forwarding to external recipients by default, because attackers who take over a mailbox often set up a forwarding rule to steal mail. When an inbox rule, mailbox forwarding setting, or redirect tries to send a copy outside the tenant, the NDR comes back as 5.7.520.
The bounce goes to the mailbox owner whose rule fired, not to the person who wrote the original message. Ordinary replies and manual forwards still work; only automatic forwarding is caught.
It is controlled by the outbound spam filter policy in Microsoft Defender, where "Automatic forwarding rules" defaults to the system controlled setting, which now means off.
Likely causes
- A user created an Outlook rule to forward everything to a personal Gmail or another company.
- An admin set mailbox level forwarding (ForwardingSmtpAddress) to an outside address.
- A shared mailbox or service account forwards alerts to an external ticketing system.
- An attacker set up a hidden forwarding rule on a compromised account.
How to fix it
- First check who created the forward and why; if nobody remembers making it, treat the mailbox as compromised.
- If the forward is legitimate, create a custom outbound spam filter policy that sets automatic forwarding to On and apply it only to the users or groups that need it.
- Leave the default policy blocking forwarding for everyone else.
- Consider a transport rule or a connector to the external system instead of personal forwarding.
- Ask the user to trigger the rule again and confirm the copy arrives.
Checks that apply
- Email Header Analyzer The NDR headers show which mailbox and rule produced the forward attempt.
- MX Lookup Shows where the external destination receives mail so you can confirm the forward goes where you expect.
FAQ
- Why did forwarding suddenly stop working?
- Microsoft changed the default so automatic external forwarding is off unless an admin allows it in the outbound spam filter policy.
- Can a user fix this on their own?
- No. Only a Microsoft 365 admin can change the outbound spam filter policy that blocks the forward.