ProbeKit
Sign inSign up

550 5.7.64: Microsoft TenantAttribution relay denied

550 5.7.64TenantAttribution; Relay Access DeniedPermanent: retrying will not helpFrom Microsoft 365 and Outlook.com

Example
550 5.7.64 TenantAttribution; Relay Access Denied

What it means

When a server relays mail through Exchange Online to the internet, Microsoft must work out which tenant the mail belongs to. It does that with an on premises (inbound) connector that matches either the source IP or the certificate the server presents. If neither matches, Microsoft refuses to relay and returns 5.7.64.

You typically hit this after an on premises Exchange server, gateway, or appliance changes its public IP or renews its certificate with a different subject name. Mail to your own Microsoft 365 mailboxes may still flow, because that is not relaying; only mail to external domains fails.

Likely causes

  • Your outbound public IP changed and the inbound connector still lists the old one.
  • The connector authenticates by certificate and the new certificate’s subject or SAN no longer matches the configured name.
  • The sending server is not presenting a certificate at all because TLS is misconfigured.
  • Mail is relayed from a domain that is not an accepted domain in the tenant.

How to fix it

  1. In the Exchange admin center open Mail flow, Connectors, and check the connector from your organisation’s email server.
  2. Update its IP list to the server’s current public IP, or update the certificate name to match the new certificate.
  3. Make sure the sending server uses TLS and presents that certificate when it connects to your MX endpoint.
  4. Confirm the sender domain is an accepted domain in the tenant, then send a test to an external address.

Checks that apply

  • SMTP Diagnostics Shows the certificate your server presents, so you can compare its name with the connector’s setting.
  • SPF Check Confirms the relaying server’s IP is in your SPF, since relayed mail will be checked by recipients.
  • Reverse DNS (PTR) Checks the reverse DNS of the relay IP, which receivers also look at after Microsoft forwards the mail.
See the example diagnosed

The classification runs without network lookups and we never store your paste.

FAQ

Why does internal mail still work?
Mail to your own mailboxes is delivered, not relayed, so it does not need tenant attribution.
Is this an outage on Microsoft’s side?
Almost never. It is a connector match failure; fixing the IP or certificate name resolves it.

Microsoft 365 delist portal Outlook.com SNDS

All 191 bounce codes