550 5.7.509 Microsoft: DMARC failed, reject policy
Quick answer
Exchange Online rejected the message because it failed DMARC and the sending domain publishes p=reject. Microsoft is enforcing the sender's own policy.
Recommended action: Fix sender reputation
Common causes
- A third-party service sends with your From domain but signs with its own domain and is not in your SPF record.
- Forwarding or a mailing list broke SPF and altered the message so DKIM failed.
- Someone is spoofing your domain, and DMARC is doing its job.
What to do
Read your DMARC aggregate reports to find the failing source. Add legitimate services to SPF and set up DKIM with your domain for each one. If the failures are spoofing, no action is needed.
Provider note: Like every 5.7.x reply, RocketVerifier classifies this as a block on the sender, never as an invalid recipient.
How to read 550 5.7.509
550 is the basic SMTP reply defined in RFC 5321. 5.7.509 is the enhanced status code from RFC 3463, which reads as class, subject and detail:
- Class
- 5Permanent failure
- Subject
- .7Security or policy
- Detail
- .509Microsoft: DMARC failed, reject policy
Further reading
FAQ
Frequently asked questions
Should I lower my DMARC policy to stop 5.7.509?
Only as a short-term measure while you fix a legitimate sender. Lowering the policy also lets spoofed mail through. Fix the failing source instead.
Stop hard bounces before they start
Upload a list or call the API, and send only to addresses that can receive mail. Unknown results are always free.
100 free credits · No card required · Credits never expire