550 5.7.509: DMARC reject policy failed (Microsoft)
Your message failed DMARC, and your domain's own DMARC record says to reject mail that fails. Microsoft followed your instruction.
Blocked The address is probably fine. The problem is how the mail was sent.
What the bounce message looks like
The wording changes from one provider to another. These are typical examples:
550 5.7.509: Access denied, sending domain [example.com] does not pass DMARC verification and has a DMARC policy of reject.Common causes
- SPF and DKIM don't pass for the domain in your From address
- A new email service that isn't set up with SPF or DKIM for your domain
- A forwarding service that broke authentication
How to fix it if you sent the email
- Find which service sent the message and set up SPF and DKIM for your domain with it.
- Check your records with the DMARC checker.
- If you're still setting things up, use p=none until all your mail passes. See the DMARC generator.
If you manage the receiving or sending mail system
- Read your DMARC reports to find every service that sends as your domain.
Free tool: paste the full bounce into the bounce message decoder to get a plain-English reading of every code in it.
Questions people ask
- What does 550 5.7.509 mean?
- Your message failed DMARC, and your domain's own DMARC record says to reject mail that fails. Microsoft followed your instruction.
- Is 550 5.7.509 a hard or soft bounce?
- Blocked. The address is probably fine. The problem is how the mail was sent.
- Should I remove the address after a 5.7.509 bounce?
- No. Fix how the mail is sent; the address itself is probably fine.