What 550 5.7.509 means
Microsoft documents 5.7.509 as 'Access denied, sending domain [domain] does not pass DMARC verification and has a DMARC policy of reject'. The domain in the visible From address (the 5322.From) didn't pass DMARC, and because its owner told receivers to reject failures, Microsoft did exactly that.
DMARC passes only when SPF or DKIM passes for a domain that aligns with the From domain. A message can pass SPF for your SMTP provider's bounce domain and still fail DMARC.
What the bounce looks like
The wording providers document for this code. Your bounce may add an IP address, a session ID or a help link after it.
550 5.7.509 Access denied, sending domain [domain] does not pass DMARC verification and has a DMARC policy of reject.Why cold emailers see 550 5.7.509
- DKIM signs with your provider's domain instead of yours, and the Return-Path also uses the provider's domain, so nothing aligns.
- A new sending tool or inbox added to the domain without SPF and DKIM set up for it.
- p=reject published before every mail stream was verified as aligned.
- Forwarding that breaks SPF, combined with DKIM that was broken by message modification.
How to fix 550 5.7.509
- Check a sent message's headers for which domain signed DKIM (d=) and which domain is in the Return-Path.
- Set up DKIM with your own domain at every service that sends as you. That alone fixes most alignment failures.
- If you can't fix a stream quickly, relax DMARC to p=quarantine or p=none while you repair it, then tighten again.
- Use DMARC aggregate reports (rua) to find every source sending as your domain.
Retry or suppress?
Don't suppress the recipient. Fix alignment and resend. Every DMARC-enforcing receiver will reject the same messages.
Reading the code
The basic code 550 means "Mailbox unavailable or message refused (permanent)" under RFC 5321. In 5.7.509, the 5 is the class (permanent failure) and the 7 is the subject (security or policy). The detail number 509 isn't in the RFC 3463 / IANA registry; it's specific to the provider, so the text after the code carries the meaning.
- Class 5
- Permanent failure
- Resending the same message won't work. Something about the message, the recipient or the sender has to change first.
- Subject 7
- Security or policy
- A security or policy decision: spam filtering, authentication, blocklists, permissions.
- Detail 5.7.509
- Provider-specific
Check the rest of your setup
Run your sending domain through the SPF, DKIM & DMARC checker to see which record fails, then follow how to set up SPF, DKIM and DMARC. Paste the headers of a test message into the email header analyzer to confirm all three pass.
Got a different bounce? Paste it into the SMTP error code lookup to decode it.