A 550 5.7.515 bounce means Outlook.com, which also handles Hotmail, Live and MSN addresses, refused your email because your domain didn't meet Microsoft's authentication rules. Microsoft wants SPF and DKIM to pass, plus a DMARC record of at least p=none that lines up with one of them, and since 5 May 2025 it has been rejecting email that fails instead of sending it to junk.
What the bounce says
Microsoft gives the full error as:
550 5.7.515 Access denied, sending domain yourbusiness.com.au does not meet the required authentication level.
It's usually followed by this line: "The sender's domain in the 5322.From address doesn't meet the authentication requirements defined for the sender." The 5322.From address is simply the From address your recipient sees. Some bounces say "doesn't meet" instead of "does not meet". Many also list the results, such as Spf=Pass, Dkim=Fail, DMARC=Pass. If yours does, that tells you which check to fix first.
A 550 code is a permanent rejection. The email was not delivered and won't be retried.
Who this applies to
This rule belongs to Outlook.com, Microsoft's free consumer email. It covers addresses ending in outlook.com, hotmail.com, live.com and msn.com. Microsoft 365 business mailboxes use different checks.
Microsoft aims these requirements at domains that send more than 5,000 emails a day to its consumer addresses. It counts by the domain in the From address. So every service that sends as yourbusiness.com.au adds to the total: your newsletter tool, your accounting software, your website and your staff mailboxes. Once a domain passes that level, Microsoft expects every email from it to meet the rules, including everyday one-to-one email. Smaller senders have also reported this bounce when one check fails, so don't assume you're too small for it to matter.
When Microsoft started enforcing it
Microsoft announced the requirements on 2 April 2025. At first it planned to send failing email to junk. On 29 April 2025 it changed course, and from 5 May 2025 it rejects failing email with the 550 5.7.515 code. Microsoft also says adding a sender to safe senders won't get around these rules.
What Outlook.com requires
- SPF must pass. Your SPF record must list the server that sent the email.
- DKIM must pass. The email must carry a valid DKIM signature.
- DMARC must exist and pass. You need a DMARC record of at least p=none. SPF or DKIM (at least one) must pass for your own domain, not just your sending service's domain. This match is called alignment.
Note that Microsoft wants both SPF and DKIM to pass, which is stricter than DMARC on its own.
How to fix it
1. Find out which service sent the bounced email
Was it your Microsoft 365 mailbox, a newsletter, an invoice from your accounting software or a website form? Each one sends from different servers, so each one needs its own setup.
2. Make SPF pass
If Microsoft 365 is your only sender, use this record:
| Type | Name | Value |
|---|---|---|
| TXT | yourbusiness.com.au | v=spf1 include:spf.protection.outlook.com ~all |
If another service sends for you, add its include: value to the same record. Keep only one SPF record, and keep it under 10 DNS lookups.
3. Make DKIM pass for your own domain
For Microsoft 365: in the Microsoft Defender portal go to Email & collaboration → Policies & rules → Threat policies → Email authentication settings → DKIM. Select yourbusiness.com.au, add the two CNAME records it shows (selector1 and selector2), then switch on "Sign messages for this domain with DKIM signatures".
For any other service: turn on DKIM signing for yourbusiness.com.au in the service that sends the email, and add the DKIM record it gives you to your DNS. Most services call this "domain authentication". If the service offers a custom bounce or return-path domain, set that up too, so SPF passes for your domain.
4. Add a DMARC record
Add this record. It starts in monitoring mode (p=none), so nothing changes for your email yet. Change the rua address to a mailbox you read; once reports show all your genuine email passing, move to p=quarantine.
| Type | Name | Value |
|---|---|---|
| TXT | _dmarc.yourbusiness.com.au | v=DMARC1; p=none; rua=mailto:dmarc-reports@yourbusiness.com.au |
5. Test, then resend
Send one email from the service that bounced to your private test address. We check SPF, DKIM, DMARC, alignment and Outlook.com's sender rules, and show a verdict for Outlook.com, Microsoft 365, Gmail, Google Workspace and Yahoo. If anything still fails, the report shows the exact record to change. When everything passes, resend the email that bounced.
Checked against: Microsoft Support, Fix NDR error "550 5.7.515" in Outlook.com · Microsoft Defender for Office 365 Blog, Strengthening Email Ecosystem - Outlook's New Requirements for High-Volume Senders · Microsoft Q&A, Got 550 5.7.515 Access denied but I am not a high volume sender · Microsoft Learn, Set up DMARC to validate email in Microsoft 365 · Microsoft Learn, How to use DKIM for email in your custom domain.